CASL Compliance: What Calgary Businesses Must Know

Quick Answer: Canada's Anti-Spam Legislation requires three things for every commercial email: documented consent (express or implied), clear sender identification with mailing address, and a working unsubscribe process within 10 business days. Penalties reach $10 million per violation for businesses. Compliance is straightforward once the system is set up correctly.

Canada's Anti-Spam Legislation (CASL) governs every commercial electronic message sent to or from Canada and is significantly stricter than the US (CAN-SPAM) and most international regulations. For Calgary businesses, full compliance is non-negotiable: the law has been enforced with multi-million-dollar penalties since 2014, and private right of action provisions mean individuals can also pursue claims directly. The good news is that compliance is straightforward once the three core requirements (consent, identification, unsubscribe) are systematized.

What you should expect with proper CASL compliance is a documented consent record for every subscriber, every email containing required identification and an unsubscribe link, and a quarterly audit of your consent records to maintain integrity. You should not expect "everyone does email marketing, the enforcement is loose" to protect you, and you should not be relying on assumed consent without documentation.

This article covers the three core CASL requirements, the difference between express and implied consent, what counts as a commercial electronic message, the exemptions Calgary businesses can legitimately use, and the penalty framework. By the end, you'll know exactly what your email program needs to be defensible.

At a Glance

Quick Facts:

• Maximum penalty per violation: $10 million for businesses, $1 million for individuals

• Implied consent duration: 2 years after last purchase, 6 months after inquiry

• Unsubscribe processing requirement: within 10 business days

• Consent records retention: as long as you continue sending (no expiry)

• Required in every send: full business legal name, mailing address, contact mechanism, unsubscribe

• Effective date: July 1, 2014 (private right of action provisions in effect from 2017)

What Is a Commercial Electronic Message Under CASL

CASL applies to any commercial electronic message (CEM), which includes email, SMS, instant messages, and some social media direct messages, where the primary purpose is encouraging commercial activity. Promotional newsletters, sale announcements, abandoned cart reminders, and product launches all qualify.

What CASL does not apply to: transactional messages (order confirmations, password resets, shipping updates), purely informational non-commercial messages, and messages to recipients with whom you have a personal or family relationship.

The grey area is messages that mix transactional and commercial content. A shipping confirmation with a "buy this complementary product" pitch becomes a CEM in the commercial portion. The safer approach is to keep transactional messages purely transactional and put commercial content in separate marketing emails.

For Calgary B2B businesses, an important note: CASL covers business-to-business communication too. The "business email exception" is narrow and conditional, not a blanket allowance. The cleanest practice is to apply CASL standards to all marketing communication, regardless of recipient type.

What's the Difference Between Express and Implied Consent

This distinction is the single most important compliance concept in CASL.

Express consent is the gold standard: the recipient actively and deliberately agreed to receive your messages. This means they ticked an unchecked box, signed a form, or otherwise affirmatively opted in. Express consent has no expiry as long as the recipient hasn't unsubscribed.

Implied consent applies in limited circumstances and has expiry dates:

• Existing business relationship: purchase, contract, or written agreement within the last 2 years

• Existing non-business relationship: donation or volunteer work within 2 years

• Inquiry consent: the recipient asked about your business in the last 6 months

• Conspicuous publication: business email address publicly displayed without a "no marketing" notice, and the message relates to the recipient's role

• Disclosure consent: The recipient gave you their email in a business context without restrictions on use

Implied consent works in the short term but is operationally messier because you have to track expiry dates and convert subscribers to express consent before the implied period ends. The cleanest path is to obtain express consent whenever possible and treat implied consent as a transitional bridge.

What doesn't count as consent: pre-checked opt-in boxes, hidden terms-of-service consent language, consent obtained as a condition of purchase, and any consent where the request didn't clearly identify what the recipient was agreeing to.

What Must Every Email Include

Three elements appear in every CEM regardless of consent type:

• Sender identification: the full legal name of the business sending the message (and any business on whose behalf the message is sent)

• Contact information: a mailing address and either a phone number, email, or web address valid for at least 60 days after the message is sent

• Unsubscribe mechanism: a clear, no-cost way to opt out, processed within 10 business days

The mailing address requirement is real and often overlooked. A PO Box is acceptable. An email-only "contact us" link is not. For Calgary businesses, the registered office address or principal business address both qualify.

The unsubscribe mechanism must be functional and one-step, where possible. A link that opens a preference page where the subscriber has to find a specific opt-out is technically compliant, but tends to look bad-faith if a complaint is filed. The cleanest implementation: one-click unsubscribe link that immediately removes the subscriber from all commercial sends.

Most email platforms (Mailchimp, Klaviyo, ConvertKit, ActiveCampaign) handle these requirements automatically if you complete your business profile correctly. Verify the footer of your sent emails actually contains your business name, address, and unsubscribe link before launching any campaign.

What Are the Penalties and Who Enforces CASL

The Canadian Radio-television and Telecommunications Commission (CRTC) enforces CASL with significant authority. Penalties for non-compliance reach:

• $1 million per violation for individuals

• $10 million per violation for businesses

• Private right of action (in effect from 2017) allows individuals to pursue direct claims

The CRTC has issued multi-million-dollar penalties since CASL took effect, with several public cases involving Canadian companies fined $50,000 to $1.5 million for spam violations. Most enforcement actions focus on businesses sending high-volume unsolicited email, but smaller businesses have also been penalized for systematic non-compliance.

Each individual non-compliant message can theoretically count as a separate violation, which is how the dollar figures escalate quickly. A list of 5,000 subscribers contacted without proper consent could trigger penalties in the millions if pursued aggressively.

The practical risk for most Calgary small businesses isn't a CRTC investigation; it's reputation damage, deliverability collapse from spam complaints, and the rare but possible private claim from a frustrated recipient. All three are avoidable with proper compliance from day one.

What Are the Legitimate CASL Exemptions

A few exemptions exist that Calgary businesses can use:

• Family or personal relationship messages (genuine pre-existing relationships, not "we met at a networking event once")

• Transactional messages (order confirmations, password resets, shipping updates without significant promotional content)

• Messages requested by the recipient (one-time response to a direct ask)

• Messages to recipients outside Canada (CASL focuses on messages sent to or from Canada, with caveats)

• Quote or estimate responses (responding to a specific request)

• Warranty, recall, or safety notices (legally required communications)

Each exemption has nuances. The "messages to recipients outside Canada" exemption sounds broad, but in practice, most Calgary businesses send to Canadian recipients, making the exemption rarely useful. Transactional messages are the most commonly used exemption; the key is keeping them transactional in their primary purpose.

What's not exempt: cold outreach to business email addresses scraped from LinkedIn or websites, mass emails to attendees of an event you spoke at, or any "we found your email and thought you'd be interested" approach. These are CEMs and require consent or a clear exemption.

How Do You Build a Defensible Compliance Posture

CASL Compliance relies on consistent consent management, accurate records, and proper unsubscribe practices to reduce legal risk and keep email marketing compliant.

The seven practices that put a Calgary business in a clearly defensible position:

• Use express consent forms with unchecked opt-in boxes and clear language about what subscribers are agreeing to

• Document every consent with date, source URL, IP, and consent type captured automatically by your email platform

• Include full required identification (business legal name, mailing address, contact info, unsubscribe) in every send

• Process unsubscribes immediately, well within the 10-business-day requirement

• Audit consent records quarterly to verify integrity and flag any subscribers approaching implied consent expiry

• Avoid purchased or scraped lists entirely (the cost of a violation dwarfs any short-term list growth benefit)

• Train your team so new hires don't accidentally violate CASL through well-meaning outreach

Most email platforms handle the technical requirements automatically. The human-process requirements (training, audits, consent capture discipline) are where most violations originate. An hour of CASL training during onboarding and a quarterly consent audit catches most problems before they become legal exposure.

Frequently Asked Questions

Does CASL apply to my small Calgary business if I only have 200 subscribers?

Yes. CASL applies to every commercial electronic message sent to or from Canada, regardless of business size or list size. The penalties scale with violations, but the rules themselves are universal. Small businesses are not exempt.

Can I send to people who gave me their business card at a Stampede networking event?

Only if you obtained explicit consent at the event, ideally documented. A business card exchange alone doesn't constitute consent under CASL. The defensible practice: send a single personal follow-up email asking if they'd like to be added to your list, and only add them on an affirmative reply.

What if a subscriber gave me consent verbally during a sales call?

Verbal consent counts under CASL, but documentation is critical. Record the consent (with the recipient's awareness if you're recording the call), or send an immediate written follow-up confirming the consent and saving that record. Without documentation, verbal consent is hard to defend if challenged.

Does CASL apply to text messages and SMS marketing?

Yes. CASL covers all commercial electronic messages, including SMS. The same consent, identification, and unsubscribe rules apply. SMS adds the further complication that mobile carriers enforce their own anti-spam policies, often with faster consequences than CRTC enforcement.

Can I import an old customer list into a new email platform without re-confirming consent?

Only if you have documented consent records that you can transfer with the import. If consent was never properly documented, the cleaner path is a re-permission campaign asking former customers to opt back in. Sending without documented consent exposes the business, even if the customers would happily receive the emails.

About LTL Creative: LTL Creative is a Calgary digital marketing agency providing Calgary email marketing services for ambitious local businesses, specializing in CASL-compliant email program setup, consent system design, and ongoing campaign management, delivered through Email Marketing specialist certification for owners and marketing leaders requiring measurable, trusted results.

Ready to Drive Results Today with an email program that's both compliant and high-performing? LTL Creative helps Calgary businesses build CASL-compliant consent systems, document subscriber records, and run campaigns that earn results without legal risk, backed by Google Partner, Meta-certified, and CXL-trained specialists.

Connect with LTL Creative today to discuss your email compliance strategy.

Disclaimer: Results vary by business, industry, and market conditions. Statistics, platform data, and pricing referenced reflect current industry benchmarks and are subject to change. This article is general information only and does not constitute legal advice; consult a Canadian privacy and anti-spam lawyer for case-specific guidance.