Rule 30 of 33

CASL (Canada’s Anti-Spam Legislation)

What are the rules for sending marketing emails in Canada?

CASL requires express or clearly implied consent before you send commercial email, identification of the sender in every message, and a working unsubscribe honoured within ten business days. There is no business-to-business exemption, penalties reach ten million dollars, and directors can be named personally.

What the rule requires

Opt-in consent before any commercial email or text. Up to $10M per violation.

Who it catches

Anyone sending commercial email, SMS or social messages to Canadians - there is no B2B exemption and no general org exemption. The CRTC can fine a business up to $10M per violation and name directors personally.

What this looks like in practice. You email a purchased list with no proof anyone opted in, and the unsubscribe link is broken. There's no B2B exemption - Compu-Finder was fined $1.1M, and Hudson's Bay paid $120,000.

How to check whether you comply

The checkFor every list: can you prove opt-in (or a valid implied-consent basis with its expiry clock)? Does each message carry your identification and a working unsubscribe honoured within 10 days? Keep the consent records.

Read it yourself

We would rather you checked us than took our word for it. This links to the law as published, not to our summary of it.

Primary source CRTC ↗ Real case CRTC: Hudson's Bay $120,000; up to $10M per violation ↗

We have a longer piece on this: compliance watch.

Questions people ask

What are the rules for sending marketing emails in Canada?

CASL requires express or clearly implied consent before you send commercial email, identification of the sender in every message, and a working unsubscribe honoured within ten business days. There is no business-to-business exemption, penalties reach ten million dollars, and directors can be named personally.

Who does CASL (Canada’s Anti-Spam Legislation) apply to?

Anyone sending commercial email, SMS or social messages to Canadians - there is no B2B exemption and no general org exemption. The CRTC can fine a business up to $10M per violation and name directors personally.

How do I check whether we comply with CASL (Canada’s Anti-Spam Legislation)?

For every list: can you prove opt-in (or a valid implied-consent basis with its expiry clock)? Does each message carry your identification and a working unsubscribe honoured within 10 days? Keep the consent records. You can also run our free website check, which tests 25 technical items in about twenty seconds, or book a review if this rule needs a documented answer.

Other rules that catch the same businesses

Rule 31PCI DSS v4.0.1 (card-data security) Rule 32Subscription auto-renewal laws (ROSCA + state ARLs) Rule 33Colorado AI Act (SB 24-205, as amended) Rule 2ADA Title III (US web accessibility) All of themThe full 33-rule table, searchable

Find out which of the 33 apply to you

The fine risk check asks a few questions about your business and tells you which rules catch you, with the deadlines. Nothing you tick leaves your browser.

Check my fine risk

This page summarises a legal obligation in plain language so you can work out whether it applies to you. It is not legal advice, and the primary source linked above governs. Last reviewed 2026-10-03.