What CASL Actually Requires Beyond a Basic Opt-In Checkbox
Most teams treat CASL as 'get an opt-in and you're covered.' It isn't. Here's what Canada's Anti-Spam Legislation actually requires operationally — documented consent, expiring implied consent, and identification rules most email programs miss.
By Robin Deane — Founder & Marketing Strategist, RD
CASL requires more than a checked opt-in box. Express consent has to be specifically documented — what the recipient agreed to, when, and how, not just a boolean flag in your CRM. Implied consent (from an existing business relationship or a direct inquiry) is real under CASL, but it expires: roughly two years from a customer's last transaction, and around six months from an inquiry, after which you need express consent to keep emailing. Every commercial message also needs clear sender identification — legal business name, a valid mailing address, and a working contact method — plus a functional unsubscribe mechanism that takes effect within 10 business days without requiring the recipient to do anything beyond a single click. Most Canadian email programs that assume "we have opt-in" are actually non-compliant on the documentation and expiry requirements, not the consent itself. General orientation, not legal advice — confirm specifics with local counsel.
"We have opt-in" is the most common answer marketing teams give when asked if their email program is CASL-compliant, and it's usually only half true. Canada's Anti-Spam Legislation does require consent, but the law's actual weight sits in three places most teams never configure: how that consent has to be documented, how long implied consent lasts before it expires, and what has to appear in every message regardless of consent type. A program can have genuine, real consent from every contact on the list and still be non-compliant because of how that consent is recorded or how old it's gotten.
What Does CASL Actually Require Beyond "Get Consent"?
Express consent under CASL means a recipient has taken a clear, specific action — checking an unticked box, replying to confirm, signing a form — that a reasonable person would understand as agreeing to receive commercial electronic messages from you specifically. Implied consent arises automatically from an existing business relationship or a recent inquiry, without the recipient taking a separate consent action, but it is time-limited and narrower in what it covers.
The distinction matters because most marketing automation platforms only track a single "subscribed" boolean, which captures neither which type of consent a contact has nor when it was obtained. CASL enforcement, in practice, turns on being able to produce a record of how consent was obtained for a specific contact — the platform-level checkbox isn't proof of anything if you can't show the underlying capture event.
How Long Does Implied Consent Actually Last Under CASL?
This is the requirement most programs get wrong, because implied consent isn't permanent the way an unsubscribed-until-opted-out US model would treat it.
| Implied Consent Source | Typical Duration | What Happens at Expiry |
|---|---|---|
| Existing business relationship (a completed purchase, contract, or similar transaction) | Roughly 2 years from the last qualifying transaction | Implied consent lapses — continuing to email requires express consent obtained before or at expiry |
| Inquiry or application (a lead form, quote request, or similar direct inquiry with no completed transaction) | Roughly 6 months from the inquiry | Implied consent lapses considerably faster than the business-relationship window — a common gap in lead-nurture sequences that run longer than this |
| Express consent (a specific, documented opt-in) | Indefinite, until withdrawn | Remains valid until the recipient unsubscribes or otherwise withdraws consent |
The inquiry window is the one that catches B2B lead-nurture programs most often — a six-to-nine-touch nurture sequence spread over several months can easily still be sending after the implied consent from the original inquiry has technically expired, unless express consent was captured somewhere along the way.
What Has to Appear in Every CASL-Compliant Message?
Regardless of which consent basis applies, CASL requires every commercial electronic message to clearly identify the sender (the legal business name, not just a brand name if they differ), include a valid mailing address and at least one other contact method (phone, email, or web form), and provide an unsubscribe mechanism that's clearly and prominently displayed. These identification requirements apply even to messages sent under valid express consent — consent doesn't exempt a message from the disclosure rules.
How Fast Do You Actually Have to Process an Unsubscribe?
CASL requires unsubscribe requests to be given effect within 10 business days, and the mechanism itself has to work without the recipient needing to do anything more than a single action (typically one click) — no login requirement, no "tell us why" gate blocking the actual unsubscribe, no multi-step confirmation flow that delays it. A functioning unsubscribe link that takes 15 business days to actually stop sending, or that requires the recipient to log into an account first, doesn't meet the standard even though a link technically exists.
How Do You Actually Build a CASL-Compliant Program?
Not just "subscribed: yes/no" — record whether consent is express or implied, what triggered it (form, purchase, inquiry), and the exact date, so expiry can be calculated per contact rather than assumed.
Set your automation platform to flag or suppress contacts whose implied consent window is approaching expiry, and route them into an express-consent capture flow before they lapse rather than after.
Confirm every commercial template — not just the main newsletter — includes the legal business name, mailing address, and a working contact method, since transactional-adjacent and promotional templates are often built separately and miss this.
Test the actual unsubscribe flow as a recipient would experience it, and confirm suppression takes effect well inside the 10-business-day requirement rather than relying on the outer limit.
Map every active nurture sequence's total duration against the shorter implied-consent window — this is the single most common CASL gap in B2B programs.
What Happens If a Program Gets This Wrong?
CASL carries real financial penalties for non-compliance, and enforcement has historically focused on exactly the gaps described above — expired implied consent and missing identification — rather than cases of outright unsolicited spam, which makes this a genuine operational risk for programs that assume "we have opt-in" is the whole answer. Beyond formal enforcement, the same documentation discipline that makes a program CASL-defensible also tends to improve inbox placement, since sending to expired or poorly-documented contacts is disproportionately likely to generate complaints that damage sender reputation.
For a broader view of how Canada's consent model compares to other markets you might be sending into, see our region-by-region compliance guide. If your automation platform isn't currently tracking consent type and expiry per contact, that's exactly the kind of system-level fix covered under our AI automation & implementation service.
- CASL requires documented consent, not just a checked opt-in box — the platform-level subscribe flag isn't proof without a record of how and when consent was captured
- Implied consent expires — roughly 2 years from a last transaction, roughly 6 months from an inquiry — and most non-compliance comes from missing this expiry, not lacking consent entirely
- Every commercial message needs sender identification (legal name, mailing address, contact method) regardless of consent type
- Unsubscribe requests must take effect within 10 business days via a mechanism requiring no more than one action from the recipient
- B2B lead-nurture sequences are the most common place implied-consent expiry gets missed, since sequences often run longer than the 6-month inquiry window
- The same consent-documentation discipline that makes a program CASL-defensible also improves deliverability by reducing complaints from stale contacts
- General orientation, not legal advice — confirm specifics with local counsel before relying on any consent classification
Frequently Asked Questions
Does having an opt-in checkbox make an email program CASL-compliant?
Not by itself. CASL requires that express consent be specifically documented — what was agreed to, when, and how — not just a boolean "subscribed" flag. A program can have real consent from every contact and still fail a CASL review if it can't produce records of how that consent was obtained.
How long does implied consent last under CASL?
Implied consent from an existing business relationship generally lasts around two years from the last qualifying transaction. Implied consent from a direct inquiry with no completed transaction generally lasts around six months. After expiry, continuing to send commercial messages requires express consent.
What has to be included in every CASL-compliant email?
Clear identification of the sender's legal business name, a valid mailing address, at least one other working contact method, and a clearly displayed unsubscribe mechanism — regardless of whether the message is sent under express or implied consent.
How fast do unsubscribe requests need to be processed under CASL?
Within 10 business days, and the mechanism itself must work with no more than one action from the recipient — no login requirement and no multi-step confirmation flow that delays the actual unsubscribe.
Why do B2B lead-nurture sequences run into CASL problems specifically?
Because the implied-consent window from a direct inquiry (roughly six months) is often shorter than the total duration of a multi-touch nurture sequence, meaning later messages in a long sequence can be sent after implied consent has technically expired unless express consent was captured earlier in the sequence.
Keep Reading
Want this handled properly?
If this is the kind of problem you're wrestling with, a short conversation is usually enough to tell whether there's a real opportunity here.