CASL Compliance for Small Business: Website Forms, Email and Texts

Canada's Anti-Spam Legislation (CASL) is stricter than the US CAN-SPAM rules many email tools are designed around. That catches out plenty of small businesses, usually through a website form rather than a deliberate spam campaign. Here is how to stay on the right side of it. This is a practical overview, not legal advice.

What counts as a commercial electronic message

A commercial electronic message (CEM) is any electronic message that encourages participation in a commercial activity: newsletters, promotions, product announcements, and even a follow-up text offering a discount. CASL covers email, SMS and direct messages on social platforms.

Every CEM must meet three requirements:

1. Consent: express or implied
2. Identification: your business name and contact information
3. An unsubscribe mechanism: simple, free and working

Express consent: the gold standard

Express consent is an active "yes" from the recipient. To be valid, your request must clearly state:

• Why you're asking (for example, "monthly tips and offers")
• Who is asking, with your business name and contact information
• That the person can withdraw consent at any time

Express consent doesn't expire until someone unsubscribes, which makes it the foundation of any email list. The government's guide to getting consent sets out the details.

Implied consent and when it expires

Implied consent exists in specific situations, and it is time-limited:

Implied consent is useful, but it runs out. Use it to invite people to give express consent before the clock expires.

Designing a compliant email sign-up form

Your email sign-up form is where CASL compliance is won or lost:

• Use an unchecked box or a clearly labelled sign-up button. Pre-checked boxes are not valid consent.
• Keep consent separate. Don't bundle marketing consent into accepting terms and conditions or completing a purchase.
• Say what people will receive, such as "monthly newsletter and promotions."
• Identify your business next to the form.
• Record the evidence: date, time, form version and the wording shown. CASL puts the burden of proof on the sender.

The unsubscribe mechanism

Every CEM needs an unsubscribe mechanism that is easy to use at no cost. Under CASL:

• Requests must be processed within 10 business days
• The unsubscribe link must keep working for at least 60 days after the message is sent
• You can offer preference options, but always include a clear "unsubscribe from all"

Test your links regularly. Broken unsubscribe links have triggered enforcement actions.

Text messages and automated follow-ups

CASL applies to SMS just as it does to email. If you use missed-call text back or automated follow-ups, the same rules apply. Someone who just called about your services generally gives implied consent for related messages for six months, but promotional texts still need identification and a way to opt out, such as "Reply STOP to unsubscribe." Our guide to AI for trades shows how this works in practice.

Messages that don't need consent

Some messages are exempt from the consent requirement but still need identification and an unsubscribe mechanism. Examples include:

• A quote or estimate the person asked for
• Confirmation of a purchase or transaction
• Warranty, recall or safety information about something they bought
• Factual updates about an ongoing subscription or account

Purely transactional messages with no promotional content are the safest. Adding a "20% off your next order" banner to a receipt turns it into a CEM.

Bought lists, referrals and contests

A few common shortcuts don't hold up under CASL:

• Purchased or rented email lists: the people on them haven't consented to hear from you, so they're not a valid basis for marketing.
• Referrals: CASL allows a single message to someone referred to you, if the referrer has a relationship with both of you and you name the referrer in the message. After that, you need the person's own consent.
• Contests and giveaways: an entry form is fine, but marketing consent must be a separate, optional checkbox, not a condition of entering.

Penalties and enforcement

The CRTC enforces CASL. Administrative penalties can reach $10 million per violation for organizations and $1 million for individuals, and the CRTC's compliance guidance explains how it assesses cases. Enforcement has included penalties against well-known Canadian companies, often for consent and unsubscribe failures rather than outright spam.

Record-keeping that holds up

If the CRTC asks, you must show how each person consented. For every sign-up, keep the date and time, the source form or page, the exact consent wording shown, and the IP address or other identifier your tools capture. Most email platforms store this automatically when sign-ups come through their own forms; custom website forms need to pass it along. Keep records for as long as you message the contact, plus a buffer afterwards.

Sign-ups collected in person or by phone

Consent doesn't have to be collected online. If staff add customers to your list at the counter or over the phone, script the request so it covers the same points as your web form, and record when, how and by whom consent was collected. An unverifiable "they said yes" won't stand up if the CRTC asks.

A quick CASL checklist

1. Audit every website form that collects emails or phone numbers
2. Remove pre-checked boxes and bundled consent
3. Add business identification to every template
4. Test unsubscribe links in every email and SMS flow
5. Store consent records with timestamps and form wording
6. Track implied-consent expiry dates in your CRM
7. Re-permission older contacts before their implied consent lapses

Conclusion: build consent into the website

CASL compliance for small business is mostly a design problem. When your forms collect clear express consent, your templates identify you and your unsubscribe links work, you can market confidently and keep a list that actually wants to hear from you.

We build business websites with CASL-ready forms and consent records built in. If you'd like your sign-up forms and email flows reviewed, send us a quick note.