The new Canadian Anti-Spam Law (CASL) has been in effect for over a month and we’ve had marketers asking us about the law every day. To provide some clarity and guidance, we’ve posted answers to some of the most common questions we’ve fielded.


NOTE: We can offer opinions and recommendations on how to be CASL compliant, but this does not serve as legal advice. Marketers should seek their own legal counsel for their interpretations of CASL.


Implied consent: Having some form of a business relationship. i.e. - completed a purchase, entered into a contract, membership, or asked for more information, etc.

Explicit consent: Someone explicitly and knowingly requested emails. i.e. - checked a box that says “subscribe to email newsletters” and entered their email into a pop-up or a web page box that is clearly marked. Express consent cannot be obtained through opt-out methods such as checking a box that says “check here if you don’t want emails from us.”

1. Whom does CASL affect?

OPINION: CASL affects any business, organization or individual that sends electronic messages to or from a Canadian computer or device.

2. How do I determine which email addresses are Canadian?

OPINION: If you’re not collecting demographic data, this could pose a challenge. A few data points to help: geoIP tracking, shipping data, physical address, domains ending in .ca, or collection locations such as a conference in Montreal. CASL provides some leniency on this, but moving forward it will be a good idea to start tracking this data more closely. If there isn't obvious data to show an address is located in Canada, you may be forgiven based on lack of information.

3. Will transactional emails need an unsubscribe link?

CASL requires an unsubscribe link in all transactional emails that allows the subscriber to opt out of future marketing email messages. OPINION: We strongly recommend that you avoid including marketing language in transactional emails.

NOTE: If there is any marketing language in a transactional email, then that transactional email becomes a marketing message. This becomes an issue if a subscriber has opted out of marketing messages.

4. Can I send abandoned cart emails to people who are not subscribed to marketing emails?

OPINION: Abandoned cart messages should have either implied or explicit consent PRIOR to sending. It is Bronto’s opinion that a person shopping on a site and providing email address/mailing information is enough to be considered a business relationship at that point and that a one-time abandoned cart email would be acceptable. We also recommend adding language to the privacy policy to state that people can be contacted should they leave something in the cart.

5. Is a double opt-in required or is single opt-in OK?

OPINION: Double opt-in is not required but it does satisfy the explicit consent rule should you follow this practice. For example, if you pre-check a box or auto add someone to your list because they bought a book from you (both implied consent actions), you would still need to send an email to confirm their desire to sign up. Once they click on the link in that email to confirm, the explicit consent standard has been met.

6. Do pop-up sign-ups comply with CASL’s ‘explicit’ consent policy?

OPINION: Yes, CASL accepts a box in which someone enters an email address as explicit consent as long as it is clearly labeled that by entering their email address they will be added to marketing email newsletters.


  • Acceptable: “Enter your email address to sign up for our email newsletters”
  • Unacceptable: “Enter your email to register”
  • Unacceptable: “Enter your email address and agree to terms and conditions/privacy policy”

7. Switching my checkout sign-up to an unchecked box will reduce the number of sign-ups we are adding. Must I uncheck my permission boxes, or will I just need to know that I have two years to capture “explicit” consent from Canadian buyers?

OPINION: You can leave your check boxes checked, but that will only be implied consent and you will still need to collect explicit consent in the next two years. While unchecking the box will reduce the number of sign-ups, it will bring two huge benefits. First, it will satisfy the explicit consent rule and you will not have to track people to figure out when their two years of implied consent time is up. Second, it will strengthen your list with solid permissions and highly-engaged subscribers.

8. What is the best way to capture explicit consent from current contacts who previously have only given implied consent?

OPINION: Once you have identified Canadian addresses in which you only have implied consent, you have two options:

1. Create an email message asking the subscriber to confirm their permissions by clicking a link that takes the subscriber back to an email preference form. There the subscriber will have to check a box confirming they want to receive marketing emails. Also, you can set up reminders if the subscriber hasn’t confirmed their permission. If the subscriber never does confirm, the rule would automatically unsubscribe them after 24 months. This would allow you to track who provided express consent and who only has implied consent.

2. Create a message that simply says “click here to confirm your permissions per CASL.” That link would go to a web page on your site that thanks them, giving you a record of the subscriber granting you permission.

9. If I get explicit permission and the subscriber stops opening/clicking my emails (stops engaging), do I have to remove them or re-opt them in after a certain time?

OPINION: No, explicit consent does not have a time expiration on it.

10. If I get implied consent and the subscriber is opening and clicking (engaging) within the emails we are sending them, is this behavior considered acceptable permission?

OPINION: Someone opening or clicking on your emails does not confirm permission. Unless a qualified transaction, such as a purchase, the two-year implied consent clock would continue to count down.

11. What if a third party sends my fulfillment emails for us?

OPINION: It is absolutely imperative your partners are aware of and abide by the new CASL requirements. They are sending email on your behalf, so the email police will follow the trail back to you and hold you accountable. Keep track of the behavior of your email partners and make sure they are compliant!

12. Does CASL require contact information in the email?

OPINION: Yes, clear and updated contact information (postal address, phone, email address) in the email is a CASL requirement.

13. I am collecting email addresses via phone conversations. How do I record consent?

OPINION: Make sure your phone scripts show that you are collecting clear consent from the caller by specifically asking if they would like to receive marketing emails from you. It’s a good idea to follow up with a confirmed opt-in email in which the caller would click on a link to confirm their permission to be added to your marketing emails. Also, simply asking the caller if they want an e-receipt does not satisfy explicit permissions for marketing emails.

14. Am I at risk by promoting Refer-a-Friend type emails?

OPINION: (This one really should be answered by your legal team)

Yes, but you can reduce this risk by having the initiator read and agree to terms that state the initiator can, if required, confirm the receiving “friend” is either an existing business relationship or a personal or family relation. The email should include clear identification of both the initiator (first and last name), the company information, the purpose of the message that it is being sent on behalf of the commercial entity and an unsubscribe link. Refer-a-friend emails should only be sent to people who have an existing relationship with the initiator.

The email can come from the friend or the company. I would also state that offering an incentive for the refer-a-friend program will increase risks of responsibility for the company, since it makes it a heavier commercial message.

15. If someone ‘likes’ us on Facebook or ‘follows’ us on Twitter, is that acceptable consent to send them marketing emails?

OPINION: No. CASL requires an explanation for the purpose of requesting consent. Since ‘liking’ or ‘following’ doesn’t clearly request an email relationship, it would not confirm implied or explicit consent.

16. Is collecting business cards at a trade show acceptable consent?

OPINION: If information is collected via a fishbowl or blank sheet of paper, then permissions would be allowed under ‘implied consent’ and express consent would need to be collected in the following 24 months. However, if at the point of collecting a business card or a written email address it is clearly stated that the contributor will be added to marketing messages and can unsubscribe at any time, then this is express consent. Always record where and when you collect business cards, etc.

17. We are an association that sends periodic emails to our members. Do we need express consent to continue to mail to our members?

OPINION: No, as long as they are a member you have implied consent and can continue to send to them. Should that member leave, you will have two years to collect express consent from them to keep sending them emails.

18. Can I offer an incentive in the CASL opt-in campaign I send to my subscribers?

OPINION: There is no language in CASL preventing anyone from offering an incentive.

For some great tips on how to engage your Canadian subscribers and gain their permission, read Bronto Senior Professional Services Consultant Emily Keye’s recent blog post Best Practices for CASL Compliance.