- CASL applies broadly to commercial electronic messages — email, text messages, and some social media messages — that encourage participation in a commercial activity.
- Express consent means the recipient affirmatively agreed to receive commercial messages from you — typically through an opt-in checkbox that is not pre-checked, a sign-up form, or a…
- CASL recognizes several situations where consent can be implied from an existing relationship or context, without a separate opt-in step — for example: - An existing business…
Canada's Anti-Spam Legislation, known as CASL, starts from a premise that trips up a lot of otherwise careful businesses: you generally need consent before sending a commercial electronic message, not just an easy way to unsubscribe after the fact. The trouble is that CASL recognizes two different kinds of consent — express and implied — and treating them as interchangeable is one of the most common compliance mistakes an Ontario business can make.
The Default Rule: Consent Before You Send
CASL applies broadly to commercial electronic messages — email, text messages, and some social media messages — that encourage participation in a commercial activity. The starting assumption under CASL is opt-in, not opt-out: you need consent before sending, and a working unsubscribe mechanism does not substitute for having had consent in the first place. Businesses that build a list first and plan to "let people unsubscribe if they don't want it" have the framework backwards.
Express Consent: The Clearer, Safer Path
Express consent means the recipient affirmatively agreed to receive commercial messages from you — typically through an opt-in checkbox that is not pre-checked, a sign-up form, or a similar clear action where it is obvious what they are agreeing to and who is asking. Express consent, once properly obtained and documented, generally does not expire the way implied consent can, which is why it is the more durable foundation for an ongoing email program.
Implied Consent: The Narrow Exceptions
CASL recognizes several situations where consent can be implied from an existing relationship or context, without a separate opt-in step — for example:
- An existing business relationship, such as a past purchase, a contract, or an inquiry from the recipient about your products or services.
- An existing non-business relationship, such as a membership or a donation.
- Contact information the recipient has conspicuously published or directly provided to you, such as through a business card exchange, in a context relevant to your message.
Implied consent is real, legally recognized consent — but it is narrower than express consent and, in some categories, time-limited in a way express consent generally is not. The exact time periods attached to different implied-consent categories can matter a great deal and are worth confirming against current guidance before you rely on one.
Express vs. Implied Consent at a Glance
| Express Consent | Implied Consent | |
|---|---|---|
| How it arises | An affirmative opt-in action by the recipient | An existing relationship or specific context recognized by CASL |
| Durability | Generally does not expire on its own | Can be time-limited depending on the category |
| Proof burden | Easier — you can point to the specific opt-in action and record | Harder — you must show the relationship or context that supports it |
| Best use | Ongoing marketing programs, newsletters | A single relevant message tied closely to the underlying relationship |
Consent That Has Expired or Was Never Valid
A pre-checked box, a purchased list, or an old business card someone handed you years ago are all common sources of consent problems — the first because it is not a genuine affirmative action, the other two because implied consent tied to a relationship or a contact-sharing event can run out. If you cannot clearly explain, for any name on your list, what kind of consent you are relying on and why it is still valid, that is a gap worth closing before your next send.
Practical Steps to Build a Defensible Consent Record
- [ ] Keep a record of how and when each contact's consent was obtained.
- [ ] Use a genuine opt-in action for express consent — never a pre-checked box.
- [ ] Flag implied-consent contacts separately, and track the relationship or event the consent is based on.
- [ ] Periodically review and refresh your list rather than letting old contacts accumulate indefinitely.
- [ ] Make sure every message includes the identification and unsubscribe information CASL requires.
Frequently asked questions
If someone gives me their business card, can I add them to my newsletter?
Possibly, under the implied-consent category for conspicuously published or directly disclosed contact information — but this depends on the context in which the card was given and how closely your message relates to it, so it is narrower than many businesses assume.
Does implied consent ever become express consent?
No — they are separate legal categories. If you want the durability of express consent, the better approach is to ask directly for an opt-in rather than assuming implied consent will do the job indefinitely.
Can I email past customers who have not bought anything in years?
It depends on how long ago the relationship existed and which implied-consent category you are relying on. Some implied-consent windows are shorter than businesses expect, so this is worth checking rather than assuming.
What is the safest approach for a new business with no existing customer relationships?
Build your list on express consent from day one. It takes more upfront effort than relying on implied consent, but it avoids the recurring question of whether a given contact's consent has lapsed.
This is a corporate question
Start a file online — flat, published fees, reviewed by a licensed Ontario lawyer before a dollar is owed.