CASL-safe lead capture and cold outreach: the Canadian rules that actually apply

Short answer: Cold outreach in Canada gets through only four narrow routes: a conspicuously published address, an address handed to you directly, the business-to-business exemption, or one message after a referral. Each has conditions. A lead form is different, because express consent collected there does not expire on a clock. Build the opt-in into the form, the quote widget and the chat window, and record it when it happens.

A lead system is only as good as the consent behind each contact. This article sits under our wider AI lead generation guide for Canada. Here we cover the consent side of capture, and what the law allows when you contact someone who never came to you. The implied-consent clocks, record keeping and unsubscribe mechanics live in our CASL compliance guide for email marketing.

Why the form is the one place you can get consent that lasts

Every route into an inbox has a weakness except one. Implied consent from an enquiry runs out. A published address only works while your message stays relevant. A referral gives you a single message.

Express consent is different. If someone ticks a clear box asking to hear from you, that consent does not run down on a calendar. The person who claims to have consent also carries the burden of proving it (section 13 of the Act), so the form is where you build that proof at the same moment you build the permission.

What a CASL-proof opt-in on a form, quote widget or chat window looks like

A request for consent has to say clearly and simply what you are asking for. A generic “I agree to the terms and privacy policy” box agrees to your terms. It does not show someone chose to receive marketing.

Our recommendation is a separate checkbox that is not pre-ticked. The wording should name the business and the channel, and say what is coming:

Yes, Harbour Cleaning Co. can email me quotes, tips and offers. I can unsubscribe at any time.

Keep these habits around it:

• Name the business and the channel. An email opt-in is not an SMS opt-in.
• Leave the box empty. A pre-ticked box shows nothing was actively chosen.
• Keep it apart from the terms, and let the form submit with the box empty.
• Log the exact wording, the date and time, and where the submission came from, at the moment of submission.

Chat assistants and instant auto-responders need the same treatment. A chat that collects a name and an address is easy to mistake for consent. Make the opt-in an explicit step in the script and log it as you would a form.

Replying to the enquiry versus marketing to it

Two different things happen when someone fills in a quote form, and they follow different rules.

Replying. If the person asked for a quote or estimate, sending it does not need their consent. Section 6(6)(a) of the Act takes a requested quote out of the consent rule. The message still has to identify you and carry an unsubscribe, and it stays a quote. Add a promotion and you have turned it into marketing.

Marketing afterwards. An enquiry creates implied consent, but only for a short period: six months from the enquiry (section 10(10) of the Act). Then it lapses. We cover how that clock runs, and what restarts it, in the CASL compliance guide.

So a quote request is not nothing, and it is not a permanent mailing list either. It lets you answer the question, and it lets you follow up for a limited time. If you want to keep emailing after that, you need express consent, and the best moment to get it is on the form that started the conversation. Ask once, with a separate box, and the six-month clock stops mattering for that contact.

The four routes into a stranger’s inbox, and how narrow each one is

Without a form submission, you are relying on an exception. The Act and its regulations give you four that matter for small businesses. None of them is a general licence to cold email.

1. A conspicuously published address. Consent is implied if the person published the address, or had it published, in a prominent place, and two things hold. There must be no statement that they do not want unsolicited commercial messages. And the message must be relevant to their business, role, functions or duties in a business or official capacity. This is implied consent under section 10(9)(b), not a free pass. A plumber’s published info address fits a message about plumbing supplies. It does not fit an unrelated consumer product.

2. An address handed to you directly. Section 10(9)(c) works the same way for an address someone disclosed to you. A business card handed over at a trade show is the usual example. Again, there must be no statement against receiving unsolicited messages, and the relevance condition applies. A card given so you could send a brochure does not cover a pitch for something unrelated to their role.

3. The business-to-business exemption. Section 3(a) of the Electronic Commerce Protection Regulations excludes some messages sent between organisations. It covers messages between employees of the same organisation, and messages to an employee of another organisation where the two organisations have a relationship and the message concerns the activities of the organisation receiving it. The word “relationship” matters. This does not cover a cold pitch to a company you have never dealt with.

4. One message after a referral. Section 4 of the same Regulations allows the first message sent to contact a person following a referral, on conditions. The referrer must have an existing business, non-business, family or personal relationship with you, and the same kind of relationship with the person being contacted. Your message must give the full name of the person who made the referral and say it is sent as a result of that referral. After that one message, you need consent.

So you get one properly worded message, and then you need the person to say yes.

Why you cannot email a stranger to ask for permission

The shortcut is “I will just email them to ask if I can email them.” It does not work.

Section 1(3) of the Act treats an electronic message that contains a request for consent to send commercial messages as a commercial electronic message in its own right. That means the request needs consent or an exception before you send it. You cannot get around the rule by asking nicely.

There are honest ways to ask: on the form, in the chat, or in person, before anything is sent. That is why the capture point matters so much.

LinkedIn, directories and scraped lists

CASL does not mention LinkedIn. It does not say a profile can never qualify. What it says is that the conditions above still have to be met: the address has to be conspicuously published or disclosed to you, there has to be no statement against messages, and your message has to be relevant to the person’s role.

Our view is that an address on a personal profile rarely shows those conditions clearly. It is often there for friends and recruiters. It does not tell you the person welcomes sales messages about your service. So we do not rely on it, and we do not build a campaign on it.

The same goes for directories and scraped lists. A scraped list tells you who exists, not who agreed to hear from you. Our view: treat any list you did not build through a form, a conversation or a relationship as a research list, not a mailing list.

What changes when an AI tool builds or messages the list

The consent rules do not move because software did the work. An AI tool that finds contacts or drafts the opening line is doing research and writing. It is not creating a relationship, and feeding the result into a sending tool does not manufacture consent.

What changes is speed and scale. A person sending a handful of cold emails a day has built-in friction, and a bad batch gets noticed. An automation connected to a prospecting tool can send to a whole non-compliant list before anyone looks.

Three habits help:

• Tag each contact with its consent route: express, enquiry with an expiry date, published address, card, B2B relationship, or referral.
• Keep prospecting contacts in a separate pipeline from people who opted in, so a workflow cannot quietly blend the two.
• Have a person read a sample of any AI-written batch before it sends.

Our guide to marketing automation for small business in Canada covers how to build that separation into the workflow itself, and our comparison of marketing automation software in Canada shows how the main platforms store consent and unsubscribes.

A hypothetical Saskatoon commercial cleaning company, worked through

This is a hypothetical, not a client. Imagine a commercial cleaning company in Saskatoon that serves offices and small retail units. It has four contacts to deal with.

1. A website quote request. A facilities manager fills in the quote form and leaves the marketing box empty. The company may send the quote they asked for, with identification and an unsubscribe. It may follow up about that quote. Implied consent from the enquiry runs for six months, so any general marketing has to happen inside that window. After that, it needs express consent. Had the box been ticked, there would be no clock to watch.

2. A business card from a trade show. An office manager hands over a card and says to send details. The address was disclosed to the company directly, with no statement against messages. The company may send a message relevant to the office manager’s role, such as a cleaning service for offices. It should not send an unrelated offer.

3. A property manager referred by an existing client. The client has a relationship with the company and also knows the property manager. The company may send one message that names the client as the referrer and says it is sent because of the referral. A second message needs consent.

4. A list bought from a data vendor. None of the people on it has dealt with the company. The vendor cannot hand over consent it never collected for this sender, and the company has no relationship, no published-address basis it can show for each contact, and no referral. Our advice is to leave the list unused. See the CASL compliance guide on why purchased lists are a trap.

Each contact came in by a different route, and each route allows something different. Without a record of the route, the company cannot show which rule it relied on.

Penalties, privacy law, and when to call a lawyer

The maximum penalty for a violation under section 20(4) of the Act is CA$1 million for an individual and CA$10 million for any other person.

CASL is not the only law. CASL decides whether you may send the message. PIPEDA, and Quebec’s Law 25 if you deal with people there, govern how you collect, store and use the personal data behind it. A lead flow has to satisfy both. Our guide to AI marketing and Law 25 in Quebec covers the Quebec side.

This is general information, not legal advice. If a list or campaign feels borderline, a short consultation with a lawyer costs less than a complaint. For a second set of eyes on your forms, chat scripts and outreach workflow, start with a free AI marketing audit. We set consent capture up as part of our AI automation work for Canadian businesses, and the audit is the easiest way to see where yours stands.

Frequently asked questions

Is a checkbox that says ‘I agree’ enough consent under CASL for a lead form? No. CASL wants a request for consent that clearly says what you are asking for, and a general ‘I agree to the terms’ box does not show someone agreed to marketing. A separate, unticked checkbox that names your business, the channel and what you will send is what holds up, and it is the best practice we recommend.

Can I send a quote to someone who asked for one without their consent? Yes. Section 6(6)(a) of the Act takes a quote or estimate that the recipient requested out of the consent rule. The message still has to identify your business and carry a working unsubscribe, and it should not turn into a sales pitch.

Does a contact form enquiry let me send marketing emails afterwards? Only for a limited time. An enquiry creates implied consent for six months, and after that it lapses. Express consent collected on the form does not run on that clock, which is why we ask for it at the point of capture.

Can I email someone whose address I found on their company website? Sometimes. Consent is implied if the address is conspicuously published, there is no statement that the person does not want unsolicited commercial messages, and your message is relevant to their business, role, functions or duties. If any of those three fails, you need consent first.

Can I contact someone a customer referred to me? You may send one message, under conditions. The referrer must have a relationship with you and with the person referred, and your message must give the referrer’s full name and say it is sent because of the referral. Anything after that first message needs the person’s consent.

Can I send a cold email asking someone for permission to email them? No. Under section 1(3) of the Act, a message that asks for consent to send commercial messages is itself a commercial electronic message. You need consent or an exception before you can send it.

Does CASL say how long I must keep consent records? No. CASL sets no fixed retention period. What it does say is that the person who claims to have consent must prove it, so keep the wording, the date and the source for as long as you rely on that consent.