CASL compliance in 2026: consent, implied consent and exemptions

Short answer: CASL requires consent, clear identification and a working unsubscribe on every commercial email or text, and consent is the part that gets businesses in trouble: the CRTC’s most recent enforcement report found lack of consent behind 93% of complaints. Implied consent from a purchase lasts two years, from an enquiry six months, and businesses regularly lose track of when it runs out. The law has not changed for 2026, but enforcement has, with far more notices to produce than warning letters, and penalties still up to C$10 million per violation for a business.

CASL is not actually hard. Get consent, say who you are, let people leave. What gets businesses in trouble is not the rule itself, it is that the onus of proving consent sits with the sender, not the regulator. If someone complains and you cannot produce a record of when and how they agreed to hear from you, you are already on the back foot, whatever your intentions were. That single fact explains why implied consent expires and why a purchased list is worthless even if nobody on it ever complains.

What every commercial message actually needs

Every commercial electronic message you send in Canada, email, text or a direct platform message, has to clear three requirements.

• Consent, express or implied, before you send.
• Identification: your business name, a mailing address, and one more contact method (phone, email or website).
• Unsubscribe: a working opt-out, actioned within 10 business days, that keeps working for at least 60 days after the message was sent.

A fourth requirement applies before you even have consent: the request itself has to say who is asking, why you want to send messages, how to contact you, and that consent can be withdrawn at any time.

Implied consent, and why the clock is the part that catches people out

Implied consent is where timing matters as much as permission. It comes in a few shapes, each on its own clock.

An existing business relationship. A purchase or active contract gives implied consent for two years from the most recent purchase, a rolling window: a new purchase resets the clock, so a customer who keeps buying stays inside it.

An enquiry or application. Asking about your product or requesting a quote gives six months from that enquiry, a window that often expires unnoticed.

An existing non-business relationship. Donations, volunteering, and membership with a registered charity, political party or club create implied consent the same way a business relationship does.

Conspicuous publication also applies, under narrow conditions covered in full by our guide to CASL-safe lead capture and cold outreach, so we will not repeat it here.

The practical problem is bookkeeping, not the rule. Record the expiry date the moment a relationship starts, inside whatever CRM you run (our guide to marketing automation platforms in Canada compares how a few handle consent fields), and trigger an express opt-in before the window closes.

A hypothetical: a landscaping company in Hamilton gets most new customers in a two-month spring burst. Customers who book again the next spring restart their two-year window. Customers who do not stay on the original one, and early in the third spring those windows start closing week by week. The business still treats “our customer list” as one group, so it keeps emailing people whose consent quietly ran out, when a per-contact expiry date would have flagged each one in time for an opt-in request.

Messages that need no consent, but still need identification and an unsubscribe

Not every message needs consent. CASL treats some messages as transactional, which can go out without permission but still need to identify your business and carry a working unsubscribe.

The transactional category covers:

• A quote or estimate the person asked for.
• A message that facilitates, completes or confirms a transaction already under way.
• Warranty, recall, safety or security information.
• Factual updates on an existing subscription, membership, account or loan.
• Information about an employment relationship or benefit plan.
• Delivery of a product or service, including entitled updates or upgrades.

A smaller set is exempt from CASL altogether: genuine personal or family messages, internal messages within one organisation, and messages between two organisations that have a relationship, where the message concerns the receiving organisation’s activities.

The catch: load a transactional message with promotions and it stops being transactional. A shipping confirmation that also pitches your next sale is no longer a pure transaction once the promotion is central rather than incidental.

What actually changed for CASL in 2026

The law has not been amended. Searching “new CASL” expecting new rules will not turn any up: it is the same statute that has applied since 2014. What changed is enforcement.

The CRTC’s enforcement report covering 1 October 2025 to 31 March 2026 shows the Spam Reporting Centre received 189,908 submissions, averaging 7,304 a week. Email accounted for 60% of what was reported, SMS for 34%. Of the complaints reviewed, lack of consent was cited in 93%, failure to identify the sender in 48%, and deceptive marketing practices in 46%. Consent, not creative, is overwhelmingly the thing people report.

On the response side, the CRTC issued 11 warning or information letters, 96 notices to produce, and two preservation demands, and flagged broken or difficult unsubscribe processes as a concern. It said plainly that it expects heightened compliance and intends to use stronger enforcement where appropriate. Penalties have not moved: up to C$10 million per violation for a business, C$1 million for an individual.

Our read, a read rather than something the CRTC stated outright, is that 96 notices to produce against only 11 warning letters looks like evidence-gathering, not a regulator handing out slaps on the wrist. A notice to produce is a formal demand for your records, and a warning letter is the good outcome, not the default one.

Worth stating plainly: CASL’s private right of action, which would have let individuals sue businesses directly, was suspended before it took effect in 2017 and has never come into force. Regulatory enforcement through the CRTC is what exists today. Full detail is in the CRTC’s own enforcement report.

Clinics, dental offices and other regulated practices

Searches for “CASL compliance healthcare marketing Canada” usually come from clinics trying to work out which patient messages need consent. The general shape, and this is general information rather than legal advice specific to your practice, is a split between transaction and promotion.

A confirmation or reminder for a booked appointment sits in the transactional category above: it facilitates something already under way, so it needs no consent, though it still needs to identify your practice and carry a working unsubscribe or equivalent.

A recall newsletter, a book-your-next-cleaning campaign, or a new-service announcement is commercial and needs consent, because it is prospecting for new business, not confirming one already under way.

A second question CASL does not answer: what you can do with a patient’s actual health information. That sits with provincial health privacy law, such as Ontario’s PHIPA, which governs how health information is collected, used and disclosed, not whether you can send a marketing message. A practice can be fully CASL compliant and still fall short of its health privacy obligations, or the reverse.

Who actually has to prove consent existed

Section 13 of CASL puts the burden of proof on whoever claims consent existed, which in practice means you. If a recipient complains they never agreed to hear from you, it is your job to produce the record showing they did, not the CRTC’s job to prove otherwise.

CASL sets no fixed retention period, which surprises people who have heard “keep it for three years” quoted as though it were written into the Act. It is not. That figure is common advice because proceedings under CASL can start up to three years after the CRTC becomes aware of a violation, so keeping records for at least three years after the relationship ends, rather than three years from when consent was given, is the safer practice.

What needs recording: the exact wording someone agreed to, the date and time, and where consent was captured, whether that is a form, a checkbox in your booking software, or a verbal agreement logged immediately afterwards. “We are pretty sure they signed up” is not a record. A timestamped entry tied to specific wording is.

The habits that quietly break CASL

A handful of habits account for most CASL trouble.

Buying or renting a list. That consent, if it existed at all, would have to expressly cover a third party sending messages, provably. This almost never holds up, so treat a bought or rented list as unusable.

Uploading phone contacts or LinkedIn connections into a marketing tool. The personal relationship exemption covers genuine personal relationships, not everyone whose number you saved. Bulk-importing and messaging on that assumption generates complaints fast.

Pre-ticked consent boxes. A box that starts ticked and requires an active opt-out is not consent, because nothing was actively agreed to.

Consent bundled into your terms of service. Agreeing to your terms is not the same as agreeing to marketing messages, and CASL wants the two kept separate.

Cold outreach and prospecting run under stricter rules again, covered properly in our guide to CASL-safe lead capture and cold outreach.

A short note on SMS and emailing across the border

CASL is not an email-only law. It covers commercial electronic messages generally, so marketing texts need the same consent, identification and unsubscribe as email, and a direct message on a social platform can count too when commercial and sent to a specific address. Public posts and ads are generally not caught, because they are not sent to a specific address.

If your list crosses into the United States, CASL is the stricter regime: CAN-SPAM allows messaging until someone opts out, with no upfront consent required. Build to the CASL standard for your whole list, and you clear both laws at once.

Where to start if you are not sure you are covered

None of this needs a compliance department. It needs one habit: capture consent, in writing, the moment it is given, somewhere retrievable.

Work through this:

• Every active list traces back to a specific consent event, or a transactional relationship needing none.
• Implied consent contacts have a tracked expiry date, not a guess.
• Every commercial message names your business, gives a mailing address, and offers a second contact method.
• Unsubscribe requests are actioned inside 10 business days, and someone has tested the unsubscribe link recently.
• Nothing on your list arrived by purchase, scrape or bulk contact import.
• Consent records are kept at least three years past the end of the relationship, wording and timestamp attached.

A platform that tracks consent source, timestamp and expiry removes most of that manual risk, part of why we build it into the AI automation we set up for Canadian clients, alongside the workflows in our guide to marketing automation for small business in Canada. A consented list is also easier to judge honestly, because every contact on it chose to be there, which is what makes measuring automation ROI meaningful rather than guesswork. Want a second set of eyes on your own setup? Get a free AI marketing audit.

Frequently asked questions

How long does implied consent last, and what restarts it? A purchase or active contract gives you two years from the most recent purchase, and a new purchase restarts that clock. An enquiry or application gives six months, with no reset unless the person engages again. Track both dates per contact, not as one list.

Which messages can I send without consent, and what do they still need? Genuinely transactional messages, a requested quote, a transaction confirmation, warranty or recall information, account updates, employment-related messages, and entitled deliveries, do not need consent. They still need to identify your business and carry a working unsubscribe. Load one with promotions and it stops qualifying as transactional.

Has anything about CASL actually changed for 2026? The law has not been amended. What changed is enforcement tone: the CRTC’s report for 1 October 2025 to 31 March 2026 shows far more notices to produce (96) than warning letters (11), and states it expects heightened compliance and stronger enforcement where appropriate. Penalties are unchanged at up to C$10 million per violation for a business.

Do clinics and dental offices need consent to send appointment reminders? Generally no. A reminder for a booked appointment is transactional, so it needs no consent, though it still needs to identify the practice and offer a way to stop reminders. Recall newsletters and book-your-next-visit campaigns are commercial and do need consent. This is general information, not legal advice for your specific practice.

Can buying or renting an email list ever be CASL compliant? In practice, no. A purchased list only carries consent you can rely on if the original consent expressly covered a third party sending messages, and you can prove that in writing. That combination essentially never holds up, so treat a bought list as unusable.

What are the penalties for breaking CASL? Up to C$10 million per violation for a business and up to C$1 million for an individual. CASL’s private right of action, which would have let individuals sue directly, was suspended before it took effect in 2017 and has never come into force, so enforcement runs through regulators, mainly the CRTC, not private lawsuits.

What has to be included when you ask someone for consent? The request has to say who is asking, why, how to reach you, and that consent can be withdrawn at any time. A vague sign-up prompt that does not name your business does not meet that bar, even if someone ticks it.

---

Want your email marketing CASL-safe without babysitting expiry dates yourself? Get a free marketing audit. No jargon, no pressure.