Cold email in Canada: what CASL requires of agencies

You spot a local business with no booking page or an outdated website. You find its email address and write. In Canada, that first email falls under Canada’s anti-spam legislation, known as CASL.

What counts as a commercial electronic message

CASL regulates commercial electronic messages, or CEMs. A CEM is an electronic message, such as an email or a text, that would reasonably be seen, from its content, its links or its contact details, as having the purpose, or one of the purposes, of encouraging participation in a commercial activity.

The Act names offers to sell a service, ads for one, and messages that promote someone as a provider. An email offering a café a new website, a booking page or a website audit is a CEM. A friendly introduction that links to your services can be one too, since links count.

Two details are easy to miss. An email asking for consent is itself a CEM (s. 1(3)), so it needs consent of its own. And the sending rules apply whenever a computer system in Canada is used to send or access the message (s. 12(1)), wherever the sender is based.

Express and implied consent

Section 6 bans sending a CEM unless the person has consented, expressly or impliedly, and the message carries the required identification and unsubscribe mechanism.

Express consent

Express consent is a clear yes, given orally or in writing. The request must say why you’re asking, who is asking and how to reach you, and that consent can be withdrawn. It lasts until the person withdraws it.

Implied consent

The Act lists the only situations where consent is implied (s. 10(9)). Three matter most to agencies:

• An existing business relationship: the business bought from you in the last two years, or sent you an inquiry in the last six months
• An address given to you, such as on a business card, with no request to avoid unsolicited messages, when your message relates to the person’s business or role
• A conspicuously published address, covered in the next section

The regulations add a referral exemption: a first message after a referral needs no consent when the person who referred you has a business, non-business, family or personal relationship with both of you, and your message gives their full name and says it follows their referral.

Identification and unsubscribe rules still apply to that message. The business-to-business exemption needs the two organizations to already have a relationship, so it doesn’t cover a cold first email.

Conspicuously published addresses

Without a relationship, a business card or a referral, a cold email rests on section 10(9)(b). It implies consent only when all three conditions hold:

1. 1

   The address is conspicuously published

   The person published it, or had it published, in plain view: a contact page or a site footer. A directory that copied it on its own doesn’t fit that wording, so go to the business’s own site.

2. 2

   Nothing refuses unsolicited messages

   The publication can’t come with a statement that the person doesn’t want unsolicited commercial messages at that address. Check the page and the site’s legal notices for “no solicitation” wording.

3. 3

   Your message is relevant

   It must relate to the person’s business, role, functions or duties in a business or official capacity. A website offer sent to a clinic’s reception address fits. A personal offer to whoever reads that inbox doesn’t.

Being visible online isn’t enough on its own. CRTC enforcement staff issued an advisory after seeing businesses email lists of addresses gathered from public websites. The Privacy Commissioner’s guidance adds that people post addresses for many purposes, so you can’t assume they want offers.

What every message must include

Consent isn’t the whole job. Every CEM must also identify the sender, give a way to reach them and include an unsubscribe mechanism (s. 6(2), s. 11 and the CRTC’s regulations).

Keep records of consent

Whoever claims consent has to prove it (s. 13). CRTC staff have seen senders unable to do so, and suggest keeping, among other records:

• Evidence of express and implied consent
• The methods you used to collect consent, documented
• Your policies and procedures for complying with CASL
• Every unsubscribe request, and what you did about it

For a published address, the evidence is the page: its web address, the date you saw it and what it said. The Privacy Commissioner also suggests revisiting records and their sources at intervals, to confirm that implied consent still holds.

The CRTC adds that good records can help establish a due diligence defence: a person isn’t liable for a violation if they show they exercised due diligence to prevent it (s. 33(1)).

CASL penalties

The CRTC can impose administrative monetary penalties for violations of sections 6 to 9. The maximum is $1 million per violation for an individual and $10 million for any other person, such as a company (s. 20(4)).

The Act says penalties exist to promote compliance, not to punish. The amount depends on factors such as the nature and scope of the violation, past violations, any financial benefit and the ability to pay.

Liability spreads, too. Aiding or causing a violation is itself prohibited (s. 9), officers and directors who direct or authorize one can be liable (s. 31), and employers answer for employees acting within their employment (s. 32).

Harvested and guessed addresses

CASL also amended PIPEDA, the federal private-sector privacy law. Its section 7.1 targets an individual’s address collected with a computer program designed or marketed primarily to generate or search for, and collect, electronic addresses.

For such an address, the exceptions that allow collection or use without consent don’t apply, the “publicly available” one included. The Privacy Commissioner’s guidance says that, with very limited exceptions, PIPEDA prohibits address harvesting, whether a tool scrapes websites or generates addresses from common names and email domains.

A bought list doesn’t get around it: the same guidance makes it your responsibility to check how a vendor collected its addresses. Québec, Alberta and British Columbia have their own private-sector privacy laws, which generally apply instead within those provinces, while PIPEDA covers information that crosses provincial or national borders.

Guessing fails under CASL as well. An address you built yourself, such as firstname.lastname@ plus the business’s domain, was never published by anyone, so the conspicuous-publication rule can’t cover it.

A checklist before you write to a local business

1. 1

   Find the address at the source

   Use the business’s own website: its contact page, footer or about page. Prefer a role address such as info@ or reception@ to a named person’s address.

2. 2

   Look for a refusal

   A statement that the business doesn’t want unsolicited messages rules that address out.

3. 3

   Make it relevant

   Pitch what relates to the business: its website, booking, listing or email setup.

4. 4

   Record where it came from

   Note the page’s web address, the date and the address exactly as published. Keep a copy of the page if you can.

5. 5

   Identify yourself

   Your business name, your mailing address, and a phone number, email address or website that will work for at least 60 days.

6. 6

   Offer an easy way out

   An unsubscribe that costs nothing and takes one step. Honour it right away: 10 business days is the legal maximum, not a target.

7. 7

   Keep one opt-out list

   Check it before every send, from every tool you send with.

8. 8

   Don’t guess, harvest or buy addresses

   A guessed address has no implied consent, harvesting software runs into PIPEDA, and a bought list still leaves you answerable for how it was collected.

9. 9

   Recheck before the next campaign

   Pages change. Revisit the source before you write again, and stop if the address is gone or a refusal has appeared.

Doing it with RadiusPilot

RadiusPilot builds the mechanical parts of this checklist into its outreach. The judgment calls stay yours: whether an address qualifies, and whether your message is relevant.

• Every email gets a footer with your business name and postal address, then a line asking people to reply “unsubscribe” if they don’t want more. It can’t be switched off, and the Windows app refuses to send an email without it
• Outreach from your mailbox waits until you add your postal address in Settings › Email. Outreach that goes out right away also carries a List-Unsubscribe header
• The opt-out list blocks every address on it, even when you copy an email to send from another app. When a reply says “unsubscribe” or “remove me”, Mail suggests Add to opt-out list. Deleting a workspace or your account leaves the list in place
• A daily send limit counted in people, not emails: 50 to start, adjustable from 10 to 200, and never more than 200 a day in the Windows app
• Published contacts reads one business’s own site at a time, when you ask: its homepage and up to five of its contact, team, about or legal pages. Each address comes with its page, nothing is guessed or decoded, and a page that refuses unsolicited messages blocks saving
• Use as business email saves one role address on the business’s own domain, with the page it came from and the date. That’s your record
• Sequence steps wait for you in Today, so nothing in a sequence goes out on its own, and by default a reply ends the sequence for that lead

Sending from your mailbox and Published contacts need the Windows app, a test version that hasn’t run on a real Windows computer yet. Read the email rules guide for what stays your job, or try the live demo: every business in it is invented, and sends are simulated.

Sources

• Canada’s Anti-Spam Legislation (CASL), full text, Justice Laws Website
• Electronic Commerce Protection Regulations (CRTC), SOR/2012-36
• Electronic Commerce Protection Regulations, SOR/2013-221 (referral and business-to-business exemptions)
• Personal Information Protection and Electronic Documents Act (PIPEDA), full text, section 7.1
• CRTC: Enforcement Advisory, how to keep records of consent
• CRTC: Enforcement Advisory, Notice for Professional Training Service Industry (implied consent and conspicuous publication)
• Government of Canada (fightspam): Getting consent to send email
• Government of Canada (fightspam): Understanding Canada’s anti-spam legislation
• Office of the Privacy Commissioner: Guidance for businesses doing e-marketing
• Office of the Privacy Commissioner: Required reading for email marketers (blog, May 2016)
• Office of the Privacy Commissioner: PIPEDA requirements in brief

Checked against these pages on November 1, 2026. General information, not legal advice.