CASL Express vs Implied Consent: Complete Guide with Examples

Consent is the foundation of CASL. Before you send a single commercial email to a Canadian recipient, you need to understand the two types of consent CASL recognises — and the significant difference between them. Using the wrong type, or relying on expired implied consent, can expose your business to CRTC enforcement action.

Last updated: April 2026

The Two Types of CASL Consent

CASL (Canada's Anti-Spam Legislation) distinguishes between two consent types for commercial electronic messages (CEMs):

1. Express consent — explicit, documented opt-in from the recipient
2. Implied consent — consent that can be inferred from specific circumstances

The critical practical difference: express consent is permanent until withdrawn; most implied consent expires after a fixed period.

Express Consent: The Gold Standard

What Counts as Express Consent

Express consent under CASL requires the recipient to take an affirmative action to agree to receive CEMs from you. This means:

✅ Ticking an unchecked checkbox: "Yes, I'd like to receive promotional emails from Acme Co." ✅ Filling out a paper form specifically requesting email communications ✅ Verbally agreeing and having that agreement documented ✅ Sending an email specifically requesting to be added to your list

What does NOT count as express consent: ❌ Pre-ticked checkboxes (the user must un-tick to decline) ❌ "By submitting this form, you agree to receive marketing communications" ❌ Purchasing a product (purchasing creates implied consent, not express) ❌ Following your brand on social media

Required Elements for Valid Express Consent

For express consent to be valid under CASL, your consent request must:

1. Describe the purpose — set out clearly and simply what the consent is being sought for (CASL s. 10(1))
2. Identify who is requesting consent — the name you carry on business under, and whose behalf you are acting on, if applicable (Electronic Commerce Protection Regulations (CRTC), s. 4)
3. Include contact information — your mailing address plus a phone number, email address or web address (Regulations, s. 4(d))
4. State that consent can be withdrawn (Regulations, s. 4(e))
5. Be separate from other agreements — the CRTC considers that requests for consent must not be bundled with consent to general terms and conditions of use or sale (Compliance and Enforcement Information Bulletin CRTC 2012-548)

Compliant consent request example:

☐ I would like to receive email newsletters, promotions, and updates from [Business Name], [mailing address], [email or phone]. I understand I can withdraw my consent (unsubscribe) at any time. [Link to Privacy Policy]

Non-compliant consent request example:

☑ I agree to the Terms of Service and consent to receive marketing communications (pre-ticked, bundled)

How Long Does Express Consent Last?

Express consent does not expire under CASL. Once given, it remains valid until:

• The recipient withdraws consent (unsubscribes)
• You become aware the consent was obtained improperly
• Specific circumstances change that would invalidate the original consent

This permanence makes express consent highly valuable. A well-documented opt-in list is a business asset.

Documenting express consent: the consent records to keep

If the CRTC investigates, you bear the burden of proving valid consent existed. Your records should capture:

• Date and time consent was given
• Method (online form, paper form, verbal)
• IP address (for online sign-ups)
• Version of consent language shown at the time
• The specific email address that was consented to

Store these records for the duration of the relationship plus at least 3 years.

Implied Consent: Useful but Temporary

Implied consent allows you to send CEMs in specific circumstances without a formal opt-in. CASL recognises three main categories:

1. Existing Business Relationship (EBR) — 2-Year Window

You have implied consent to send CEMs if there is an existing business relationship established within the past 2 years:

Relationship Type	EBR Period
Purchase of goods/services	2 years from date of purchase
Contract currently in force	Duration of contract + 2 years
A consumer-initiated inquiry/application	6 months from the inquiry
Donation or gift (registered charities, political parties/organizations and candidates only; a non-business relationship)	2 years from the donation
Volunteer work (registered charities, political parties/organizations and candidates only; a non-business relationship)	2 years from the volunteer work

Source: CASL s. 10(10) and 10(13).

The EBR clock starts ticking from the last transaction or relevant interaction. If a customer purchased from you 18 months ago and hasn't bought since, their 2-year EBR window will expire in 6 months. You have two choices: obtain express consent before the window closes, or stop sending them CEMs.

Important nuance: An enquiry only creates a 6-month implied consent window (not 2 years). Many businesses miss this distinction.

2. Conspicuously Published Electronic Address

If a person or business has prominently published an electronic address on a publicly accessible website, in a business directory, or similar location — and there is no statement that they do not wish to receive CEMs — you may send them CEMs that are:

• Relevant to their business role or function
• From your organisation, which has a business reason to contact them

Example: A supplier publishes their procurement manager's email on their website. You can send a pitch related to their purchasing function. You cannot add them to your general marketing newsletter.

Limitations: This implied consent is narrowly scoped. The message must be directly relevant to their business role, not general marketing.

3. Referral Exemption

Strictly speaking this is an exemption from the consent requirement rather than implied consent. Under the Electronic Commerce Protection Regulations, s. 4(1), if an individual who has an existing business, non-business, family or personal relationship with both you and the referred person refers that person to you:

You may send the first CEM to the referred person, provided it discloses the full name of the individual(s) who made the referral and states that it is sent as a result of the referral. This does not create an ongoing marketing relationship.

Managing the Transition from Implied to Express Consent

The biggest operational challenge for businesses is managing the expiry of implied consent. Here is a systematic approach:

Step 1: Segment your list by consent type Create separate segments in your email platform:

• Express consent (permanent, date documented)
• Implied — EBR-based (expiry date tracked)
• Implied — Enquiry-based (6-month window)
• Unknown/legacy (consent status unclear)

Step 2: Set up consent expiry alerts Monitor EBR dates. When a contact's implied consent will expire within 90 days, trigger a re-permission campaign.

Step 3: Run re-permission campaigns Before implied consent expires, send a clear email asking for express consent:

"We've valued having you in our community. To keep receiving our [newsletter/updates], please confirm your subscription."

Make it one click. Track who confirms and who doesn't. Remove non-responders before the EBR window closes.

Step 4: Handle legacy lists For contacts without documented consent (common in businesses that operated before CASL or haven't tracked carefully), assess whether implied consent may exist. If not, remove them from commercial lists.

Consent for Multiple Channels

Express consent given for one channel doesn't automatically extend to others:

• Email consent ≠ SMS/text consent
• Newsletter consent ≠ promotional email consent
• In-person verbal consent needs to be documented for digital channels

Be specific in your consent language about which channels you'll use.

Frequently Asked Questions

Q: Can I send a "are you still interested?" email to contacts whose implied consent is expiring? A: Yes, but only while the implied consent is still valid. Under CASL s. 1(3), an electronic message that requests consent to send CEMs is itself considered a CEM, so it needs consent, identification information and an unsubscribe mechanism like any other CEM. Send the request before the implied consent expires.

Q: Someone bought from me two years ago but re-purchased last month. Does the 2-year EBR clock reset? A: Yes. Each new transaction resets the 2-year EBR clock. If a customer purchases regularly, their implied consent continues to be renewed.

Q: My website has a general contact form. Does submitting it create implied consent? A: Only a limited one. An inquiry or application about your products, services or other matters listed in CASL s. 10(10)(a)–(c) creates a 6-month enquiry-based implied consent only.

Q: I acquired a business with an existing customer list. What consent do those customers have? A: You inherit whatever consent the previous business obtained. If they have documented express consent, you may be able to continue communications. If consent documentation is unclear, treat the list as having no consent and run re-permission campaigns.

Q: Does an unsubscribed person have any form of implied consent? A: No. Once someone unsubscribes, you must give effect to that withdrawal of consent without delay, and no later than 10 business days after receiving it (CASL s. 11(3)).

---

Automate CASL Consent Tracking

Managing express vs implied consent windows manually — especially for a growing contact list — is error-prone and time-consuming. A spreadsheet with the consent type, date, source and expiry date for each contact is enough for most small lists. Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your 14-day free trial and get your consent documentation in order today.

Related reading: CASL Compliance Guide | What is CASL? | CRTC CASL Guidance