The CASL Business-to-Business Exemption: When Ontario Companies Don’t Need Consent

If your Ontario business sends marketing emails, newsletters, or sales outreach, you have probably heard of Canada’s Anti-Spam Legislation (CASL) and its consent requirements. What surprises many business owners is that CASL was never meant to police ordinary business-to-business communication the same way it polices consumer marketing.

There is a recognized business-to-business exemption built into CASL, and understanding its actual scope — not the version you half-remember from a webinar — matters. Get it wrong in one direction and you are needlessly asking every supplier and client for opt-in consent. Get it wrong in the other direction and you are sending unconsented commercial messages you assumed were exempt.

This article walks through what CASL regulates, how the business-to-business exemption works, and where its edges are.

What CASL Actually Regulates

CASL applies to "commercial electronic messages" (CEMs) — emails, texts, and other electronic messages that encourage participation in a commercial activity, including messages promoting a business’s products, services, or brand. As a general rule, sending a CEM requires the recipient’s consent (express or implied), clear identification of who sent it, and a working way to unsubscribe.

CASL is broad by design, which is exactly why Parliament built in a series of exemptions for message types that do not fit the consumer-spam problem the law was written to solve. The business-to-business exemption is one of the most commonly relied on — and one of the most commonly misapplied.

The Business-to-Business Exemption, In Plain Language

Generally speaking, the exemption is understood to cover a message sent by an employee, representative, consultant, or franchisee of one organization to an employee, representative, consultant, or franchisee of another organization, where the two organizations already have a relationship and the message concerns the recipient’s role, functions, or duties within that organization.

Picture an account manager at a packaging supplier emailing a client’s operations manager about an upcoming contract renewal. That is the kind of exchange the exemption is built around — it is business continuing to talk to business about business it is already doing.

The conditions generally need to line up together

• [ ] The message comes from a person acting for one organization (employee, representative, consultant, or franchisee)
• [ ] It goes to a person acting for another organization, in the same kind of capacity
• [ ] The two organizations have an existing relationship
• [ ] The content relates to the recipient’s role, functions, or duties — not a general pitch unconnected to their job

If any one of those pieces is missing, do not assume the exemption saves you. Treat it as a narrow, fact-specific carve-out rather than a blanket pass for anything sent to a corporate email address.

Where the Exemption Doesn’t Reach

• Consumer marketing. The exemption is about organization-to-organization messages, not messages to individual consumers, even if you found their address through a work context.
• Cold outreach. A first-contact sales email to a company you have never dealt with is not automatically covered — the exemption presumes an existing relationship between the two organizations.
• Off-topic content. A message unrelated to the recipient’s job duties (a general newsletter, an unrelated product line) is on shakier ground even if sent to a work address.
• Mixed contact lists. Many businesses maintain one list that blends genuine B2B contacts with personal addresses or former colleagues. Sending the same campaign to the whole list can quietly step outside the exemption for part of the audience.
• Other CASL exemptions. Referral exemptions, personal-relationship exemptions, and others each have their own separate conditions. Qualifying for one does not mean you qualify for all of them.

Even where the exemption technically applies, including clear sender identification and a working unsubscribe option is still good practice — relationships end, roles change, and today’s exempt contact can become tomorrow’s compliance question.

Practical Compliance Steps for Ontario Businesses

1. Map your business contacts. Separate genuine organization-to-organization relationships from personal or consumer-facing addresses before you send anything.
2. Check relevance. Confirm the message actually concerns the recipient’s role or the receiving organization’s business — not just that the recipient happens to work somewhere.
3. Document the relationship. Keep a record of how and when the business relationship with the recipient organization began.
4. Build in identification and opt-out anyway. Treat these as standard practice, not just a CASL-driven checkbox.
5. Flag purchased or scraped lists. Third-party contact lists rarely come pre-sorted into "exempt" and "not exempt" — have a lawyer review how you use them before a campaign goes out.

How This Fits with Other CASL Consent Rules

The business-to-business exemption is only one route to compliance. Separately, CASL recognizes implied consent in some ongoing or recent business relationships, and express consent obtained directly from the recipient covers essentially any message. Many businesses end up relying on a mix of all three, which is exactly why a periodic legal review of your marketing and outreach list is worth the modest cost — the most common gap we see is a single campaign sent to a list that quietly mixes exempt and non-exempt recipients.

Frequently asked questions