CASL vs CAN-SPAM: the difference that catches Canadian businesses out

If you run outbound email into both the United States and Canada, you are operating under two laws that disagree on the most important question: whether you needed permission before you sent.

The core difference

CAN-SPAM (United States) is an opt-out regime. You may send a commercial email to someone who never asked for it, provided you identify yourself, do not mislead in the header or subject line, and honour unsubscribe requests promptly.

CASL (Canada) is an opt-in regime. You need express or implied consent before the message goes out. Honouring unsubscribes afterward does not cure a send you were not permitted to make.

That asymmetry is where companies get into trouble. A cold outbound sequence built by a US agency, run against a mixed list, is compliant for part of the list and a violation for the rest.

What counts as consent under CASL

Express consent is someone actively agreeing to receive commercial messages from you — a ticked box that was not pre-ticked, with a clear statement of what they are signing up for and who is sending it. It does not expire.

Implied consent is narrower than most people assume. The common grounds:

• An existing business relationship — they bought from you, or entered a contract, within the past 24 months
• An existing non-business relationship, such as a donation or volunteering, on the same 24-month clock
• An inquiry they made of you, within the past 6 months
• Conspicuously published business contact information, where the role is relevant to your message and there is no statement refusing contact

That last ground is the one people over-read. A role-relevant email address published on a company website can be contacted about that role — it is not a license to mail every address you can scrape.

Every message needs three things

Regardless of consent basis:

1. Clear identification of who is sending, with a mailing address
2. A working unsubscribe mechanism, honoured within 10 business days
3. Accurate subject lines and headers

Why this is worth getting right

Penalties run to $1 million for an individual and $10 million for a corporation. Officers and directors can be held personally liable, and there is a due-diligence defense — which only helps if you can produce records showing how consent was obtained for each contact.

That is the practical takeaway: the compliance artifact is not a policy document, it is a per-contact record of consent source and date that you can produce on request. Most email platforms will store it if you configure them to. Very few do by default.

The simple operating rule

Build to CASL and you are compliant in both countries. Build to CAN-SPAM and you are exposed in one. Since the stricter standard also tends to produce better engagement and deliverability, the compliance cost here is mostly imaginary.

---

This is general information, not legal advice. For a specific campaign, particularly one touching Quebec’s Law 25, talk to counsel.