Can my Ontario business use customer email addresses for marketing without separate consent?

Generally, no, not without thinking carefully about consent first. Under PIPEDA, using personal information, including an email address collected for one purpose, like completing a purchase or a booking, for a different purpose, like ongoing marketing, generally requires meaningful consent tied to that new purpose. Consent obtained for order fulfillment doesn't automatically stretch to cover unrelated promotional use just because the business already has the address on file.

On top of PIPEDA's consent requirements, a separate federal anti-spam law governs sending commercial electronic messages like marketing emails specifically, generally requiring its own consent, which can sometimes be implied from an existing business relationship but only for a limited time and in limited circumstances, along with a working way for recipients to unsubscribe. These two federal frameworks overlap but aren't the same thing, and satisfying one doesn't automatically satisfy the other.

Because both regimes are federal and neither is optional based on business size, Ontario businesses building a marketing list from customer transactions should set up clear, specific consent at the point of collection, and honour unsubscribe requests promptly, rather than assuming an existing customer relationship is enough on its own.