A US guide to cross-border email journeys under CASL and PIPEDA

What to take away

CASL consent rules for US senders reaching Canadian subscribers

Canada's Anti-Spam Legislation applies to commercial electronic messages sent from the United States to recipients in Canada. Your location does not exempt you. If a subscriber reads email in Ontario, Quebec or British Columbia, the message is in scope even when your servers sit in Ohio.

CASL is a consent-first regime. You need express or implied consent before the first message, and you must be able to prove it. A current business relationship or a publicly listed business address can create implied consent, though it does not last forever. Express consent has no expiry until withdrawn.

The message itself has to identify the sender by name, include a mailing address and provide a working unsubscribe mechanism. That mechanism must be functional for at least 60 days after sending. Requests to unsubscribe must be honored within 10 business days, without a fee and without requiring a login or extra steps.

Penalties are not theoretical. The CRTC can pursue administrative monetary penalties against senders outside Canada, and private rights of action have been part of the statute's design. US senders rarely plan for that exposure when they add a Canadian segment to an existing list.

Enforcement does not stop at the border. Agreements between the United States and Canada allow the FTC and the CRTC to share information about deceptive marketing practices, so a Canadian complaint can reach a US sender.

One practical trap: purchased, rented or scraped lists. Those addresses almost never carry the consent trail CASL requires, and the burden of proof sits with the sender. A US list append that adds Canadian contacts can turn a compliant program into an unprovable one.

For a deeper walkthrough of consent categories and how they change journey logic, see our guide to casl email subscriber journey rules.

What counts as express consent

Express consent requires a positive action by the recipient, plus clear disclosure of the purpose. Pre-checked boxes, bundled terms of service and silence do not qualify. A checkbox that names your organization and states that you will send commercial email is the standard pattern.

Keep the wording that was displayed at the moment of consent. If you change the disclosure later, the old consent still rests on the old wording, and you need the old wording to prove it.

Implied consent and its clock

Implied consent from an existing business relationship generally runs for 24 months from the last transaction and 6 months from an inquiry. Conspicuous publication consent is narrower and time limited. Both require you to track the underlying event, not just the address.

PIPEDA obligations when subscriber data crosses the border

PIPEDA governs how private-sector organizations handle personal information in the course of commercial activity in Canada. An email address, name, province and engagement history are all personal information. So are IP addresses and device identifiers tied to an identifiable subscriber.

The flow runs both ways. Subscriber data collected in Canada is routinely processed on servers in the United States; Canada's PIPEDA follows that data across the border. US marketing teams hold records that describe Canadian residents, and the transfer attaches duties.

PIPEDA rests on ten fair information principles. They set rules for how you collect personal information, why you collect it, how you protect it and how people get access to it. For a US sender, accountability and safeguards do the heavy lifting.

Accountability means someone in your organization is responsible for the Canadian data you hold, even when a vendor processes it. You remain accountable when information is transferred to a third party, including a US-based email service provider, and you need contractual protections that give a comparable level of protection.

Cross-border transfer is permitted. PIPEDA does not ban sending subscriber data from Canada to the United States. It requires that you tell individuals their information may be processed in another country and that they can ask about it, and that you protect it once it moves.

Safeguards should match sensitivity. Access controls, encryption in transit and at rest, logging, vendor review and retention limits are baseline expectations. The FTC's guidance on data security is written for US businesses but maps cleanly onto the safeguard expectations PIPEDA places on the same data sets.

Breach notification matters too. PIPEDA requires reporting to the Office of the Privacy Commissioner of Canada when there is a real risk of significant harm. Affected individuals must also be notified, along with any organization that can reduce the risk. Your US incident response plan needs a Canadian branch.

Access requests are the other common failure. A Canadian subscriber can ask what you hold and how it has been used and disclosed, including disclosure to US processors. If your data is split across a marketing platform, a CRM and a warehouse, you need a way to assemble one answer.

Consent logic rarely travels cleanly between platforms. Our practical guide to email campaign planning covers the gaps that surface when Canadian records land in a stack built for US consent.

How US and Canadian consent models differ in practice

US federal law takes an opt-out approach for commercial email. CAN-SPAM requires accurate headers, a non-deceptive subject line, a physical postal address, a clear opt-out and prompt honoring of opt-out requests. The FTC's CAN-SPAM compliance guide lays out those core duties, and they shape how most US subscriber journeys are built.

CASL inverts the default. Consent comes first, and the sender carries the burden of proving it. The gap between the two regimes is structural, not cosmetic. It changes list building, form design, re-permission campaigns and the way you treat older addresses.

State privacy law adds a third layer. The California Consumer Privacy Act gives consumers rights to know, delete, correct and opt out of sale or sharing. The California Attorney General's CCPA overview describes those obligations and the enforcement posture behind them. Similar statutes in Colorado, Virginia, Connecticut and Texas create overlapping duties for subscriber data.

The practical result: a journey that is fully compliant in Texas or Florida can fail the moment a Canadian address enters it. Most US programs discover this during a deliverability review, not before launch.

Designing cross-border journeys that satisfy both regimes

Build the journey around residence, not around language. A French-language preference does not tell you the subscriber is in Quebec, and an English-language subscriber in Manitoba is still covered by CASL. Map the subscriber journey stages before you split the flow.

Then split it. Canadian contacts enter a consent-first track. US contacts enter your existing opt-out track. Shared content can stay shared, but the consent capture, footer, preference center and suppression logic must differ.

Re-permission campaigns are the cleanest fix for a list of uncertain origin. Ask Canadian contacts to confirm they want to hear from you, explain what they will receive, and treat non-response as a stop. That is a hard message to send, and it protects the rest of the program.

Suppression deserves its own rule. An unsubscribe in Canada should suppress across every brand and business unit that shares the list, since CASL consent is given to an organization, not to a single newsletter.

The same logic applies to your re-engagement email journey: a Canadian contact who has gone quiet may have expired implied consent, so a win-back send can be unlawful even though it would be routine in the United States.

Journey design also affects deliverability. Canadian mailbox providers and filtering vendors watch complaint rates and authentication closely. Publish a DMARC policy, monitor Google Postmaster Tools and Microsoft SNDS, and keep complaint rates low on both sides of the border. A consent-first flow usually improves those numbers because it removes the addresses most likely to report you.

Where to place the disclosure

Put the cross-border disclosure where the subscriber actually sees it: on the signup form, in the welcome message and in the privacy policy linked from every send. A clause buried in a vendor contract does not satisfy the openness principle.

Handling preference centers

A preference center that offers topic choices must also offer a full unsubscribe that works in one step. Granularity is fine, but it cannot become a maze that delays the opt-out beyond the legal window. A first welcome email sequence should carry the same one-step option in its footer, not just in the preference center.

Documentation and record-keeping across two jurisdictions

Cross-border consent documentation is the part US teams underbuild. CASL puts the burden of proof on the sender, and PIPEDA expects you to demonstrate accountability. Both point to the same artifact: a record that ties a subscriber to the consent event that justifies the send.

Cross-border consent documentation also has to survive a move. A subscriber record can sit in the United States while the legal basis behind it comes from Canada. Most US teams store that record in the United States; Canada expects it to be produced on request.

At minimum, store the email address, the consent type, the exact wording shown and the timestamp in a fixed time zone. Add the source URL, the IP address, and the country and province captured at signup. For implied consent, store the qualifying event and its date so you can calculate expiry.

Retention is where documentation and PIPEDA meet. Keeping personal information longer than necessary is itself a compliance problem. Set a retention period, apply it to Canadian records, and make sure backups follow the same schedule rather than becoming an accidental archive.

Access and deletion requests need a runbook. When a Canadian subscriber asks what you hold, you have a defined response window and an obligation to explain disclosures to US processors. When a California consumer asks for deletion, the same systems are involved. One runbook, two legal bases, is cheaper than two teams improvising.

Vendor contracts carry much of the load. Push for data processing terms that cover Canadian personal information, restrict the vendor from using subscriber data for its own purposes, require breach notification within a short window, and name the countries where processing occurs. Review the list annually and after any platform migration.

Audit your own trail before a regulator or a plaintiff does. Pick twenty Canadian records at random and try to reconstruct why each person receives email. If you cannot answer for all twenty, the gap is in your records, not in your memory.

Our guide to email deliverability covers the technical checks that audits tend to miss, including the field-level gaps that break consent reconstruction.

Working example: United States; Canada, one subscriber

A subscriber signs up on a US form with a pre-checked box, then later moves to Alberta and updates her address. Under CAN-SPAM, the original signup was acceptable. Under CASL, the pre-checked box never produced valid consent, and the move does not create it.

The correct action is to suppress her from commercial sends and send a single re-permission request that explains the purpose and asks for a positive confirmation. If she confirms, store the new wording, timestamp and source. If she does not, the record stays suppressed.

Common questions