CASL Canada cold email requirements: what prospects require
See the consent, sender ID and unsubscribe rules behind CASL Canada cold email requirements, how B2B differs, and what 2026 CRTC enforcement data shows.
Carlos AgüeroNov 6, 2026
Last updated: Nov 6, 2026
CASL Canada cold email requirements: what prospects require
CASL is Canada's Anti-Spam Legislation, the federal law that requires consent, clear sender identification and a working unsubscribe option before you send a commercial electronic message to a recipient in Canada, business or consumer. If your team is expanding outbound into Canada, those rules apply before the first send. Canada's Spam Reporting Centre logged 189,908 submissions in six months (emailexpert, 2026), citing CRTC data. This guide explains the CASL Canada cold email requirements, how to document consent and where enforcement risk sits. It is general information, not legal advice. For the video side of outreach, see video outreach in cold email.
Key Takeaways
CASL generally treats a cold email to a Canadian work address like a consumer message: it needs consent, sender identification and an unsubscribe mechanism.
The CASL business-to-business exemption is described as depending on an existing relationship between two organizations, so it is not a safe basis for first-touch cold email.
Conspicuous publication is a narrow implied-consent basis, and a sender should keep proof for each contact.
CASL can reach US senders with no Canadian entity, so Canadian outbound needs its own consent and suppression workflow.
The CRTC issued 96 notices to produce between October 2025 and March 2026, as trade press reported in 2026.
Written by Carlos Agüero, who builds outbound automation and inbox deliverability tools for B2B sales teams. He is not a lawyer. Have Canadian counsel review your program before you act on it.
Does CASL treat B2B cold email differently from consumer email in Canada?
Canada's Anti-Spam Legislation (CASL) has no general business-to-business carve-out for cold email: a commercial electronic message to a work address generally needs the same consent, sender identification and unsubscribe mechanism as a consumer message. Lack of consent was cited in 93% of detailed complaints from October 2025 to March 2026 (emailexpert, 2026). The narrow B2B exemption needs an existing relationship.
Two envelopes on a desk, one for a company and one for a person, each with the same checklist stamp
A commercial electronic message (CEM) is a message sent electronically that encourages participation in a commercial activity. A sales pitch to a prospect's company inbox fits that definition. A business recipient does not change it.
People often call the B2B exemption a loophole. As a general reading, that is wrong. It is described as covering organizations that already have a relationship. Commentary on the CompuFinder decision suggests courts expect it to be demanding. Treat cold outreach to a company you have never dealt with as outside it. Ask counsel before you test the edge.
Question
Consumer recipient
B2B recipient
Is a sales pitch a CEM?
Yes
Yes
Is consent needed before the first message?
Yes
Yes
Must the sender be identified?
Yes
Yes
Is an unsubscribe mechanism required?
Yes
Yes
Does a B2B exemption help a first-touch email?
Not applicable
Generally no, it needs an existing relationship
We are expanding outbound into Canada. What does CASL require before we email prospects there?
Before emailing a Canadian prospect, CASL requires three things: consent (express, or implied under a defined basis), clear sender identification with contact information, and a working unsubscribe mechanism. Senders fail most on consent: it was cited in 93% of detailed complaints, failure to identify the sender in 48% and deceptive marketing in 46% (emailexpert, 2026).
Three checklist cards showing a tick, a name badge and an exit door icon laid on a table
Emailexpert is trade press re-reporting CRTC figures. Check them on the CRTC enforcement snapshot before you cite them elsewhere.
Express consent is consent a recipient actively gives to receive your messages. Implied consent is consent the law infers from a defined situation, such as an existing relationship or conspicuous publication. Cold email to strangers usually relies on the second.
The three requirements in practice
Consent: have a documented basis for each recipient before the first send.
Identification: name your company and give valid contact details in every message.
Unsubscribe: include a free, working opt-out and honor it within the legal deadline.
Sources disagree on that deadline. Most say 10 business days, one says 2. Contact details are often said to stay valid for 60 days. Check these against the Act, its regulations or ISED guidance before you set suppression rules. The CRTC lists the regulations on its CASL regulations page.
Complaints can cite more than one reason, so the shares overlap and do not sum to a total. Comparisons with earlier reports may not be valid.
Horizontal Bar chart: Why Canadians complained: reasons cited in detailed Spam Reporting Centre complaints (Oct 2025 to Mar 2026). Highest: Lack of consent at 93%.
The Privacy Commissioner also received 14 complaints in 2024-25 that it deemed CASL-related. They covered unsolicited messages, missing unsubscribe options and unsubscribe requests nobody acted on (ISED, 2025).
What counts as conspicuous publication for implied consent?
Conspicuous publication is an implied-consent basis that can apply when a recipient has openly published a work email address with no statement refusing unsolicited messages, and your message relates to their role. The CRTC FAQ says it sets a higher standard than public availability (CRTC, 2026), so the sender should keep proof for each contact.
A binder with tabbed folders and a printed web page with a date stamp on a compliance desk
The same FAQ treats an address indexed by a search engine as directly available to the public. Being findable is not enough. Read this as the regulator's current interpretation. Three conditions should hold for each contact:
The recipient published the address, or caused it to be published.
No statement says they do not want unsolicited messages.
Your message is relevant to their business role.
Regulators do check. In November 2024, the CRTC reviewed about 25 companies with higher complaint volumes. It looked for consent and a working unsubscribe mechanism, then sent warning letters (CRTC, 2025).
Why purchased lists usually fail
A bought list or third-party directory rarely proves that the recipient published the address. Practitioners generally treat the sender as the party who must show it. A vendor's word may not meet that burden. If you scraped or bought the list, assume you need your own proof for each contact.
Build an evidence file per contact
Keep a record you could hand to a regulator. A simple template works:
Field
Why it matters
Example entry
Source URL
Shows where the address was published
Company team page
Capture date
Fixes the date the address was visible
Date you saved the page
No-solicitation check
Shows no opt-out notice was present
"None found" with screenshot
Role relevance
Links your offer to the recipient's job
"Head of Sales, buys outbound tools"
Consent basis
Records the exemption or consent type
Conspicuous publication
Link these records to your Customer Relationship Management (CRM) system so a suppression flag follows each contact. Sources give implied-consent expiry as 6 months, 2 years or "while published." Verify the rule for each basis with counsel.
Does CASL apply to a US company emailing Canadian prospects?
CASL can apply to a US company emailing Canadian prospects, because general guidance says the law reaches messages sent from or accessed on a computer system in Canada, whether or not the sender has a Canadian entity. Confirm the reach rule against the Act with Canadian counsel before you rely on it.
A globe with a red pin in Canada and a paper plane approaching it from another continent
Few guides explain how this works in practice, and this article has not verified the reach rule against the Act. The exposure is regulatory. The CRTC, the Competition Bureau and the Office of the Privacy Commissioner (OPC) enforce CASL. Commentary also says liability can extend to directors, officers and service providers. It adds that a documented compliance program can support a due diligence defense. Ask counsel how to structure yours.
A US team can segment Canadian contacts at the data stage:
Tag every contact with a country field before sequencing.
Hold Canadian contacts out of sequences until the evidence file is complete.
Add a Canada-specific footer with sender identity and an unsubscribe link.
CASL enforcement is shifting from education toward evidence-gathering. Canada's Spam Reporting Centre received 189,908 submissions in the CRTC's latest six-month window, averaging 7,304 each week (emailexpert, 2026), and the CRTC issued 96 notices to produce against 11 warning or information letters in the same period.
A tall stack of official notice folders beside a few thin warning letters on a desk
Email was the largest reported spam source in detailed complaints at 60%, with SMS second at 34% (emailexpert, 2026). Email senders are the main target.
The CRTC's snapshot for 1 October 2025 to 31 March 2026 says CASL is now well established and signals a heightened expectation of compliance (CRTC, 2026). It also points to administrative monetary penalties (AMPs) of up to $10M per violation for businesses. An administrative monetary penalty is a fine the regulator imposes without a court trial. Verify that figure on the CRTC page.
Enforcement measure, Oct 2025 to Mar 2026
Count
Notices to produce
96
Warning or information letters
11
Preservation demands
2
The trade outlet reads the imbalance as a sign the CRTC may be preparing cases. That is its inference. The same report announced no new financial penalty for the period.
Lollipop chart: CRTC CASL enforcement measures, Oct 1, 2025 to Mar 31, 2026. Highest: Notices to produce at 96 count.
The private right of action, which would let individuals sue senders directly, has not been in force. A secondary source reports that the provisions were repealed on 31 December 2025 (myprivacyrights.ca, 2025). No primary source confirmed it, so treat that as unverified. Either way, CRTC, Competition Bureau and OPC enforcement continues.
Limitations: who this guide is not for
Canada's Anti-Spam Legislation (CASL) guidance on this page is written for sales and compliance teams planning outbound email into Canada, and it is general information, not legal advice. It does not cover Quebec French-language rules, PIPEDA privacy law or social direct messages. Canadian counsel should confirm each legal point against the Act and its regulations before you rely on it.
Specific limits to keep in mind:
The complaint and enforcement figures come from trade press re-reporting CRTC data, so check them on the CRTC page.
Unsubscribe deadlines and implied-consent expiry windows vary by source, so no fixed numbers appear here.
Complaint shares show what people reported, not the share of senders found in breach.
The B2B exemption, foreign-sender reach and due diligence points are not verified against the Act here.
LinkedIn messages, SMS and multi-touch sequences need separate review.
Frequently Asked Questions
Is cold email legal in Canada under CASL?
Cold email is legal in Canada only when the sender has express or implied consent, identifies itself clearly and includes a working unsubscribe mechanism. CASL does not ban first-contact outreach, but it requires a valid consent basis before sending. Under general guidance the sender must be able to prove that consent existed, so keep records for every contact.
Does CASL apply to B2B emails?
CASL applies to B2B emails, because a sales pitch to a work address is generally a commercial electronic message. A narrow business-to-business exemption exists, but under general guidance it depends on an existing relationship between the two organizations. It is not a safe route for a first-touch cold email to a company you have never dealt with.
Can I use a purchased or scraped email list for Canadian outreach?
A purchased or scraped list is risky for Canadian outreach because the sender must still be able to show a consent basis for each address. Bought lists and third-party directories usually struggle to meet the conspicuous publication test, since you must show the recipient published the address or caused its publication. Document the source of every contact.
Is a message asking for consent itself a commercial electronic message?
A message asking for consent is generally treated as a commercial electronic message under CASL. Under that general guidance, you should not send a consent request to a Canadian prospect unless you already have a valid basis to contact them. Check your consent basis before any request goes out, and have Canadian counsel confirm your wording.
Conclusion
Treat Canada as a separate compliance track, not an extension of your US sequences. Before you scale volume:
Build the per-contact evidence file and tie it to CRM suppression.
Confirm unsubscribe and expiry timing with Canadian counsel.
Hold Canadian contacts out of sequences until their records are complete.
Check the enforcement figures here against the CRTC's own pages.
Our data: SendPotion's GrowPronto case study reports 45 meetings booked and 7 accounts closed with Potion.
Once your consent basis is documented, you can test personalized video in your sequences, as outlined in video email marketing for B2B sales. Start Free Trial and run it on a compliant Canadian segment.
Written by
Carlos Agüero
Carlos Agüero builds tools that help B2B sales teams sell smarter. As part of TargetGrid.ai, Skale.email, and Potion, he's focused on multi-channel outreach automation, inbox deliverability, and AI-powered video. Berkeley Haas COBE. Based in Santiago, Chile. Passionate about helping sales teams close more, faster, with less manual work.
Carlos AgüeroNov 6, 2026
