A practical CASL checklist for email and SMS follow-up

Important: this article is general information, not legal advice. CASL is detailed and fact-specific. Review your consent practices with a qualified Canadian lawyer before relying on them.

Canada’s Anti-Spam Legislation (CASL) applies to commercial electronic messages (CEMs) — including email and text messages — sent to or from Canadian computers and devices. For service businesses using automated follow-up, it’s essential to get the basics right.

1. Know which messages are commercial

A message is generally commercial if one of its purposes is to encourage participation in a commercial activity — promoting a service, an offer or a consultation. Some messages, such as those responding to a specific request or providing information about an ongoing transaction, may be treated differently. Map each message in your automation to a category and have your advisor confirm the classification.

2. Understand express vs. implied consent

• Express consent is given actively (e.g. ticking an unticked box) for a clearly described purpose. It does not expire unless withdrawn.
• Implied consent can arise from an existing business or non-business relationship — for example, an inquiry or a purchase — but it is time-limited. Commonly cited windows are six months after an inquiry and two years after a purchase or contract. Confirm the specifics for your situation.

3. Request express consent properly

• Use an unticked checkbox — pre-checked boxes are not considered valid express consent.
• Keep marketing consent separate from agreeing to terms or submitting an enquiry.
• State the purpose (e.g. marketing emails about services and offers).
• Identify who is seeking consent, with contact information, and note that consent can be withdrawn.

4. Include identification and unsubscribe in every CEM

• Identify the sender (business name) and include contact information, including a mailing address.
• Provide a working, no-cost unsubscribe mechanism.
• Process unsubscribe requests promptly — CASL sets a maximum of 10 business days.

5. Keep evidence

If you’re ever asked, the burden is on you to show consent. Record when and how consent was obtained, the wording shown, the form or page, and when implied consent expires. Your CRM should store this alongside each contact.

6. Audit your automations

• Do nurture sequences stop when implied consent expires?
• Do reactivation campaigns only target contacts with valid consent?
• Does an unsubscribe in one tool (e.g. email) sync to every other tool (e.g. SMS, CRM)?
• Are SMS messages identified and do they include an opt-out method?

Official sources

The CRTC and the Government of Canada publish CASL guidance, and the Office of the Privacy Commissioner of Canada and provincial commissioners (such as BC’s OIPC) publish privacy guidance. Start there, and work with your lawyer.

We build consent capture, timestamps and unsubscribe handling into the email & SMS systems we design — and we recommend legal review of every client’s consent language.