CASL Compliance for B2B Companies: Cold Email Rules in Canada 2026

"Can I send cold emails to Canadian businesses?" is one of the most common questions we hear from sales teams and B2B marketers. The answer is: it depends — and the stakes are high enough that guessing wrong can cost your business up to $10 million.

CASL does not ban cold email in Canada. But it imposes strict conditions that many B2B teams violate unknowingly. Here is everything you need to know.

Last updated: April 2026

Does CASL Apply to B2B Email?

Yes. CASL applies to all commercial electronic messages sent to Canadian electronic addresses, including business email addresses. There is no blanket B2B exemption — the law treats a promotional email sent to john@bigcompany.com the same as one sent to john@gmail.com.

However, CASL does create specific provisions that make some B2B communications easier than consumer marketing. Understanding these provisions is essential for any outbound sales team.

The Conspicuously Published Address Exception

The most important CASL provision for cold B2B outreach is paragraph 10(9)(b) — the "conspicuously published electronic address" implied consent provision (CASL).

Under this exception, you may send a CEM to a business email address if:

1. The email address is prominently published by the person (on a website, LinkedIn, business directory, press release, etc.)
2. There is no accompanying statement that the person does not wish to receive unsolicited CEMs
3. The CEM is relevant to the person's business role or function

What "Conspicuously Published" Means

An address is conspicuously published if it is:

• Listed on the company's public website (About Us, team page, contact page)
• Published in a publicly accessible business directory
• Included in a LinkedIn profile set to public
• Listed on a government registry or professional association directory
• Included in a press release or published business document

An address you obtained from a data provider that scraped websites may or may not qualify — it depends on whether the original publication meets the standard. Be cautious with purchased lists.

What "Relevant to Business Role" Means

The CEM must be relevant to the business role or function of the person at the address. A few examples:

Contact Role	Relevant CEM	Not Relevant
IT Manager	Software security solution pitch	HR outsourcing service
Marketing Director	Email marketing platform demo	Accounting software
CEO	Strategic consulting services	Mass market consumer offer
Procurement Officer	Supply chain software	Internal wellness app

Generic sales pitches that don't relate to the person's function are not protected by this exception. Personalisation isn't just good sales practice — it's legally relevant.

The "No Unsolicited CEMs" Statement

If a person publishes their email address alongside a statement like "For media enquiries only" or "Not for commercial solicitations," the exception does not apply. Sending to them anyway is a direct CASL violation.

Similarly, if a website has a general "no unsolicited commercial email" notice, even addresses published on that site are protected.

Existing Business Relationship (EBR) for B2B

In addition to the conspicuously published exception, B2B companies can send CEMs based on an existing business relationship (EBR):

• You have an active contract with the company: send freely during the contract
• They purchased from you within the last 2 years: implied consent continues
• They made an enquiry or submitted a form in the last 6 months: implied consent applies
• A mutual contact referred them and disclosed themselves in the referral: one CEM permitted

For B2B sales cycles, the referral provision is particularly useful for SDRs doing account-based prospecting.

Building a CASL-Compliant Cold Outreach Sequence

Here is a compliant framework for outbound B2B sales in Canada:

Step 1: Source Verification

Before adding a Canadian business contact to a cold sequence, verify:

• Is the email address publicly listed (website, LinkedIn, directory)?
• Is there any "no solicitation" notice on the publication?
• Is your message relevant to their role?

Document your source: "Found via LinkedIn, listed on company website — [URL] — accessed [date]."

Step 2: Message Content Requirements

Every outreach CEM must include:

• Your full business name
• Your mailing address
• A contact email or phone number
• An unsubscribe mechanism (yes, even in cold outreach)
• No false or misleading headers, subject lines, or sender information

Subject line compliance: CASL explicitly prohibits false or misleading subject lines. "Quick question" followed by a sales pitch may be considered deceptive. "Introduction: [Your product] for [Their company's use case]" is more defensible.

Step 3: Sequence Management

A typical B2B cold sequence of 3-5 emails is permissible under the conspicuously published exception — but only for as long as:

• The implied or conspicuously-published consent basis remains valid
• The contact has not unsubscribed
• The messages remain relevant to their role

Once someone unsubscribes from your sequence, remove them from all commercial lists. Do not continue the sequence from a different sender address.

Step 4: EBR Follow-Up

When a prospect responds — even just to decline — this may create an EBR (business communication initiated). This gives you a stronger basis for continued outreach. Document all responses.

LinkedIn and Social Media Outreach

CASL applies to direct messages on social platforms (LinkedIn InMail, Twitter DMs, Instagram DMs) when they are commercial electronic messages.

The same conspicuously published exception may apply for LinkedIn messages if the recipient has a public profile — but the message must still be relevant to their role and include identification and unsubscribe mechanisms.

Practical LinkedIn guidance:

• Connection request messages: generally not CEMs (no commercial purpose beyond connecting)
• InMails with a commercial pitch: CEMs, require compliance
• Public posts and comments: not CEMs (no electronic address involved)

What About Buying Email Lists?

Purchased email lists are a significant CASL risk. When you buy a list:

• You inherit the consent records — which are often inadequate or non-existent
• The vendor's "compliance" claims are not a legal defence
• The conspicuously published exception may still apply if each address was independently and publicly published

Before using a purchased list for Canadian contacts:

1. Request detailed documentation of the source of each address
2. Verify that addresses were publicly listed (not scraped from private sources)
3. Confirm no "no solicitation" notices accompanied the publication
4. Send only messages relevant to each contact's documented role

Many compliance teams conclude that the documentation burden for purchased lists is too high and opt for organic list building instead.

CASL Fines for B2B Email Violations

The CRTC has been active in enforcing CASL against B2B senders. Selected enforcement examples:

• Compu-Finder (training company): $1.1M initially imposed for B2B spam including inadequate unsubscribe, reduced to $200,000 on CRTC review
• Blackstone Learning (corporate training): $640,000 initially imposed for sending to addresses without valid consent, reduced to $50,000 on CRTC review
• Avis Car Rental: $85,000 for improper CEMs to business addresses

Frequently Asked Questions

Q: Does the conspicuously published exception give me unlimited contact attempts? A: No. It gives you the right to send CEMs relevant to the recipient's role. If they unsubscribe, the exception no longer helps you — you must stop. If they never respond through multiple touchpoints, the legitimacy of continued outreach becomes questionable.

Q: Can I use the conspicuously published exception for consumer marketing? A: No. It applies only to persons who published their address in the context of a business role (e.g., a business contact), not to individuals who published their personal email address on social media.

Q: Is LinkedIn Sales Navigator CASL-compliant for Canadian outreach? A: The tool itself is neutral. Whether your use of it complies with CASL depends on your message content and the consent basis for each contact.

Q: We're a US company with no Canadian office. Does CASL apply? A: Yes. CASL applies based on the recipient's location. Sending CEMs from the US to Canadian email addresses is subject to CASL.

Q: What if a Canadian contact visits our US website and fills out a form? A: This creates an enquiry-based EBR (6-month implied consent window) for the specific person. Treat this the same as a Canadian website enquiry.

---

Build a Compliant B2B Outreach Programme

CASL compliance for B2B doesn't mean stopping outreach — it means building the right systems. Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your free trial today — and sell with confidence across Canada.

Related reading: CASL Compliance Guide | CASL Express vs Implied Consent | CRTC Enforcement Reports