CASL compliance for marketing email communications
What Canada's Anti-Spam Legislation (CASL) is and when it applies
CASL regulates commercial electronic messages (CEMs), which are messages that encourage participation in a commercial activity (including fundraising, paid events/programs, promotions). It applies to email and other electronic messages (for example, texts).
Common university examples: paid program promotion, fundraising, paid event invites, sponsorship/marketing announcements.
Often not commercial: purely informational updates, academic/research news with no promotional intent, internal employee communications (use judgment—context matters).
The four things CASL generally requires
If you’re sending a CEM, you typically need:
- Consent (express or implied)
- Clear identification of who’s sending (and on whose behalf)
- Valid contact information (kept valid for 60 days after sending)
- A working unsubscribe option
Rule of thumb: consent + identify + unsubscribe + keep proof.
Consent: express vs. implied
Express consent (preferred): the person actively opted in (e.g., checkbox/sign-up). Best for ongoing newsletters.
Implied consent (time-limited): can apply based on relationships or context (e.g., recent business/non-business relationship like donations/membership/volunteering, or a publicly posted email relevant to their role). It can expire—use it cautiously and treat it as a bridge to express consent.
Unsubscribes and recordkeeping
Your unsubscribe option must be easy, free, and functional. Unsubscribe links must stay active for 60 days, and requests must be processed within 10 business days.
You also need to keep records, because the sender must be able to prove consent (how/when it was obtained and what people agreed to receive).
Penalties
CASL allows significant administrative monetary penalties: up to $1M for individuals and $10M for organizations, with enforcement involving bodies including the CRTC, Competition Bureau, and Office of the Privacy Commissioner.