Canada's anti-spam law made consent the default, not an opt-out

The revenue mechanism

Canada's Anti-Spam Legislation, commonly called CASL, took its core sending provisions into force on 1 July 2014, according to the coming-into-force notes attached to the statute's own consolidated text. The mechanism it changed is the default a sender starts from. The US CAN-SPAM Act permits a business to send commercial email until a recipient opts out. CASL instead prohibits sending a commercial electronic message unless the sender already has consent, either express or implied, before the first message goes out. That single reversal of the starting position is what Canadian guidance and US-focused publishers alike describe as the practical difference between the two regimes, even though both statutes also require a working unsubscribe mechanism.

What the documents show

The statute's own text sets out how express consent must be obtained: a sender seeking it must clearly state, at the time of the request, the purpose for which consent is sought and identify who is seeking it. It separately defines implied consent, permitting it only in narrower circumstances such as an existing business relationship between the parties or where the recipient has conspicuously published the electronic address without a statement that they do not wish to receive unsolicited messages. The Act requires an unsubscribe mechanism a recipient can use at no cost, to be honoured without delay and in any event no later than 10 business days. For enforcement, the statute sets a maximum administrative monetary penalty of $1,000,000 for an individual and $10,000,000 for any other person, a ceiling stated directly in the Act rather than a typical assessed amount. The government's own public information page confirms the 2014 timing and describes CASL as also covering non-email conduct such as malware installation and address harvesting.

The assumptions exposed

The $10,000,000 figure is a statutory ceiling, not a typical penalty, and the cited sources do not report how often that maximum has actually been imposed. It is also a common misreading to assume CASL's implied-consent categories are as broad as a simple existing-customer exception; the statute's own conditions for implied consent are narrower and time-limited in ways a sender should read directly rather than assume. Because CASL applies based on whether a message is received in Canada, a newsletter based elsewhere can fall under it without the publisher realising a Canadian subscriber changes which consent standard applies to that send.

What to check before you rely on it

This is an editorial checklist. A publisher with any Canadian subscribers should confirm whether consent for each of them is express, properly documented, or covered by one of the statute's specific implied-consent categories, rather than assuming a US-style opt-out list is sufficient.

• Is there a record of when and how each Canadian subscriber's consent was obtained?
• Does an implied-consent claim actually match one of the statute's stated categories?
• Is the unsubscribe mechanism honoured within the 10-business-day window the Act specifies?

CASL's consent-first design is a documented legal fact for a Canadian audience; treating it as equivalent to CAN-SPAM's opt-out model is the error the statute's own structure is built to correct.