CASL compliance checklist for Canadian small businesses

To follow Canada's Anti-Spam Legislation before sending a commercial email or text, your small business needs four things. You must have valid consent from the recipient, clear sender contact details in the message, a working unsubscribe link, and a record of when and how permission was given. This CASL compliance checklist breaks each rule into plain steps you can check in ten minutes before you press send.

Disclaimer: This article provides practical marketing information for Canadian businesses, as of November 2026. It is not legal advice. If you have questions about how the law applies to your specific situation, consult a qualified Canadian privacy lawyer.

What does CASL require from small businesses, and what are the penalties?

Canada's Anti-Spam Legislation (CASL), officially enacted as S.C. 2010, c. 23, came into force on July 1, 2014 to regulate commercial electronic messages (CEMs). A CEM is any digital message where one purpose is to encourage the recipient to take part in a commercial activity. This covers emails and SMS texts. It also applies to direct messages on social networks. If an email promotes your products or invites past clients to a paid workshop, the law applies to it.

Small businesses and solo founders are not exempt. There is no minimum list size required to trigger an investigation. Responsibility for enforcing CASL is shared across three federal agencies: the Canadian Radio-television and Telecommunications Commission (CRTC), the Competition Bureau, and the Office of the Privacy Commissioner of Canada (OPC).

The maximum fines in the law are steep. Under Section 20(4) of CASL, the maximum administrative monetary penalty for a violation is $1,000,000 for an individual and $10,000,000 for any other person (such as a corporation or business). While eight-figure fines target large violations, regulators also penalize small senders. In one documented case, the CRTC imposed a $15,000 administrative monetary penalty on an individual for sending approximately 58 non-compliant emails.

Bad consent habits also hurt your everyday email delivery. When people mark unexpected messages as spam, email providers lower your domain reputation. Soon, your normal client replies start landing in junk folders.

The printable 4-part CASL compliance checklist

Copy or print this pre-send CASL compliance checklist. Run through it whenever you set up an email newsletter or a promotional campaign, even when you map out an AI content calendar.

Part 1: Consent verification

• [ ] Every recipient on the send list has documented express consent or active, un-expired implied consent.
• [ ] Contacts whose 24-month purchase window or 6-month inquiry window has passed have been filtered out.
• [ ] Anyone who previously opted out is on a permanent suppression list and excluded from the send.
• [ ] Your website signup checkboxes are blank by default. To obtain valid express consent, a recipient must take a proactive, positive action (such as checking an unchecked box).

Part 2: Sender identification (footer check)

• [ ] The message clearly states the name of the person or business sending it. If an agency sends it for you, both names must appear.
• [ ] The message includes a valid, current physical mailing address. You can use a street address or a post office box. A rural route number also works.
• [ ] The message includes at least one secondary contact method, such as a phone number or an email address. A web address with a contact form is also fine.
• [ ] This contact information is accurate and will stay valid for at least 60 days after you send the message.

Part 3: Unsubscribe mechanism

• [ ] The message has a clear, easy-to-find unsubscribe link. For SMS, it gives a simple instruction like replying STOP.
• [ ] The opt-out process is completely free to the recipient.
• [ ] Clicking the link takes the user to a web page that works for at least 60 days after the message goes out.
• [ ] Your system processes opt-out requests right away, or within a maximum of 10 business days.

Part 4: Record-keeping and proof

• [ ] Your database stores the exact date and time each person gave express consent.
• [ ] You keep a copy or screenshot of the signup form wording that was live when they agreed.
• [ ] For implied consent, your system logs the exact date of the last purchase or inquiry so you know when the window closes.
• [ ] You can export these records quickly if a regulator asks for proof.

What is the difference between express and implied consent?

Knowing which type of permission you hold for each contact is the hardest part of email marketing in Canada. Express consent is permanent until the person unsubscribes. Implied consent is temporary and comes with strict expiry dates.

Many small business owners get into trouble when implied consent runs out. Suppose a client buys a workshop ticket from you on May 1. You have implied consent to send them promotional emails for 24 months. If they do not buy again or check an express opt-in box during those two years, you must stop emailing them when that window ends.

How do you fix your signup forms and email footers today?

Most compliance mistakes happen in two places: the website signup form and the bottom of the email template. You can fix both in a few minutes.

First, check every form on your website. A common mistake is adding a pre-checked box on a checkout page that says "Sign me up for news and offers." Under Canadian rules, silence or inaction never counts as express permission. The customer must click that box themselves. Make sure the text next to the box states clearly what they are signing up for and who is sending it.

Second, look at the footer of your email template. Many businesses only write their city and province at the bottom of a newsletter. That is not enough. You must include a full mailing address where you can receive physical mail for the next 60 days. If you work from home and do not want to share your home street address with your email list, rent a post office box and use that instead.

Third, test your unsubscribe link yourself. Send a test email to your personal address and click the opt-out button. Does the page load quickly? Does it let you opt out without logging into an account or paying a fee? If the link is broken or hidden in tiny grey text that nobody can read, fix the template before your next send.

What records do you need to keep in case of an audit?

If the CRTC investigates a complaint about your messages, the burden of proof always rests on you as the sender. Even if a subscriber genuinely asked to join your list two years ago, your business is considered non-compliant if you cannot produce a record showing how they agreed.

Keep a simple folder for your compliance records. Whenever you launch or update a signup form on your site, take a screenshot of the page and put the date in the file name. This proves the box was unchecked and shows the exact promise you made to the subscriber.

Next, check what your email software or CRM records when someone signs up. A good system logs the date, the time, and the source URL or form name. If you take verbal consent at a local trade show or in your shop, do not just type the person's email into a spreadsheet. Have them sign a paper sheet or fill out a tablet form on the spot, and keep that record on file.

Review your next campaign before it goes out

Take ten minutes today to open your email tool and check your default footer and your main signup form against the four parts of this CASL compliance checklist. Once your templates and opt-in settings are clean, staying compliant on future sends takes very little effort.

If you are comparing AI marketing tools for small business to help write those campaigns, Réson is one option: a workspace built with Canadian privacy rules in mind, where every email draft waits for your approval before anything goes out. It is free during the beta.