CASL Penalties: What Happens If an Ontario Business Gets a CRTC Complaint

Getting a letter or a call about a complaint under Canada's Anti-Spam Legislation, known as CASL, is unsettling — in part because most businesses have never seen the enforcement process up close and do not know what actually happens next.

This article walks through how a CASL complaint typically moves through the system, who the players are, and what is realistically at stake for an Ontario business.

Who Enforces CASL

CASL enforcement is not handled by a single body. The Canadian Radio-television and Telecommunications Commission, or CRTC, is the regulator most associated with day-to-day CASL enforcement around unsolicited commercial messages, but the Competition Bureau and the federal Privacy Commissioner can also become involved depending on what a complaint actually alleges. Misleading representations, for example, or unauthorized collection of contact information, raise issues closer to those other regulators' mandates.

How a Complaint Becomes an Investigation

Recipients of unwanted commercial messages can report them, and a pattern of complaints about a particular sender is generally what draws regulatory attention — a single complaint rarely triggers a full investigation on its own. From there, the CRTC can open an investigation, which typically involves requesting information and records from the business about its consent practices, message content, and sending practices before reaching any conclusion.

What the CRTC Can Actually Do

Depending on what an investigation finds, outcomes can range widely in seriousness:

• No action, where the business's practices turn out to be compliant or the issue is resolved informally.
• A warning or compliance letter, often the outcome for a first, less serious issue.
• An undertaking, where a business agrees to specific compliance commitments, sometimes alongside a voluntary payment.
• A formal notice of violation, which can carry a significant monetary penalty and is generally reserved for more serious or repeated non-compliance.

The specific dollar amounts a notice of violation can carry are set out in the legislation and its regulations, and can be substantial. Confirm the current figures directly with current CRTC guidance or legal counsel rather than assume a number, since the amount at stake varies with the nature and history of the violation.

Factors That Affect the Outcome

• Whether this is a first issue or part of a documented pattern.
• Whether the business cooperated with the investigation and can show good-faith compliance efforts.
• The size and sophistication of the business — a large, well-resourced sender is generally held to a higher standard than a small operator.
• Whether the business has a genuine compliance program, including consent records, unsubscribe processes, and identification information, or is discovering these requirements for the first time during the investigation.

How to Respond If You Are Contacted

1. Do not ignore it. A non-response tends to make a routine inquiry worse, not make it go away.
2. Preserve your records. Consent documentation, email templates, and sending logs are exactly what an investigation will ask about.
3. Get legal advice before you respond substantively. What you say in an initial response can shape the rest of the process.
4. Use the moment to audit your broader practices, not just the specific complaint — a single complaint often points to a wider gap.

Frequently asked questions