CASL Consent Requirements for Small Businesses

Executive Summary

Canada's Anti-Spam Legislation, commonly called CASL, is best treated as a pre-send decision system, not as a blanket ban on marketing. A message is a commercial electronic message, or CEM, when one of its purposes is to encourage participation in commercial activity ^[1]. If it goes to an electronic address, a Montreal freelancer, startup or small team should ordinarily be able to document consent or a specific exemption, identify the sender, and provide an unsubscribe mechanism. The CRTC describes those same three core requirements ^[2]. Email, commercial SMS, private social-media messages and some push notifications can qualify. A private LinkedIn direct message is not automatically outside CASL simply because it is on a networking platform ^[3]. Voice, fax and prerecorded voice calls fall outside the CEM provisions described by industry guidance ^[4].

The safest durable basis is express opt-in consent. It does not expire merely with time, but it can be withdrawn ^[5]. Implied consent is narrower. A qualifying purchase may support an existing business relationship for two years, while an inquiry or application may support it for six months ^[6]. A publicly posted work email is not an open invitation: there must be no no-solicitation statement and the message must be relevant to the person's business role ^[7]. A qualifying referral permits only the first CEM without the recipient's consent and requires disclosure of the referrer ^[8].

Every send should carry the sender's identity, a mailing address and another prescribed contact route. Contact information must remain valid for at least 60 days ^[9]. Opt-outs must be free and effective without delay, no later than 10 business days ^[10]. The sender bears the burden of proving consent ^[11], so the practical control is a consent log with source, scope, evidence, expiry or review date, and suppression status.

CASL and Quebec's privacy regime require two separate checks. CASL governs the sending of CEMs. Quebec privacy law governs collection, use, communication, retention and protection of personal information. Quebec's statute says privacy consent must be clear, free and informed ^[12]. Passing one check does not settle the other. This report is a screening and operations guide, not a legal safe harbour or individualized legal advice.

Introduction and Background

For a small business, the difficult CASL question is rarely whether spam is undesirable. It is whether a particular newsletter, sales email, text message, LinkedIn direct message or referral introduction is a CEM sent to an electronic address, and whether the sender can prove the legal basis used at the moment of sending. Official CRTC remarks describe the opt-in approach as applying to emails, direct messages and text messages ^[13].

The consequences for workflow are concrete. A contact in a customer relationship management system is not necessarily sendable. A work email visible on a website is not necessarily consent. An inquiry has a different clock from a purchase. A rebrand differs from the sale of a list. Even a message asking for consent can itself be a CEM ^[14].

This matters in a local entrepreneurial setting. 2727 Coworking offers workspaces for freelancers and teams, including private offices for teams of one to ten ^[15]. Its site also presents business-address and mailbox plans from $35 per month ^[16]. Those services do not determine CASL compliance. They illustrate the audience for this operational guide: small operators using newsletters, outreach and customer follow-up while sharing tools, vendors and physical infrastructure.

The Justice Laws pages cited here are the legislation and regulations. CRTC, Innovation, Science and Economic Development Canada, and other government pages are guidance. Their examples remain scenario-specific.

Does CASL Apply? A 60-Second Decision Flow

The useful starting point is classification, not the channel name. A message is commercial if one purpose encourages participation in commercial activity. A mixed informational and commercial message can still be a CEM ^[17].

Use this sequence before selecting recipients:

• Purpose: Does the content offer, advertise, market or promote a product, service, business or commercial opportunity?
• Electronic address: Is it sent to an email, telephone account, instant-messaging account or comparable account?
• Location: Is Canada implicated because the message is sent or accessed through a Canadian computer system?
• Exclusion or exception: Is it interactive two-way voice, a requested message, a transaction-completion message, or another narrow statutory or regulatory case?
• Consent or exemption: Can the sender document express consent, implied consent, or a specific exemption?
• Message form: Are identity, contact and unsubscribe elements present when required?
• Suppression: Has this recipient opted out, and has every sending system received that status?

The classification should focus on substance. A public social post not directed to electronic addresses is different from a private message to an account. Legal guidance draws that distinction for general social-media publication ^[18]. A transactional email that only completes an already agreed transaction may not require consent, but adding a promotion can alter the analysis ^[19].

Key Consent Requirements

Express consent is affirmative and durable

Express consent should be captured through a positive action. Canadian legal guidance characterizes the standard as opt-in ^[20]. The request must state why consent is sought, identify the relevant parties and explain that consent can be withdrawn. The regulations allow oral or written consent but require CEM consent to be sought separately from consent for other regulated acts ^[21].

A signup record should preserve the exact disclosure shown, timestamp, page or form version, affirmative action, address and source system. Express consent has no automatic calendar expiry, but withdrawal ends the basis. It should still be reviewed after major changes in sender identity, purpose, audience or data source.

Implied consent has conditions and clocks

An existing business relationship can arise from specified transactions, contracts, inquiries or applications. ISED summarizes the usual implied-consent windows as up to two years, or six months for inquiries and applications ^[6]. Each qualifying subsequent transaction can restart the relationship-based period ^[22].

Other implied-consent paths require their own evidence:

• Conspicuous publication: retain the page URL, capture date, address, absence of a contrary statement and role relevance.
• Voluntary disclosure: retain how the address was provided, any restriction expressed, and why the message relates to the person's work role.
• Non-business relationship: document the statutory category and event date rather than assuming all community contact qualifies.
• Expiry review: compute the last send date from the underlying event, not from the date the contact entered the marketing tool.

Exemptions are narrower than labels suggest

The business-to-business exemption is not a generic permission for cold B2B prospecting. The regulations require a relationship between the organizations and content concerning the recipient organization's activities ^[23]. The referral exception is limited to the first CEM after a qualifying referral, with prescribed disclosure. An internal-organization exemption likewise depends on the people and message having the specified connection to the organization's activities.

These routes should have named evidence fields rather than a free-text note. “B2B” alone proves nothing. “Referral” without the referrer's relationship to both sides and the first-message status is incomplete.

Consent and Scenario Matrix

Table 1 screens ten common small-business situations. “Possible” means a basis may exist if every stated condition is documented. It is not a safe harbour.

The abandoned-cart row is deliberately conservative. CRTC guidance states that an abandoned online cart is not a purchase ^[24] and recommends securing express consent when an email address or phone number is collected during checkout ^[25]. The public-address row is equally conditional. The address must not carry a no-CEM statement, and relevance must be specific to the recipient's role.

For a referral, the sender should preserve the referrer's full name and the relationships that qualify the referral. CRTC guidance says only one CEM may be sent without recipient consent on this route ^[26].

Channel Matrix: Email, SMS, LinkedIn and Push

Table 2 maps the channel to the practical CASL question. The Act is technology-neutral, so switching tools does not erase the need to classify the communication.

The matrix shows why LinkedIn message consent cannot be answered with a platform-only rule. Competition Bureau guidance expressly includes direct messages sent through social-platform messaging services ^[28]. The content, destination, recipient, consent basis and platform interface all matter. A connection, follow or group membership is not automatically one of the statutory consent categories.

SMS demands especially short operational paths. CRTC guidance has identified replying “STOP” or “Unsubscribe” as an appropriate option ^[29]. Shortness does not remove the identification rules. Legal guidance notes that an instant-messaging interface can conspicuously present sender contact and unsubscribe information ^[30].

Message Anatomy and Operational Handoff

A compliant campaign is not complete when the copy is approved. The message, recipient evidence and downstream suppression process must align.

What the message should expose

• Sender identity: name the person sending and, if different, the person on whose behalf it is sent.
• Mailing address: include the prescribed mailing address.
• Additional contact route: include a telephone number, email address or web address as prescribed. The regulations expressly begin with “the mailing address, and either a telephone number” ^[31].
• Contact validity: keep the contact information valid for the required post-send period.
• Clear presentation: set identity and unsubscribe information out clearly and prominently ^[32].
• No-cost opt-out: let the recipient indicate the wish to stop at no cost.
• Channel fit: when practicable, use the same electronic means by which the message was sent ^[33].

Consent-log field schema

A useful log is recipient-level, not campaign-level. Recommended fields are:

• Contact key: normalized electronic address plus internal customer or lead ID.
• Channel: email, SMS, named messaging platform or push.
• Legal basis: express, relationship-based implied consent, conspicuous publication, voluntary disclosure, referral, B2B exemption or other reviewed basis.
• Source event: form submission, purchase, inquiry, meeting, referral or publication capture.
• Source timestamp: date, time and time zone.
• Evidence pointer: immutable form version, transaction, screenshot, URL capture or call record.
• Scope: sender identity, brands, channels and stated purposes covered.
• Event date: the date that starts any implied-consent clock.
• Expiry or review date: calculated date and reason.
• Disclosure version: exact consent language presented.
• Withdrawal date: when the opt-out arrived.
• Suppression propagation: systems updated, vendor acknowledgement and completion time.
• Reviewer: person who approved an exemption or edge case.

CRTC guidance specifically suggests retaining the electronic address, date and method by which consent was received ^[34]. The business needs a defensible retention schedule that supports continuing sends while satisfying applicable privacy limits.

Printable pre-send audit

• Classify the content: record why the message is or is not commercial.
• Identify the address: name the email, telephone or messaging account used.
• Segment recipients: do not apply one consent basis to a mixed list.
• Test express consent: confirm an affirmative action and preserved disclosure.
• Test implied consent: identify the qualifying category, event and unexpired period.
• Test publication: capture the page, address, date, absence of restriction and role relevance.
• Test referral: verify relationships to both sides, first-message status and required disclosure.
• Test B2B exemption: preserve inter-organization relationship evidence and activity relevance.
• Check suppressions: compare every recipient against the central opt-out list.
• Check identity: verify sender, represented party, mailing address and contact route.
• Check the opt-out: send a test through the actual production path.
• Check vendors: confirm SMS, customer-relationship and email tools share suppression changes.
• Set deadline: route opt-outs for completion well inside the statutory outer limit.
• Archive proof: retain the final creative, audience, time, basis and delivery vendor.
• Escalate exceptions: pause bought lists, cross-border uncertainty and ambiguous exemptions for counsel.

A small or medium-sized business should designate one accountable point person. Accountability does not require a large department. It requires one owner, a repeatable review and evidence that survives staff and vendor changes.

Implementation Considerations and Process Changes

The most reliable implementation separates eligibility, content and suppression. Eligibility determines whether a recipient may receive this message now. Content checks the sender and unsubscribe elements. Suppression ensures a later send cannot override a withdrawal.

Build rules around events, not imported labels

Marketing databases often contain labels such as “customer,” “lead,” “partner” or “B2B.” Those labels are not statutory proof. Convert them into dated events and evidence:

• Customer becomes qualifying transaction type, date and counterparty.
• Lead becomes inquiry, publication, referral or express-consent record.
• Partner becomes the actual relationship between organizations and the message's relevance to recipient activities.
• Subscriber becomes the opt-in action and exact disclosure.

Third-party lists deserve a stop condition. Buying only an email list does not transfer the seller's express consents ^[35]. A vendor warranty is therefore not a substitute for recipient-level evidence.

Treat rebranding and acquisitions differently

A change of business name by the same legal person does not itself invalidate consent when the original purpose and scope continue ^[36]. Operationally, the first post-rebrand message should make the identity change understandable and ensure current contact information appears.

A genuine sale of a business is different from a list sale. CRTC guidance says transferred express consents may be relied on where the business-sale contract transfers the consented list as a business asset ^[37]. Preserve the agreement, continuity analysis, original consent scope and migration record.

Stop and ask counsel

Pause automation when:

• A bought list lacks recipient-level proof and source captures.
• Cross-border routing makes it unclear where messages are sent or accessed.
• A referral chain cannot establish the required relationships to both parties.
• A B2B claim rests only on industry similarity or a scraped address.
• A mixed-purpose message combines required service information with promotions.
• A business sale does not clearly transfer the relevant business assets and records.
• A platform interface cannot present or link required information effectively.
• Privacy authority to collect, use or export contact data is uncertain.

Messages sent from abroad to recipients in Canada may still need to comply with CASL ^[38]. A global campaign should therefore segment by destination and applicable law rather than assuming the sender's location controls.

Data Analysis and Evidence

The best quantitative context does not measure “how compliant” a particular campaign is. It shows the scale of electronic commerce, official reporting and operational demand.

Table 3 summarizes current official indicators and explains what they can and cannot support.

The statistics support a process conclusion, not a legal presumption. An online sale, quote request or checkout event should generate structured consent and relationship data. It should not merely add an address to a list. Statistics Canada's target population for the cited survey included about 293,000 small businesses ^[45].

The official complaint total should also be interpreted carefully. It counts complaints, not adjudicated messages, unique senders or proven contraventions. For a small operator, its value is directional: recipients continue to use official reporting channels, and incomplete records can make even a defensible campaign hard to explain.

Worked Small-Business Scenarios

Freelancer referral (Hypothetical Example)

A designer receives a referral from a former client and wants to send a promotional email to the referred founder. Before sending, the designer records the referrer's full name and verifies that the referrer has a qualifying relationship with both sides. The first message explains the referral, identifies the designer and includes an opt-out. The designer does not place the founder into a sequence unless the reply or another event creates a documented basis. This reflects the regulation's first-message limitation and required referral disclosure.

SaaS abandoned cart (Hypothetical Example)

A startup captures an address after a visitor begins checkout but does not buy. The team treats the cart as no proof of a transaction and instead offers a separate, unchecked promotional opt-in. A receipt or security notice is classified apart from an upsell. The campaign system stores the disclosure version, affirmative action and timestamp.

Local service inquiry and SMS (Hypothetical Example)

A repair company receives a text asking for a quote. It records the inquiry date and the service requested, then answers the request. If it later sends promotional texts based on the relationship, it calculates the six-month inquiry period ^[6] and includes a working opt-out. It does not convert the inquiry into permanent marketing permission. ISED's SMS guidance says commercial text messages require consent ^[27].

CASL Versus Quebec Law 25

CASL and Quebec's private-sector privacy law answer different questions. CASL asks whether and how a CEM may be sent. Quebec privacy law asks whether personal information may be collected, used, communicated, retained and protected for the proposed purpose. Quebec described the Law 25 amendments as taking effect progressively from 2022 over three years ^[46].

For Montreal businesses, a practical two-check model is:

• CASL check: Is this a CEM sent to an electronic address, and what consent basis or exemption applies?
• Privacy check: Is collection and use of the address authorized for this purpose, with appropriate notice, safeguards, retention and vendor controls?

Quebec's statute states that commercial prospecting is not a purpose automatically consistent with the original collection purpose ^[47]. It also says privacy consent is valid only for the time necessary to achieve its stated purposes ^[48]. These rules are conceptually different from CASL express consent, which does not expire merely through time.

The Commission d'accès à l'information describes valid privacy consent as specific to a precise, clearly circumscribed objective ^[49]. Its website also expressly characterizes its text as plain-language explanation of applicable laws ^[50], so the statute remains the controlling text.

Cross-border tooling adds a privacy question. Quebec's statute requires a privacy impact assessment before an enterprise communicates personal information outside Quebec ^[51]. That requirement does not supply CASL consent. It governs the personal-information layer around the messaging operation.

Implications and Future Directions

The central operational change is to make send eligibility dynamic. A contact may be eligible for one campaign and ineligible for another because channel, purpose, consent scope, event date or organizational relationship differs. A single “subscribed” checkbox cannot represent that complexity.

Small teams should prioritize four controls:

• Event-based evidence: connect permissions to purchases, inquiries, forms and referrals.
• Automatic clocks: calculate the applicable statutory window from each qualifying event.
• Central suppression: propagate withdrawals across email, SMS, customer-relationship and messaging tools.
• Human review: require approval for publication-based outreach, referrals, B2B exemptions, acquisitions and cross-border edge cases.

The unsubscribe deadline is an outer bound, not a service target. Systems should suppress promptly and use the statutory outer period as contingency. Campaign shutdown also should not immediately disable the required response channel.

Privacy and marketing operations should share a data map without collapsing their legal tests. The practical design is one governed contact record with separate fields for privacy authority, CASL basis, expiry, purpose and withdrawal.

Frequently Asked Questions (FAQs)

Does CASL require express consent for every marketing email?

No. CASL recognizes express and specified forms of implied consent, and regulations contain exemptions. The sender should document the exact route rather than treating “not express” as “not required.” Express consent is generally the most durable basis, while relationship-based implied consent often has a six-month or two-year limit.

Can a business email every address published on a website?

No. Conspicuous publication is conditional. There must be no statement against unsolicited CEMs, and the message must be relevant to the person's business role, functions or duties. The sender has the burden of proof, so a dated page capture and written relevance rationale are essential.

Does accepting a LinkedIn connection create consent?

Not automatically. Private LinkedIn messaging can be sent to an electronic address for CASL purposes. The sender still needs a documented consent basis or applicable exemption for a commercial message. Platform connection status alone does not establish every element of express consent, implied consent or the B2B exemption.

How long does CASL consent last?

Express consent does not expire simply because time passes, but it ends when withdrawn. Implied consent depends on its category. A qualifying purchase may support a two-year period, while an inquiry may support six months ^[6]. Publication and voluntary-disclosure routes remain conditional and should be revalidated.

Must SMS messages contain an unsubscribe option?

Commercial texts subject to section 6 require the prescribed unsubscribe mechanism. It must be free and workable. The CRTC has identified STOP or Unsubscribe replies as an appropriate SMS design, while required identification may use a compliant accessible link when space is impracticable.

Can a business send an email asking for consent?

Not merely because the message asks for consent. Legal guidance confirms that the CEM definition includes an electronic request for consent ^[14]. Another valid basis would still be needed before sending that request electronically.

Is the B2B exemption the same as implied consent?

No. They are different legal routes. The inter-organization exemption requires a relationship between the organizations and content concerning the recipient organization's activities. A public work address may instead raise conspicuous-publication implied consent, with its own conditions.

Does CASL replace Quebec Law 25?

No. ISED guidance similarly says businesses must comply with both CASL and the federal privacy regime where applicable ^[52]. In Quebec, CASL and the provincial private-sector privacy statute require separate analysis.

Conclusion

CASL consent requirements for small businesses are manageable when converted from a legal summary into a recipient-level workflow. First classify the message by commercial purpose and electronic destination. Next identify and document express consent, a defined implied-consent category or a specific exemption. Then validate sender identity, contact information and the unsubscribe path before the campaign leaves the system.

The consent basis should never be a vague label. Purchases and inquiries need dates. Published addresses need captures and role relevance. Referrals need relationship evidence and a first-message flag. B2B exemptions need an actual inter-organization relationship and content connected to the recipient organization's activities. Rebrands and business sales require continuity records, not assumptions.

Finally, compliance is operational. A defensible program keeps a consent log, calculates review dates, tests opt-outs, synchronizes suppression and preserves campaign evidence. It also runs CASL and Quebec privacy checks separately. This matrix can screen common situations, but it cannot turn a fact-specific exception into an automatic safe harbour. Bought lists, uncertain cross-border campaigns, ambiguous platform mechanics and unclear exemptions should stop for focused legal review before sending.