CASL Compliance Guide for Canadian Businesses
Everything you need to know about Canada's Anti-Spam Legislation (CASL) and how to stay compliant in 2026.
CASL Penalties Can Reach $10 Million
CASL has some of the strictest anti-spam penalties in the world. Organizations can face fines up to $10 million per violation, and individuals up to $1 million. Directors and officers can be held personally liable.
What is CASL?
CASL Overview
Canada Anti-Spam Legislation — CASL, and often just called the CASL law — is one of the world's strictest anti-spam laws. It governs how businesses can send commercial electronic messages (CEMs) to recipients in Canada.
Effective: July 1, 2014
Enforced by: CRTC, Competition Bureau, Office of the Privacy Commissioner
Who Must Comply?
- Any business sending emails to Canadians
- Canadian businesses sending emails anywhere
- Organizations using SMS, social media DMs
- Anyone installing software on devices
CASL Compliance Requirements
To comply with CASL, every commercial electronic message must meet three key requirements.
1. Express and implied consent
You need a consent basis before sending a commercial electronic message. CASL recognises two: CASL express consent, which lasts until it is withdrawn, and CASL implied consent, which expires.
- Express consent: an active opt-in — a ticked checkbox or a signup — that does not expire until it is withdrawn
- Implied consent: an existing business relationship, for 2 years after the last purchase or contract
- Implied consent: a recent inquiry, for 6 months after it was made
Some messages fall outside these rules entirely. See which messages CASL exempts before deciding you need consent, and how express and implied consent differ in practice.
2. Identification
Every message must clearly identify the sender.
- • Business name and contact information
- • Valid mailing address
- • Phone number, email, or website
- • If on behalf of another, identify both parties
3. Unsubscribe
Every message must include a working unsubscribe mechanism.
- • Clear and prominent unsubscribe link
- • Must work for 60 days after sending
- • Process unsubscribes within 10 business days
- • No fees, login, or personal info required
CASL Penalties & Enforcement
Maximum Penalties
Recent Enforcement Actions
Compu-Finder - $1.1 Million
Sending emails without consent
Porter Airlines - $150,000
Deficient unsubscribe mechanism
Blackstone Learning - $640,000
Multiple CASL violations
How Canada Compliance AI helps with CASL today
Of the 11 CASL obligations on our coverage map, a product feature helps with 2, we explain 6, 0 are on the roadmap, and 3 are not covered.
Live product features
- CASL unsubscribe-footer checker (in-app): paste an email footer and it flags a missing mailing address or a footer too short to identify the sender.
- CASL unsubscribe-footer checker (in-app): flags a footer with no clickable unsubscribe link, an unlabelled link, or an opt-out that appears to require logging in.
On the roadmap
Nothing dated on the roadmap for CASL right now.
Further reading on CASL
- What is CASL? Canada's Anti-Spam Law, Explained
- CASL Express vs Implied Consent: Complete Guide with Examples
- CASL Exemptions: When You Don't Need Consent to Email in Canada
- CASL Unsubscribe Requirements: Build a Compliant Opt-Out Mechanism
- CASL Compliance for B2B Companies: Cold Email Rules in Canada 2026
- How to Audit Your Email List for CASL Compliance in 2026
- Double Opt-In and CASL: Is It Required for Canadian Email Marketing?
- CASL Compliance for Email Marketing: Consent, Unsubscribe and Penalty Rules for Canadian Businesses
More in the compliance blog and the overview of Canadian regulations.