How to set up marketing automation in Canada with CASL built in

Short answer: To set up marketing automation in Canada with CASL built in, create the consent record as fields on every contact first: source, date, type, wording, and the dates that drive implied consent expiry. Then build workflows that read those fields, so the platform asks for express consent before a window closes and stops marketing when it does. Add a locked footer, a separate stream for quotes and receipts, and a check on where your data is stored.

Our view: most CASL trouble in automation is not a badly written email. It is a missing field, or an expiry date nobody tracked, so the platform kept sending to people it should have stopped. The order of the build matters.

This guide sits under our piece on marketing automation for Canadian small business, which covers what to automate. This one covers configuring the platform so the legal side runs itself. If you are still deciding whether it pays, start with the payback maths.

One warning first. If you cannot say where most of your contacts’ consent came from, do not automate yet. Automation only multiplies whatever your list already is.

Start with one field: where each contact’s consent came from

Under section 13 of the Act, a person who says they have consent has the onus of proving it. A tag in your platform is that proof, or you have none. Before you build a workflow, add these fields to every contact record:

• Consent type: express or implied.
• Consent source: the named form, checkout step, quote request or conversation it came from.
• Consent date: when it was given.
• Consent wording: the exact text the person agreed to, or the form version that showed it.

Make the source a fixed dropdown, not free text, and make the type field required so a contact cannot be saved without one. Then have forms stamp the source, date and wording themselves, so no person has to remember. Our guide to CASL-safe lead capture covers how to word the checkbox. This page is about what the platform does with the answer.

Turn the CASL clocks into workflows that run themselves

Implied consent expires. It lasts two years from a purchase and six months from an enquiry, and express consent given on a form does not run on that clock. The full rules are in our CASL compliance guide. For the build, you need two more date fields: last purchase date and last enquiry date. Your platform can then work out each contact’s expiry itself.

Build two workflows on top of those dates.

The asking workflow. For contacts with implied consent only, request express consent while the window is still open, with a lead time that gives people a chance to respond. Keep it a plain, single-purpose message with your identification and an unsubscribe in the footer.

The suppression workflow. On the expiry date, if the contact has not given express consent, move them to a suppressed state. That state must block every marketing send in every workflow. Test that it does.

Re-check the dates each time a contact buys again, because a new purchase restarts the two-year window.

Sorting an old list before it goes anywhere near the platform

Sort your old list into three piles before importing anything.

1. Provable express consent. You can show the person asked to hear from you.
2. Provable implied consent, still inside its window. A dated purchase or enquiry.
3. Unknown. You cannot say where the address came from, or when.

The unknown pile does not get imported into marketing lists. It is tempting to email those people once to ask if they want to hear from you. You cannot. Under section 1(3) of the Act, a message that asks for consent to send commercial messages is itself a commercial electronic message, so it needs consent or an exception before it goes out. We explain this in the lead capture guide.

Ask where the person already meets you instead: a quote form, a phone call, the next job. Keep the unknown pile in a list no workflow can read.

The footer every automated message needs

Section 6(2) of the Act requires every commercial message to identify who sent it, give a way to contact them, and carry an unsubscribe mechanism. The Electronic Commerce Protection Regulations set out the identification detail: the name you carry on business under, your mailing address, and a telephone number, email address or web address. It must be set out clearly and prominently, and unsubscribing must be readily done.

Section 11 of the Act covers the unsubscribe itself. It must let people opt out at no cost, through an electronic address or web page that stays valid for at least 60 days after the message is sent. You must give effect to it without delay, and no later than 10 business days after the person asks to unsubscribe.

Build all of that into the platform, not into each email:

• Lock the footer. Put the identification and unsubscribe block in a locked template section, so nobody can delete it or send a campaign without it.
• Make unsubscribes global by default. Opting out of one workflow should suppress marketing everywhere, unless the person chose a narrower class.
• Sync every tool that sends. If your booking tool or a second email service also sends marketing, an unsubscribe in one must reach the others.

Keep quotes and receipts out of the marketing stream

Section 6(6) of the Act lists messages that do not need consent, including one that solely provides a quote or estimate the recipient asked for, and one that confirms a transaction they already agreed to. Read what it says: paragraph 6(1)(a), the consent requirement, does not apply to them. Nothing in it lifts section 6(2), the identification and unsubscribe duty. On the text of the Act, these messages are excused from consent only.

Our advice is to treat them as a separate transactional stream:

• A separate sending stream in the platform, with its own template.
• The same locked identification and unsubscribe footer as marketing.
• No promotional blocks or “you might also like” sections.
• A rule that a transactional message never adds a contact to a marketing list.

Do not add a promotion to a quote or receipt. Once the message does more than its excused purpose, it becomes a marketing message, and it needs consent like any other.

Where the platform keeps Canadian customer data

CASL decides whether you may send. Privacy law, usually PIPEDA, decides what you may do with the data behind the send. The point to build around is accountability. The Office of the Privacy Commissioner’s guidelines for processing personal data across borders say the organisation that transfers personal information to a third party for processing remains accountable for it, including when it is processed abroad. The guidelines also expect you to be open with customers that their information may be processed in another country, and ideally to say so when you collect it.

In practice, ask your vendor which countries hold the data, including backups and support access. Say so plainly in your privacy policy. Read the contract for what the vendor may do with the data, and write down what you checked and when.

Alberta, British Columbia and Quebec have their own private-sector privacy laws, which can apply instead of PIPEDA to businesses operating there. The pillar guide covers that detail. Our advice is not to pick a platform on price alone until you know where it keeps your data. For choosing one, see our comparison of platforms in Canada.

Quebec contacts need their own settings

Quebec contacts bring Law 25 and French-language expectations on top of CASL. Add a province field and a language field to every contact record now, because you cannot sort people you never recorded. Then route them into their own workflows and templates. Our guide to AI marketing and Law 25 in Quebec covers what those rules ask for.

A hypothetical Winnipeg renovation company, set up in order

This is a hypothetical, not a client: a hypothetical Winnipeg renovation company that keeps contacts in a spreadsheet and replies from a shared inbox. The list is mixed: past customers, quote requests, and a stack of trade show business cards. The build would run in this order.

Fields first. The owner adds consent type, source, date and wording, plus last purchase date, last enquiry date, province and language. Source becomes a dropdown: “quote form”, “job completion form”, “trade show card”.

Sort the list. Past customers with a job in the last two years go in pile two, with their job dates. People whose last quote request was over six months ago have no live consent left, so they stay out of marketing alongside pile three. The trade show cards are the awkward part: the company has no note of what each person was told, so it logs them as unknown and leaves them out of marketing.

Build the clocks. The asking workflow targets past customers with implied consent only, ahead of their two-year date. The suppression workflow closes the gap after.

Lock the footer and split the streams. Quotes and job receipts go through a transactional stream with the locked footer and no promotions.

Check the data and the province. The owner asks the vendor where data is stored, updates the privacy policy, and tags the Quebec contacts.

Only then does it build its first follow-up workflow, and the platform already knows who it may email.

What to check before the first automated send

Run this on the platform itself, and fix any failure before real contacts touch it:

• Make a test contact for each consent state and confirm each is treated correctly.
• Confirm unknown and suppressed contacts cannot receive any marketing workflow.
• Send yourself a marketing message and a quote, and check the footer: business name, mailing address, a contact method, and a working unsubscribe.
• Unsubscribe the test contact and confirm it is suppressed in every tool that sends.
• Check required fields cannot be left blank.

This is general information, not legal advice. A lawyer should check your specific setup, especially if you have Quebec contacts or sell into regulated sectors.

If you would like a second pair of eyes on your fields, footers and expiry rules, get a free audit. We set this up as part of our AI automation work for Canadian businesses.

Frequently asked questions

What fields does a Canadian contact record need for CASL?

At minimum: consent type (express or implied), consent source, the date consent was given, and the exact wording or form it came from. For implied consent, add a date for the last purchase and a date for the last enquiry so the platform can work out when the window closes. A province field and a language field are worth adding too. Without these fields you are relying on memory, and the Act puts the burden of proof on you.

Can my automation platform remove contacts when implied consent expires?

Yes, if you build the rule yourself. Most platforms can run a workflow on a date field, so you set one that checks each contact’s last purchase and last enquiry dates, sends a request for express consent while the window is still open, then moves the contact to a suppressed state when it closes. Check that the suppression actually blocks marketing sends before you rely on it.

What do I do with old contacts when I cannot prove consent?

Keep them out of your marketing lists. Do not import them as marketable, and do not email them to ask for permission, because under section 1(3) of the Act a request for consent is itself a commercial electronic message. Ask for consent where the person already meets you: a form, a conversation or a visit. Contacts you cannot place stay in a research or archive list.

Does a quote or receipt email need an unsubscribe link in Canada?

Section 6(6) of the Act says only that the consent requirement in paragraph 6(1)(a) does not apply to a message that solely provides a quote or estimate the recipient asked for, or confirms a transaction they already agreed to. The identification and unsubscribe requirements in section 6(2) are not lifted by that wording. Our advice is to include both in every message, and keep promotions out of them.

Is it a problem if my marketing platform stores data in the United States?

Not automatically, but you stay accountable for personal information you hand to a processor, wherever it sits. The Privacy Commissioner’s guidance expects you to be open with customers that their information may be processed in another country. Find out where your platform stores data, say so plainly in your privacy policy, and keep a note of what you checked.

How should I set up automation if some contacts are in Quebec?

Record province and preferred language on every contact so Quebec contacts can be filtered into their own workflows. Then handle them separately: Law 25 adds privacy duties on top of CASL, and French-language expectations affect the messages themselves. Do not rely on a shared English-only sequence for those contacts. Get advice on the specifics before you send.