CASL and Cold Email to Canada: Consent, Exemptions, Proof

CASL bans commercial email to Canadian addresses unless the recipient has consented, expressly or by implication, or an exemption applies. For cold outreach the usual route is implied consent from conspicuous publication. The person published the address, did not say "no unsolicited messages", and your email is relevant to their job. You have to be able to prove all three.

That makes Canada's Anti-Spam Legislation the opposite of CAN-SPAM in structure. The US law lets you send first and requires you to stop when asked. CASL requires a lawful basis before the first message. This post quotes the Act, its two sets of regulations and the CRTC's published guidance, then turns them into a decision sequence for a cold campaign. This is not legal advice.

Does CASL apply to my cold emails?

Yes, if any recipients are in Canada, wherever you are based. The CRTC's CASL FAQ answers it directly:

"Commercial electronic messages (CEM) sent to recipients in Canada from another country must comply with CASL. Senders of CEMs need to: (1) obtain consent, (2) provide identification information, and (3) provide an unsubscribe mechanism."

What counts as commercial is broad. Section 1(2) of the Act covers a message where "it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity". That includes messages that offer or promote a product or service. "One of its purposes" is wider than CAN-SPAM's "primary purpose" test. A friendly note with a soft pitch at the end is still a CEM.

There is a foreign-state exemption, and US senders often misread it. Regulation SOR/2013-221, section 3(f) exempts a message where the sender "reasonably believes the message will be accessed in a foreign state that is listed in the schedule" and it complies with that state's similar law. The schedule includes the United States and the United Kingdom. It covers Canadian senders emailing recipients abroad. It does nothing for a US sender emailing someone in Toronto.

You cannot cold email to ask for consent

Asking permission by email is itself a commercial message. Section 1(3) of the Act states: "An electronic message that contains a request for consent to send a message described in subsection (2) is also considered to be a commercial electronic message."

The CRTC's guidance on implied consent spells out the consequence:

"Remember that an electronic message that contains a request for express consent is also considered to be a CEM under CASL and therefore is not a method through which express consent can be obtained... The only way to obtain express consent via e-mail is if you have implied consent to send the message."

So the "permission-based cold email" tactic, "Mind if I send you a two-minute overview?", needs the same lawful basis as the pitch itself.

The routes to sending lawfully, in order of how often they fit cold email

Route	Source	Fits cold outreach?	What you must be able to show
Conspicuous publication	Act s.10(9)(b)	Often, for named business contacts	Where and when the address was published, no "no CEMs" statement, relevance to their role
Address disclosed to you	Act s.10(9)(c)	Business cards, event conversations	The disclosure, no objection, relevance to their role
Referral	SOR/2013-221 s.4(1)	First message only	The referrer's full name, stated in the message, and their relationships with both sides
Inquiry within six months	Act s.10(10)(e)	Inbound leads that went cold	The inquiry and its date
Business-to-business exemption	SOR/2013-221 s.3(a)(ii)	Rarely for true cold email	An existing relationship between the organisations
Purchase or contract within two years	Act s.10(10)(a), (d)	Past customers, not cold prospects	The transaction and its date

Conspicuous publication

This is the clause most cold email to Canada relies on. Section 10(9)(b) implies consent where the person "has conspicuously published, or has caused to be conspicuously published, the electronic address", the publication "is not accompanied by a statement that the person does not wish to receive unsolicited commercial electronic messages", and "the message is relevant to the person's business, role, functions or duties in a business or official capacity."

The CRTC's own worked example is worth quoting because the test is relevance to the individual, not to the company. A company publishes the addresses of its chief operating officer and marketing officer with no objection statement:

"Example 1: A training company sends a CEM to the COO. This CEM promotes a course on how to be an administrative assistant. This CEM is not relevant to the recipient's business, role, functions or duties... Example 2: A training company sends a CEM to the marketing officer. This CEM promotes a course on how to develop social media platforms for e-marketing. In this case, the CEM is relevant..."

Three practical points follow from the text:

1. "Published" means published by them or for them. An address on the company's team page or in the person's own professional profile fits the wording. An address your email finder guessed from a naming pattern was never published. Pattern-guessed addresses, including ones produced by our own email finder, do not create implied consent under this clause however well they verify.
2. Check the page for a refusal statement. A "no unsolicited commercial email" line next to the address removes this route.
3. Relevance is per person. Sending the same pitch to every contact at a company fails for the people whose role does not match.

The business-to-business exemption is narrower than its name

SOR/2013-221 section 3(a)(ii) exempts messages sent by an employee of one organisation "to an employee, representative, consultant or franchisee of another organization if the organizations have a relationship and the message concerns the activities of the organization to which the message is sent."

The CRTC FAQ stresses that the focus "is on relationships between organizations. The mere fact that an employee of an organization has a relationship with an employee of another organization does not necessarily result in a relationship between the organizations." A company you have never dealt with has no relationship with yours. For a genuinely cold prospect, this exemption usually does not apply.

Referrals: one message only

The referral exemption in SOR/2013-221 section 4(1) covers "the first commercial electronic message" sent after a referral by someone who has a relationship with both you and the recipient, and requires that the message "discloses the full name of the individual or individuals who made the referral and states that the message is sent as a result of the referral." Follow-ups need another basis, such as a reply that leads to express consent.

Implied consent expires

Implied consent based on an existing business relationship is time-limited by section 10(10). Purchases, accepted opportunities and contracts run on a "two-year period immediately before the day on which the message was sent". An inquiry or application runs on a "six-month period".

For cold email this matters most with inbound leads. Someone who downloaded a guide or asked for pricing 8 months ago and never bought falls outside the six-month inquiry window. Unless another basis applies, they are a cold contact again.

Conspicuous publication has no fixed expiry in the text, but it depends on facts that change. If the address comes off the website or the person changes role, your evidence of relevance goes stale. The CRTC says that "if you continue to send CEMs over time, based on implied consent, there is an ongoing need to maintain accurate records."

The burden of proof is on you

Section 13 of the Act is one sentence: "A person who alleges that they have consent to do an act that would otherwise be prohibited under any of sections 6 to 8 has the onus of proving it."

The CRTC guidance says what a record of conspicuous publication can look like:

"to prove there were no statements against receiving CEMs a company could record screenshots or have a contemporaneous record of the publication where the address was listed, including information such as the date, email address and URL."

It also addresses bought or third-party lists directly: "Even though the company did not create the list, as the sender of the CEMs, it must still be able to prove that consent was implied". The company "should therefore take all reasonable steps to assure itself that the list it is relying on meets the requirements set under CASL."

A workable per-contact record for a Canadian cold list has six fields:

Field	Example
Email address	the contact's address
Consent basis	conspicuous publication, s.10(9)(b)
Source URL	the page where it appeared
Date captured	2026-10-01
Screenshot or archived copy	file reference
Relevance note	why the offer fits their stated role

Most lead databases do not export a source URL per address. If yours does not, you cannot build this record from it.

What every message must contain

Consent is half of section 6. The other half is form. Section 6(2) requires every CEM to identify the sender and anyone they are sending for, to give contact information, and to include an unsubscribe mechanism. The CRTC's regulations (SOR/2012-36, section 2) set out the details:

• the name the sender carries on business under, and the name of anyone the message is sent for
• "the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an email address or a web address"

Section 3 of those regulations requires this information and the unsubscribe mechanism to be "set out clearly and prominently". It says the unsubscribe "must be able to be readily performed."

The time limits are stricter than in the US:

	CASL	CAN-SPAM
Consent before first message	Required (express or implied) unless exempt	Not required
Unsubscribe mechanism must stay valid	60 days (s.11(2))	30 days
Contact information must stay valid	60 days (s.6(3))	Not specified
Unsubscribe must take effect	"without delay, and in any event no later than 10 business days" (s.11(3))	Within 10 business days
Maximum penalty	$1,000,000 individual / $10,000,000 other person, per violation (s.20(4))	Up to $53,088 per email (FTC guide)

The 60-day rule matters if you rotate cold email domains. An inbox used for a Canadian send needs to keep receiving unsubscribe replies, and its contact details must stay valid, for two months after its last message. The CAN-SPAM breakdown covers the US side in detail.

A bounced message still counts as sent

One line of section 6 is easy to miss, and it matters to anyone who thinks list cleaning reduces legal exposure. Section 6(4) says that for the consent prohibition, a message "is considered to have been sent once its transmission has been initiated", and "it is immaterial whether the electronic address to which an electronic message is sent exists or whether an electronic message reaches its intended destination."

Sending without consent to an address that turns out not to exist is still a send. Verification protects your bounce rate and sender reputation. It does not create consent and does not shrink the number of messages you sent without a basis. Use it to clean a list you are already allowed to mail, not to decide who you may mail.

Penalties

Section 20(4): "The maximum penalty for a violation is $1,000,000 in the case of an individual, and $10,000,000 in the case of any other person." Section 20(2) states that the purpose of a penalty "is to promote compliance with this Act and not to punish". Section 20(3) lists the factors considered, including "the nature and scope of the violation", the person's history and "the person's ability to pay the penalty".

A decision sequence for a Canadian cold campaign

1. Split Canadian recipients out. Use the domain (.ca), the company's location and the contact's location. Handle them under CASL, not your default process.
2. For each contact, name the consent basis from the table above. If none fits, do not send.
3. For conspicuous publication, capture the evidence at collection time: URL, date, screenshot, and a check for a refusal statement.
4. Write a relevance note per contact, not per company.
5. Drop pattern-guessed addresses that were never published, unless another basis applies.
6. Put identification, a mailing address, a second contact method and an unsubscribe in every message of the sequence.
7. Keep sending inboxes and contact details valid for 60 days after the last send.
8. Process unsubscribes immediately across every domain and tool.
9. Re-check time-limited consent (six-month inquiries, two-year purchases) before each new campaign.

If the EU or UK is also on your list, the framework there is different again. See GDPR and B2B cold email and the overview of collecting business emails legally.

The CASL question to ask about each contact is "what is my basis for this person, and could I show it?", not "is this address valid?". Only once you have a yes to that should you check the list for bounces.