CASL Explained for Small Business Websites

What CASL is, in plain English

CASL is Canada’s anti-spam legislation. In short, it says that before you send someone a commercial electronic message, like a marketing email or a promotional text, you need their consent. Innovation, Science and Economic Development Canada’s plain-language guide puts it simply: consent is at the heart of CASL.

For a small business, most CASL decisions happen on your website. That is where people sign up for newsletters, request quotes, create accounts and check out. Get those moments right and most of your compliance follows.

“Good email marketing and CASL want the same thing: messages people actually asked for.”

What counts as a commercial electronic message

ISED’s guide frames it as two questions. Is the message sent to an electronic address, usually through email, SMS, instant messaging or similar platforms? And does it contain commercial or promotional information, such as marketing, sales, offers or solicitations?

If both answers are yes, CASL rules apply. That covers newsletters with offers, promotional emails, marketing texts and similar messages. The law also treats an email that asks someone for consent to send them marketing as a commercial electronic message itself, which matters when you plan to re-permission an old list.

Does CASL apply to my business?

If you send marketing emails or texts to people in Canada, assume CASL applies and plan accordingly. It is not just for big companies with huge lists. A two-person business sending a monthly offer email is covered just the same.

There are exceptions and edge cases, such as messages between people with a personal or family relationship. The Act also excludes a message sent to a person engaged in a commercial activity that consists solely of an inquiry or application related to that activity. If your situation is unusual, get legal advice rather than guessing.

The three rules that matter most

Almost everything else in this guide is about doing those three things well on your website and in your email tools.

Why CASL can actually help your marketing

It is easy to see CASL as red tape. In practice, its core ideas line up with good email marketing.

• People who chose to hear from you are more likely to open and act on your emails.
• Clear identification builds trust, especially with new customers.
• Easy unsubscribes keep complaints low, which protects your ability to reach inboxes.
• Good records mean you know exactly where your best subscribers came from.

Treat compliance as a quality standard for your list, not just a legal box to tick.

Express consent

Express consent means someone has actively agreed, verbally or in writing, to receive commercial electronic messages from you. According to ISED’s guide, there is no time limit on express consent unless the person withdraws it.

That makes express consent the gold standard for your email list. When someone ticks an unchecked box that says yes, send me your newsletter and offers, you have a clear, lasting basis to email them, as long as you keep a record and honour unsubscribes.

Express consent also travels well. If you change email platforms, redesign your website or hire a new marketing helper, a list built on clear, recorded express consent moves with you without any guesswork.

Implied consent, and why it expires

Implied consent applies only in certain situations. The most common for small businesses is an existing business relationship, for example someone who bought from you or sent you an inquiry.

The catch is time. ISED’s guide notes that implied consent may be valid for up to 2 years, or just 6 months in the case of inquiries or applications. After that, unless you have obtained express consent, you should stop sending them marketing messages.

Consent can also be implied when someone has conspicuously published their email address, such as on a website, without saying they do not want unsolicited messages, and your message is relevant to their business role. Treat this narrowly. It is not a licence to email every address you can find.

Business-to-business emails

CASL applies to business-to-business marketing too. Emailing another company’s staff about your services is still a commercial electronic message.

ISED’s guide suggests asking practical questions: did the person publish their contact information online, or give you a business card? Look closely for any do-not-contact instructions, and make sure your message is relevant to their business, role or duties.

Scraping addresses from websites and sending everyone the same pitch is exactly the kind of behaviour CASL was written to stop. Keep B2B outreach targeted, relevant and easy to opt out of.

What a consent request must include

When you ask for consent, the CRTC’s regulations set out what the request must include:

• the name your business operates under
• if you are asking on behalf of someone else, their name and which of you is asking
• your mailing address, and a phone number, email address or web address
• a statement that the person can withdraw their consent

The regulations also say consent can be requested orally or in writing, and must be sought separately for each of the activities the law covers, such as sending commercial messages. In practice, make your email opt-in its own clear choice, with its own wording, rather than burying it in your terms and conditions.

No pre-checked boxes

This one trips up a lot of websites. The CRTC’s guidance on toggling says pre-checked boxes are not acceptable for obtaining express consent, because they put the onus on the person to uncheck the box if they do not consent.

Instead, the person must take a positive action, such as ticking an unchecked box themselves. Check every form on your site, including checkout pages and account sign-ups, where pre-ticked marketing boxes often hide.

Designing a compliant sign-up form

A good newsletter or marketing sign-up form is simple and honest:

• An unchecked box, or a clear button that only signs people up for marketing.
• Plain wording about what they will receive, such as tips, news and offers.
• Your business name and contact details, or a link to them.
• A line saying they can unsubscribe at any time.
• A link to your privacy policy.

Made-up example wording: Yes, send me tips, news and offers from Example Plumbing. You can unsubscribe at any time. Example Plumbing, 123 Main Street, Anytown, info@example.com. Short, clear and easy to say yes or no to.

Pop-ups, chat widgets and other sign-up tools

Pop-ups, slide-ins, chat widgets and checkout add-ons all collect email addresses. The same rules apply to every one of them.

• Use an unchecked box or a clear sign-up action, never a pre-ticked one.
• Say plainly what people are signing up for.
• Make it easy to close the pop-up without signing up, especially on phones.
• Check that each tool passes sign-up details and consent records to your email platform.

Third-party widgets are easy to install and easy to forget. Review them whenever you review your forms.

Wording that builds trust

Compliant wording does not have to sound like a legal document. The best sign-up copy is clear, specific and friendly.

• Say what people will get: monthly tips, seasonal offers or early access to bookings.
• Say how often, roughly, so nobody feels ambushed.
• Say who you are, by name.
• Say they can unsubscribe anytime, and mean it.

Setting honest expectations at sign-up means fewer unsubscribes and spam complaints later. People who know what they signed up for are far more likely to read what you send.

Contact and quote forms

When someone fills in your contact or quote form, they are making an inquiry. That can create implied consent for a limited time, which ISED’s guide puts at 6 months for inquiries.

Some messages do not need consent at all. The Act says the consent requirement does not apply to a message that solely provides a quote or estimate the person asked for, or that solely facilitates, completes or confirms a transaction they previously agreed to. Those messages must still meet the other requirements, such as identifying your business.

The key word is solely. If your quote email also pushes unrelated promotions, it is no longer just a quote.

Order confirmations and service emails

Not every email you send is marketing. The Act says the consent requirement does not apply to messages that solely facilitate, complete or confirm a transaction the person previously agreed to, or that provide warranty, product recall, safety or security information about something they bought or use.

That covers things like order confirmations, receipts, booking reminders and delivery updates. They still need to identify your business, so keep your footer in place.

Be careful with mixed messages. Adding a big promotional banner to an order confirmation can turn a transactional email into a marketing one. Keep transactional messages focused, and send promotions separately to people who have agreed to them.

Collecting consent in person or by phone

Consent does not have to happen online. The CRTC’s regulations say a request for consent may be obtained orally or in writing.

• At a market stall or event, use a sign-up sheet or tablet with clear opt-in wording.
• On the phone, read a short consent script that includes your business name and that people can unsubscribe at any time.
• Record the date, the person’s details and the wording used.
• Add them to your list with a note of how and when they agreed.

Verbal consent is valid, but harder to prove. Good notes make the difference.

Contests, giveaways and free downloads

Contests and free guides are popular ways to grow a list. They are also where consent gets blurry.

• Entering a contest is not the same as agreeing to marketing emails.
• Downloading a free guide is not automatically a newsletter sign-up.
• If you want to add people to your marketing list, ask separately and clearly, with an unchecked box.
• Deliver what you promised first, whether or not they opt in.

Clear opt-ins may grow your list a little more slowly. They also give you subscribers who actually want to hear from you.

Identify yourself in every message

Every commercial message needs to say clearly who it is from. Based on ISED’s guide and the CRTC’s regulations, include:

• your business name, and the name of anyone you are sending on behalf of
• a current mailing address
• a phone number, email address or website
• contact information that stays valid for at least 60 days after you send the message

The regulations say this information, and your unsubscribe mechanism, must be set out clearly and prominently. Most email platforms add a footer for this. Check that yours is filled in correctly and up to date.

If you move offices or change your phone number, update your email footer the same day. Out-of-date contact details in every message is an easy mistake to make and an easy one to avoid.

Make unsubscribing easy

Under the Act, the unsubscribe mechanism must let people opt out at no cost, using the same electronic means the message was sent by, or another practical electronic means. The regulations add that it must be readily performed.

Timing matters too. The Act says effect must be given to an unsubscribe without delay, and in any event no later than 10 business days.

• Put a clear unsubscribe link in every marketing email.
• Do not make people log in, explain themselves or jump through hoops.
• Make sure unsubscribes sync to every tool that sends email.
• Never re-add someone who unsubscribed without fresh express consent.

Keep records of consent

ISED’s guide says senders should be ready to provide proof of consent if asked. For a small business, that means keeping simple, reliable records.

• when the person signed up
• where, such as which form or page
• what wording they agreed to
• how the consent was given, such as a checkbox or a verbal yes noted by staff
• any unsubscribe or withdrawal, and when

Many email platforms record sign-up dates and sources automatically. Make sure your website forms pass that information through, and keep a copy of your form wording each time you change it.

Is double opt-in worth it?

Double opt-in means someone signs up, then confirms by clicking a link in a follow-up email before they are added to your list.

It adds a step, so some people never confirm. In return you get a cleaner list, fewer fake or mistyped addresses and a very clear record that the person wanted your emails. For many small businesses, that trade-off is worth it, especially for newsletters with public sign-up forms.

Whichever approach you choose, be consistent and keep the records your email platform produces.

Cleaning up an old email list

If you have an old list with unclear consent, do not just blast it with a new campaign.

• Separate contacts with clear express consent from everyone else.
• For contacts with valid implied consent, such as recent customers, ask for express consent before it expires.
• Remember that an email asking for consent is itself a commercial message, so only send it where you still have a valid basis.
• Stop marketing to contacts with no valid consent.

A smaller list of people who want your emails will usually outperform a bigger list of people who do not.

Keep a note of what you decided for each group and why. If questions come up later, a clear record of your clean-up is far more reassuring than a guess.

Texts and messaging apps

CASL is not just about email. ISED’s guide lists SMS, instant messaging and similar platforms alongside email. If you send promotional texts or messages through apps, the same rules on consent, identification and unsubscribing apply.

Text messages feel personal, so people react strongly to unwanted ones. Be especially careful to have clear consent and an easy opt-out before you start texting customers.

When someone sends on your behalf

Many small businesses use an agency, freelancer or platform to send emails. Under the CRTC’s regulations, messages and consent requests must name both the sender and the business on whose behalf they are sent, where those are different.

• Make sure your name appears clearly in messages sent for you.
• Check that whoever sends for you uses only lists with proper consent.
• Agree in writing who handles unsubscribes and records.
• Do not hand over lists without confirming how consent was obtained.

Outsourcing the sending does not outsource the responsibility. Your name is on the message.

A note for charities and nonprofits

ISED’s guide notes that charitable or not-for-profit organizations may have implied consent in certain situations, such as when the recipient has made a donation or been a member or volunteer.

There is also a specific exemption in the Electronic Commerce Protection Regulations for messages sent by or on behalf of a registered charity whose primary purpose is raising funds for the charity. Nonprofits that are not registered charities do not get that exemption, and not every message from a charity is a fundraising message, so get advice for your situation.

CASL and privacy work together

ISED’s guide reminds businesses that CASL is not the only rule they must follow. Many also have obligations under PIPEDA, Canada’s federal private sector privacy law, especially around how they collect and handle personal information.

For your website, that means your sign-up forms, contact forms and analytics should be covered by a clear privacy policy that explains what you collect, why and how people can reach you about it. Collect only what you need.

What is at stake

CASL has real teeth. The Act sets a maximum administrative penalty of $1,000,000 per violation for an individual and $10,000,000 for any other person, such as a business.

Most small businesses will never face anything like that. But compliance protects more than your bank account. Messages people asked for get opened, clicked and acted on. Messages they did not ask for get reported as spam, which can hurt your ability to reach anyone’s inbox.

Compliance also tells customers something about you: that you respect their inbox, their time and their choices.

Let your email tools help

Reputable email marketing platforms build in many CASL-friendly features: unsubscribe links, footers with your business details, sign-up date tracking and double opt-in options.

• Fill in your business name and mailing address in the account settings.
• Use the platform’s sign-up forms or connect your website forms properly.
• Turn on double opt-in if you want an extra layer of proof.
• Review your list sources and remove imported contacts without consent.

The tool helps, but the responsibility stays with you. Check your settings, and test your own sign-up and unsubscribe flow from start to finish.

Compliance is the floor, relevance is the goal

Following CASL keeps you on the right side of the law. Sending emails people value keeps them reading.

• Send less, but make every message useful.
• Segment your list, so customers get messages that fit them.
• Use your customers’ real questions as inspiration for content.
• Watch unsubscribes and complaints as early warnings, not just numbers.

A smaller, engaged list beats a large, annoyed one every time, for your results and for your reputation with email providers.

Your website CASL checklist

1. Audit your forms. Find every form that can add someone to marketing, including checkout and account pages.
2. Remove pre-checked boxes. Replace them with unchecked opt-ins or clear sign-up actions.
3. Update consent wording. Include your business name, contact details and a withdrawal statement.
4. Check your email footer. Business name, mailing address, contact details and an unsubscribe link.
5. Test unsubscribing. Make sure it works in one step and syncs everywhere.
6. Set up records. Capture date, source and wording for every sign-up.
7. Review your list. Separate express, implied and unclear consent, and act on each.
8. Get advice where needed. Talk to a lawyer about anything unusual or high-volume.

Work through it once, then review it whenever you add a new form, tool or campaign type.

Review your setup regularly

Websites change. New forms appear, plugins get added, staff come and go. Put a CASL check on your calendar a couple of times a year, and after any redesign or new campaign tool.

• Re-test every form that adds people to marketing.
• Re-test unsubscribing from a recent campaign.
• Check your email footer details are still accurate.
• Spot-check records for a few recent sign-ups.

Ten minutes of checking can prevent a lot of trouble later.

Common mistakes

• Pre-checked marketing boxes on forms and checkouts.
• Emailing everyone who ever contacted you, long after implied consent expired.
• Buying email lists.
• Unsubscribe links that do not work, or require a login.
• No records of when or how people signed up.
• Quote emails stuffed with promotions.

Each of these is easy to fix once you know to look for it.

Getting your website right

Most CASL compliance on a small business website comes down to well-built forms, clear wording and email tools that are set up properly. Our guide to website migrations is a reminder to check forms whenever your site changes, and our content guide covers writing sign-up wording people actually respond to.

For legal questions, talk to a lawyer. For the website side, make sure whoever manages your site checks every form against the checklist above.

Frequently asked questions