CASL for Shopify Stores: Canadian Email Marketing Compliance Guide

Many Canadian merchants sell on Shopify. The combination of abandoned cart emails, Klaviyo flows, and default Shopify checkout consent language creates significant CASL exposure for Canadian e-commerce stores. Here's how to fix it.

Last updated: April 2026

Does CASL Apply to My Shopify Store?

Yes, if you are:

• A Canadian business selling to Canadian customers, or
• A non-Canadian business sending commercial emails to Canadian recipients

CASL applies to commercial electronic messages (CEMs) sent to Canadian email addresses. This includes:

• Order confirmation emails that contain promotional content
• Abandoned cart emails
• Marketing newsletters
• Win-back campaigns
• Cross-sell and upsell flows
• Loyalty programme emails

Note: Pure transactional messages (order confirmations without promotional content, shipping notifications) are generally not CEMs — but adding a coupon code or product recommendation to a transactional email can change its classification.

The CASL Problem with Default Shopify Settings

Out of the box, Shopify's checkout has an "Email me with news and offers" opt-in checkbox that is unchecked by default. This is actually the correct approach for CASL express consent.

However, the common problems are:

1. Pre-ticked checkboxes — some Shopify themes or settings result in the checkbox being pre-ticked, which invalidates CASL consent
2. Email marketing apps that don't record consent timestamps — if you can't prove when and how consent was given, you can't defend a CASL complaint
3. Abandoned cart emails without consent — sending abandoned cart emails to customers who didn't opt in is a CASL violation
4. Klaviyo and other email platforms importing contacts without consent records — a common migration error

Shopify + CASL: The Consent Framework

Express Consent at Checkout

The standard Shopify checkout opt-in gives you express consent when:

• The checkbox is unchecked by default
• The label clearly explains what the customer is opting into ("Email me with news and offers from [Store Name]")
• The consent is recorded with a timestamp

Verify this in your Shopify admin: Settings → Checkout → Under "Marketing" — confirm "Pre-select the email marketing newsletter checkbox" is set to "Off"

Implied Consent for Existing Customers

CASL allows implied consent for existing business relationships. You can email customers about your products and services for 24 months after their last transaction without express consent.

Key rules:

• The 24-month clock resets with each new purchase
• The customer must always have a functioning unsubscribe mechanism
• Once 24 months passes without a transaction, implied consent lapses — you need express consent to continue emailing

No Consent = No Email

Customers who abandoned a cart but never purchased from you, and who didn't opt in to marketing:

• Have no implied consent (no prior transaction)
• Have no express consent (no opt-in)
• Cannot legally receive abandoned cart emails under CASL

This is a common CASL error for Shopify stores.

Setting Up CASL-Compliant Consent in Shopify

Step 1: Checkout Marketing Opt-In

Ensure your checkout is configured correctly:

1. Go to Shopify Admin → Settings → Checkout
2. Under "Email marketing," set "Pre-select the email marketing checkbox" to Off
3. Verify the consent language — should say something like "Email me with news and offers" or "I agree to receive marketing emails"

Step 2: Subscribe Form Language

For newsletter sign-ups (pop-ups, footer forms):

• Be explicit: "Subscribe to receive promotional emails from [Store Name]"
• Include your business name so customers know who they're subscribing to
• If using Klaviyo, Mailchimp, or Omnisend, ensure the form captures consent with timestamp

Step 3: Configure Your Email Marketing Platform

Whether you use Klaviyo, Mailchimp, Omnisend, or Shopify Email:

Klaviyo specifically:

• Enable "Double opt-in" for Canadian subscribers (optional but adds confirmation record)
• Map the email_marketing consent field from Shopify to Klaviyo's consent field
• Set up suppression lists correctly so non-consented customers don't receive marketing flows
• Do NOT include customers in abandoned cart flows unless they have active marketing consent

Shopify Email:

• Shopify Email automatically respects the marketing consent checkbox from checkout
• Customers who didn't opt in at checkout won't receive marketing campaigns — but verify this with a test

Step 4: Segment Your Audience

Create clear segments:

• Express consent — active (opted in, not withdrawn)
• Implied consent — active (purchased in last 24 months, no express consent)
• No consent — suppress from marketing

Review your Klaviyo or Mailchimp audience and ensure non-consented contacts are suppressed from marketing campaigns.

Abandoned Cart Emails: The CASL Risk

Abandoned cart emails are a popular e-commerce email sequence — and a CASL-problematic one.

Who can receive abandoned cart emails?

• ✅ Customers who checked the marketing opt-in at checkout
• ✅ Customers who purchased in the last 24 months (implied consent)
• ❌ Cart abandoners who never purchased and never opted in

The tricky part: When a customer enters their email at checkout to get a shipping quote or progress through checkout (but doesn't purchase and doesn't opt in), many Shopify + Klaviyo setups will still capture that email for abandoned cart flows.

Fix: In Klaviyo, configure your abandoned cart flow to check for accepts_marketing = true OR a prior purchase within 24 months before sending. Do not send to all emails captured at checkout.

Unsubscribe Requirements

Every marketing email to a Canadian recipient must include:

• A functioning unsubscribe link (must work for at least 60 days after the message is sent)
• Processing the unsubscribe request within 10 business days
• The unsubscribe must be at no cost to the recipient and able to be readily performed (CASL s. 11(1); CRTC Regulations s. 3(2))

Shopify and Klaviyo both provide unsubscribe links by default — but verify they process within 10 business days and that unsubscribed contacts are actually suppressed from future sends.

Documenting Your Consent Records

CASL requires you to be able to prove consent existed at the time you sent each message. You need:

• What form of consent was obtained (express opt-in, or implied through purchase)
• When consent was given (timestamp)
• The consent language the customer saw when opting in
• How the message was described at point of consent

Shopify records checkout marketing consent timestamps in the customer profile. Export and back up this data regularly.

Compliance Checklist for Shopify Stores

• Checkout marketing checkbox is unchecked by default
• Abandoned cart flows check for marketing consent before sending
• All marketing emails include a functioning unsubscribe link
• Unsubscribes are processed within 10 business days
• Consent timestamps are recorded in Shopify customer profiles
• Non-consented customers are suppressed in your email platform
• 24-month implied consent window is tracked and segmented
• Your business name, mailing address, and unsubscribe mechanism appear in every email

Frequently Asked Questions

Q: We have 50,000 email contacts. How do we know if they're CASL compliant? A: Audit your list. For each contact, determine: (a) Did they opt in with a valid unchecked checkbox? (b) Did they purchase in the last 24 months? If neither, suppress them from marketing. A one-time re-permission campaign may help.

Q: Can we send a welcome email to everyone who creates an account, even if they don't opt in to marketing? A: A pure transactional welcome email (confirming account creation, explaining features) is not a CEM. But if it includes promotional content (discount codes, product recommendations), it becomes a CEM requiring consent.

Q: Our Klaviyo flow sends emails 1, 3, and 7 days after cart abandonment. Does consent apply differently to each? A: Consent must exist at the time each email is sent. If implied consent lapses (24 months) between emails, you shouldn't send the subsequent ones without express consent.

---

CASL Compliance Made Simple for Shopify Merchants

Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your free trial today — protect your Shopify store from CASL exposure.

Related reading: What is CASL | CASL Express vs Implied Consent | CASL Unsubscribe Requirements