email · 3 august 2026 · 7 min read

CASL email marketing: what a Canadian small business can actually send

Most Canadian small businesses sending marketing email are somewhere between "probably fine" and "quietly in breach", and can't tell which. CASL email marketing rules are stricter than the ones most email tools are built around — the penalties reach $10 million per violation — but the actual requirements are short enough to read in one sitting. Here they are in plain English.

One thing first, because it matters: this is a plain-English summary, not legal advice. We're a marketing company, not a law firm. Everything below is sourced to the regulators' own pages and linked so you can check it, and if you're making a decision with real money attached, confirm it with the CRTC or an adviser.

what the CASL email marketing rules actually cover

CASL governs the commercial electronic message, or CEM. The CRTC defines that as any message where one of the purposes is to encourage the recipient to participate in a commercial activity — an offer to sell, a promotion, a business opportunity, or promoting a person who does those things.

Two things are commonly got wrong.

Business-to-business email is covered, apart from one narrow exemption. Plenty of owners assume company-to-company email sits outside CASL. It generally doesn't — but the regulations do exempt messages sent between employees, representatives, consultants or franchisees of two organisations where the organisations already have a relationship and the message concerns the activities of the organisation receiving it. The load-bearing word is relationship. Emailing a business you've never dealt with doesn't qualify, so the exemption is no help at all for cold outreach.

It isn't only email — but it isn't all of social media either. CASL applies to messages sent to an "electronic address", which it defines as an email account, an instant messaging account, a telephone account, or any similar account. SMS and instant messages are in. Some social accounts may count as a "similar account", which the CRTC says has to be decided case by case — and in general CASL does not apply to a one-way general broadcast, such as posting publicly to your own feed. Sending someone a direct pitch is a different matter from posting.

express versus implied consent — the distinction that decides everything

You need consent before sending. It comes in two forms, and knowing which one you're relying on for each contact is the whole job.

Express consent is someone actively agreeing, in writing or verbally. It has no expiry date unless the person withdraws it. You cannot get it with a pre-checked box — it needs a positive action, like ticking an unticked box or filling in a signup form. And the burden of proof sits with you: if it's ever questioned, you have to show you obtained it, which in practice means recording what someone agreed to, when, and how.

Implied consent is narrower and, critically, it expires. The CRTC sets out when you have it:

• An existing business relationship — two years from a purchase, contract or other transaction.
• An inquiry or application — six months from when they asked. Someone requesting a quote gives you six months, not forever.
• An existing non-business relationship, such as membership of your club or someone volunteering for your charity.
• Conspicuous publication of their address — the one everybody asks about, covered below.

The practical consequence is that implied consent is a clock, not a status. A list built from quote requests two years ago is not a list you can still email, however warm those people once felt.

Where p.a. fits: we write and produce the emails, you own the list and the consent record. That division matters — no outside party can manufacture consent you don't have. We're the vendor here, so weight our opinion accordingly.
See what the packages cost →

can you email an address you found online?

This is the question every Canadian business actually wants answered, and the honest response is: only under specific conditions.

The CRTC's guidance says you can rely on conspicuous publication — someone posting or publishing their email address — only when both of these hold:

• there is no statement with the address saying they don't want to receive commercial messages; and
• your message is relevant to that person's business, role, functions or duties in a business or official capacity.

That second condition does the heavy lifting, and the CRTC's own example makes it concrete. A company publishes its employees' addresses, including the chief operating officer's. A training company emails the COO promoting a course on how to be an administrative assistant. The regulator's verdict: not relevant to that recipient's role, so the exemption doesn't apply.

Read that carefully, because it kills the most common assumption. "Their address was public" is not the test. The test is whether what you sent matches what that person does. A generic blast to every address you scraped fails it by design, no matter where the addresses came from.

We'll be straight about our own position, since we do cold outreach ourselves: this exemption is the lane we operate in. We only use business addresses the company has published itself, we skip any that carry a do-not-contact notice, and each message has to be about that specific business's marketing — which is why we write them one at a time rather than sending one template to a list. The day we sent a generic blast, we'd be outside the exemption, and so would you.

the three things every message must contain

Consent is only half of it. Every CEM also has to carry:

1. Who you are. Identify the sender, and anyone else on whose behalf the message is sent.
2. A valid mailing address, which must stay current for at least 60 days after you send the message.
3. A working unsubscribe mechanism that's simple and quick to use, stays valid for at least 60 days after sending, and is actioned without delay — and in any case no later than 10 business days.

The unsubscribe clock is where small businesses most often slip. Ten business days is the outer limit, not a target, and "I only do the list on weekends" is not a defence. If your unsubscribes require you to remember to do something manually, that's the part to automate first.

what this means for a small list

The rules land differently depending on where your contacts came from, so sort them before your next send:

• Signed up on your site or in person — express consent. Keep the record of when and how, and you're on the firmest ground available.
• Bought from you — implied, two-year clock running from the transaction. Use that window to convert them to express consent by asking them to subscribe properly.
• Asked for a quote — implied, six months. Short. Ask for express consent while you're still talking to them.
• Address found online — only under the conspicuous-publication conditions above, and only with content relevant to their role.
• A list you bought — no consent. Someone else's consent doesn't transfer to you.

The recurring theme is that the strongest position is always express consent, and the best time to collect it is while implied consent is still running. That's a marketing job, not a legal one: give people a reason to subscribe deliberately rather than relying on a clock you can't see.

It's also just better email. A list that opted in outperforms one that tolerated you — which is the same argument our guide to email that doesn't get deleted makes on purely commercial grounds, before compliance enters into it.

the honest takeaway

CASL email marketing compliance comes down to four questions you should be able to answer about any contact on your list: which kind of consent do I have, when does it run out, can I prove it, and does this message actually relate to this person? Get those right and the mechanics — identify yourself, keep a mailing address live for 60 days, honour unsubscribes within 10 business days — are straightforward.

Penalties run to $1 million per violation for an individual and $10 million for a business, which is the number that gets attention. But the realistic risk for most Canadian small businesses isn't a CRTC penalty — it's building a year of marketing on a list you'll eventually have to stop emailing. Sorting the consent question early costs you an afternoon. Discovering it late costs you the list, and every deal that would have come from it.

Deciding what that list is worth to you in the first place is a separate exercise — our guide to setting a marketing budget in Canada covers it.