Canadian email compliance
CASL for small business: consent, commercial email, and deliverability.
If you email customers, prospects, or subscribers in Canada, the question is not only whether the message looks professional. You need a clear reason to send it, a way for people to recognise you, and a straightforward way to unsubscribe when the message is commercial.
Updated September 2026 · General information only, not legal advice.
Start with the email your business is actually sending
Owner-operators often have more email streams than they realise: a monthly promotion, a welcome series, a quote follow-up, a booking reminder, an abandoned-cart message, an invoice, and a personal sales email. They do not all have the same purpose. Treating every message as “the newsletter” makes it harder to decide what consent, unsubscribe, and record-keeping approach applies.
Canada’s Anti-Spam Legislation, commonly called CASL, addresses commercial electronic messages. The CRTC describes three core elements for a commercial electronic message: consent, identification information, and an unsubscribe mechanism. The Government of Canada’s plain-language CASL guidance is a sensible first read before designing or changing a campaign.
What counts as a commercial electronic message?
A commercial electronic message is not limited to a polished marketing newsletter. If one purpose of a message is to encourage participation in commercial activity, it may be a CEM. That can include messages that promote services, invite a purchase, or market a business relationship. An operational message such as a receipt or an appointment detail may have a different purpose, but adding promotional content can change the analysis.
The practical move is to separate your sends into clear groups. Label the purpose of each automation and campaign. Ask whether it is necessary to deliver a requested service, whether it markets something, and which system sends it. That clarity also helps your email platform use appropriate templates and unsubscribe treatment.
Consent is more than a checked box
Express consent
Express consent is a positive agreement to receive commercial messages. The official guidance says it can be given in writing or orally, and that the sender needs to be able to prove it. In practice, a signup form should make the purpose clear, avoid pre-checked subscription boxes, record when and how consent was captured, and preserve the wording shown at the time.
Implied consent
CASL also recognises implied consent in specific circumstances, including certain existing business relationships and inquiries. It is generally time-limited. It is not a safe shortcut for every address in a CRM, every business card, or every abandoned checkout. The CRTC’s CASL FAQ explains that the sender has the onus to prove consent and gives examples where assumptions can be risky.
For a small business, the safest operational habit is to identify the consent basis and date for each contact, rather than relying on staff memory. If you cannot explain why someone is on the promotional list, do not treat that address as ready for a campaign.
What to check first
- Inventory your email types. List newsletters, promotions, lead follow-ups, receipts, booking reminders, support messages, and automated flows. Note the platform and From address for each.
- Map how contacts joined. Record whether contacts opted in, purchased, made an inquiry, were referred, or were imported from another system. Keep supporting records where possible.
- Review the sender identity. Commercial messages should make the business and a contact method clear. Check that brand names, reply addresses, and footer details match the business a recipient expects.
- Test the unsubscribe path. It should be easy to find, work without friction, and remove the recipient from the relevant promotional stream. Government guidance notes that unsubscribe requests must be actioned within 10 business days or less and at no cost.
- Separate transactional and promotional content. Keep necessary service messages clean and make sure promotional campaigns are sent only to an appropriately managed audience.
Why compliance supports deliverability
CASL compliance and inbox placement are not the same thing. A compliant message can still be filtered, and an authenticated sender still needs sound consent practices. But the underlying habits reinforce each other: clear expectations, accurate lists, recognisable identity, useful content, and easy preference control reduce the conditions that lead recipients to ignore or mark messages as spam.
Mailbox providers look for signs that email is wanted. Sending a large campaign to old, uncertain, or mismatched contacts can create bounces, complaints, and weak engagement. A permission-aware list is usually easier to maintain and more useful to the people who remain on it. Read why business emails go to spam for the technical and sending-practice side of the same problem.
When to get professional help
Talk to legal counsel when you need a legal interpretation, are restructuring consent practices, or are unsure whether an exception applies. Bring in deliverability help when your marketing platform, CRM, website forms, and workspace are sending with inconsistent identities; when contacts complain they cannot unsubscribe; or when campaigns are landing in spam despite a legitimate list.
Cyber Bounds can help with the technical side: sender authentication, list-source mapping, platform configuration, and a practical email deliverability plan. You can also review deliverability engagement options before deciding whether outside help is useful. Ontario businesses looking for a local starting point can see email deliverability support in Niagara Region.