CASL email subscriber journey rules: consent, disclosure and records

A Canadian email journey can look orderly on a calendar and still fail at the level of an individual send. CASL treats each message as a separate commercial electronic message, so permission, disclosure and opt-out arrangements need to hold for every send. Use the comparisons below to test collection, delivery and record keeping.

Permission must travel with every send

Weak version: Treat the whole journey as covered because a subscriber signed up once. That skips the question of whether each commercial message has a valid basis for sending, and it blurs the distinction between consent and other journey decisions.

Better version: Assess each message separately. The CRTC enforces consent and unsubscribe provisions in Canada's Anti-Spam Legislation; the Competition Bureau addresses misleading claims, while the Office of the Privacy Commissioner handles address collection, including harvesting and dictionary attacks.

A welcome email, a later promotion and a follow-up are separate sends, each with its own consent basis and unsubscribe line. Map those decision points against subscriber journey stages, rather than assuming that approval of the first message settles the rest of the sequence.

Consent needs a useful expiry check

Weak version: Keep sending on the strength of an old purchase or inquiry without checking whether the permission window remains open. A list can look active in a platform even after the implied consent supporting its messages has expired.

Better version: Use express consent as the durable basis for a journey; the email list building best practices checklist covers how to collect it. Implied consent from an existing business relationship lasts two years after the last purchase, or six months after an inquiry. The transitional period for addresses collected before July 1, 2014 has ended.

Implied consent has other categories that a journey designer should know:

A retailer sending seasonal offers to one-time buyers should flag addresses near the two-year limit and request express consent before that window closes. A lapsed address cannot be made compliant by retaining a record that accurately shows its expiry; re-engagement examples show how a renewed request can be framed.

The message should identify itself and make leaving simple

Weak version: Hide sender details in an image, give no monitored mailing address, or make opting out depend on a login and a reason. A subscriber should not have to search for basic information or complete extra steps before an unsubscribe is honored.

Better version: Put the sender's name, the represented business's name when a third party sends for it, a physical mailing address and a working unsubscribe mechanism in each commercial message. A street address or a post office box counts as a mailing address. CASL also requires one more way to reach the sender: a telephone number with an agent or voice messaging, an email address, or a web address.

The unsubscribe mechanism must remain available for at least 60 days after sending, and the request must take effect without delay and no later than 10 business days. The 60 days are a statutory minimum. Plan the welcome email sequence with those disclosures in the message, not as optional follow-up tasks.

Consent records should recreate the signup

Weak version: Keep only an address or a platform status that says the subscriber is active. That does not establish who agreed, the timing or method, the source of the address, or the wording displayed when permission was requested.

Better version: Keep a record that can answer the CRTC's examination questions. The sender has the burden of proof, so capture the evidence where collection happens and preserve the exact wording the person saw.

Capture the source and consent wording at the point of collection because a sending platform does not hold them automatically. If either field is missing, the record cannot establish what the subscriber agreed to, even if the address remains in the mailing list.

Geographic checks belong beside consent checks

Weak version: Assume a journey that passes the federal email test also settles every privacy and transparency issue wherever the business operates. A valid send under one set of rules does not prove that the collection record meets every applicable expectation.

Better version: Account for provincial privacy rules alongside the federal regime. Alberta and British Columbia each have a Personal Information Protection Act for the private sector, and the federal regulator treats both as substantially similar to PIPEDA. Quebec's Law 25 adds consent and transparency expectations for businesses operating in Quebec.

The American opt-out model described in FTC guidance allows a message until the recipient opts out, unlike CASL's requirement for consent before the first message unless an implied-consent category applies. A US template therefore needs a Canadian review; compare it with this CAN-SPAM overview.

The penalty calculation changes the risk

Weak version: Treat a large, non-compliant send as one campaign-level problem. CASL penalties are calculated per violation, so a journey sent to many addresses can create a much larger exposure than a single-campaign estimate suggests.

Better version: Model each affected message and recipient in the risk review. A journey sent to ten thousand addresses without a valid consent basis can be ten thousand violations, not one. The Act caps a penalty at $10 million per violation for a business and $1 million for an individual, and the CRTC sets the actual amount case by case.

Directors and officers can be personally liable for acts committed by the corporation. The Commission may also require an organization to change its consent collection and report back, taking staff time beyond the penalty itself. Complaints can increase blocklisting risk, and email deliverability can be affected by complaint rates.

Borderline messages need a separate decision

Weak version: Assume every message connected to a purchase is permitted, or treat the consent-record limitation period as a retention instruction. Those shortcuts confuse the type of message with its legal basis and confuse enforcement timing with record keeping.

Better version: An abandoned cart with no completed purchase does not create an existing business relationship. Use express consent gathered at signup, or treat the message as having no consent basis. Purely transactional notices are exempt, but adding a promotional line makes a receipt a commercial electronic message subject to consent and unsubscribe rules.

The Commission can begin proceedings within three years of a violation, but that period is a statutory limitation for enforcement, not a rule requiring records to be kept for only three years. A longer retention period is safer, because the sender may need to explain the evidence supporting a past message.