Canada's Anti-Spam Legislation (CASL) is the strictest commercial email law in the world — stricter than GDPR for cold email, and significantly stricter than CAN-SPAM. The penalties are real: up to $1 million CAD for individuals, $10 million CAD for organisations per violation. But CASL doesn't ban B2B cold email. It creates specific conditions under which commercial electronic messages can be sent without prior express consent. Understanding those conditions is what separates compliant Canadian outreach from expensive legal exposure.
CASL in Plain Language — What It Actually Requires
💡 TL;DR
CASL requires prior consent to send commercial electronic messages (CEMs) to Canadian contacts — but has two valid forms of consent: express (explicit opt-in) and implied. B2B cold email to Canadian businesses can qualify as implied consent when the recipient's business contact information is publicly published and the message is relevant to their role. Every CEM must include sender identity, a valid contact mechanism, and a functional unsubscribe mechanism honoured within 10 business days. Document everything. The CRTC enforces actively.
CASL covers any commercial electronic message sent to or from a Canadian electronic address. That means if your recipient has a Canadian email address — regardless of where you're sending from — CASL applies.
Implied Consent — The B2B Cold Email Path
Implied consent under CASL Section 10(9)(b) is the primary legal basis for B2B cold email to Canadian contacts. It applies when all of the following conditions are met:
The recipient's contact information is conspicuously published. Their email address appears on a company website, LinkedIn profile, trade directory, or another publicly accessible source — without a statement that they don't want to receive commercial messages.
The message is relevant to their business, role, or official capacity. The CEM must have a clear connection to the contact's professional function. A marketing software pitch to a VP of Sales qualifies. The same pitch to a company's HR Director is a weaker case.
No prior indication the contact doesn't want CEMs. If the contact has previously unsubscribed from your messages or indicated they don't want commercial contact, implied consent is lost — permanently for that contact.
🚩 The Part Most Teams Miss
Implied consent under CASL is not unlimited. Unlike GDPR's legitimate interests, which applies broadly to B2B outreach, CASL's implied consent for publicly published contact information requires that the recipient's information was published WITHOUT a statement that they don't want CEMs. If a LinkedIn profile says "No recruiters or cold email" — implied consent does not apply to that contact.
What Every CASL-Compliant Cold Email Must Include
Every commercial electronic message sent to a Canadian contact must include all of the following — regardless of which consent basis you're using:
Sender identification: Your full legal name (or the organisation's name if sending on behalf of a company). Not just a first name or brand name — legal identity.
Physical mailing address: A valid civic address, PO box, or registered agent address. Must be current at the time of sending.
A contact mechanism: Either a phone number, email address, or web address where the recipient can contact you. Must remain functional for 60 days after the message is sent.
Unsubscribe mechanism: A clearly accessible way to opt out of future messages — typically a link, a reply instruction, or both. The mechanism must function without the recipient providing any information other than their email address, and without any cost to the recipient.
Unsubscribe honouring deadline: All unsubscribe requests must be processed within 10 business days. This is a hard requirement — not a best practice.
Documentation — The CASL Requirement Most Teams Skip
CASL operates on a reverse onus model: if the CRTC investigates a complaint, you must be able to prove consent — the regulator doesn't have to prove its absence. This makes documentation essential for any team sending cold email to Canadian contacts.
Document the following for every Canadian contact before sending:
Where you found the contact's information (URL, publication date if available)
The date you collected the information
Whether the publication included any indication against receiving CEMs
The basis for implied consent (publicly published business contact information + role relevance)
A simple CRM field noting the source URL and collection date is sufficient for most B2B cold email operations. In our experience working with agency clients running Canadian outreach at Litemail, the teams that maintain even minimal contact source documentation face significantly fewer compliance issues than those who don't.
Infrastructure That Supports CASL Compliance
CASL compliance is primarily a legal and process concern — but infrastructure choices affect compliance in two ways: they determine whether your emails reach the inbox (where recipients can opt out properly), and they affect the technical sender identification requirements.
Dedicated Sending Domains and Clean Authentication
CASL requires clear sender identification. Using a sending domain with proper SPF, DKIM, and DMARC setup demonstrates that emails are actually from who they claim to be from — which is part of the sender identity requirement. A failed DKIM check creates an email where the sender identity can't be verified, which is problematic under CASL's identification requirements.
EU IPs for Canadian Recipients
Canada's largest ISPs — Rogers, Bell, Telus — use spam filters that evaluate sending IP reputation similarly to European mail servers. Dedicated IP addresses with clean sending history perform measurably better for Canadian recipient deliverability than shared IP pools. Litemail's pre-warmed inboxes include dedicated US and EU IPs — the EU IPs particularly benefit Canadian enterprise recipients on Outlook/Exchange infrastructure.
Unsubscribe Processing Infrastructure
CASL's 10 business day unsubscribe deadline requires that your sending platform processes opt-outs and updates your suppression list reliably. Most major platforms (Instantly, Smartlead, Lemlist) handle this automatically when inboxes are connected via OAuth. Confirm your platform's unsubscribe processing before any Canadian campaign launch.
Run Canadian Cold Email With Infrastructure Built for Compliance
Compliant CASL cold email requires proper sender authentication and reliable opt-out processing. Pre-warmed inboxes from $4.99/inbox — automated SPF/DKIM/DMARC, OAuth connection for unsubscribe processing, dedicated IPs for Canadian deliverability.
Get Pre-Warmed Inboxes from $4.99 →
Automated DNS · OAuth-compatible · Dedicated US and EU IPs · No minimum order
About Litemail — Litemail provides pre-warmed Google Workspace and Microsoft 365 inboxes for cold email outreach. From $4.99/inbox with automated DNS, dedicated US and EU IPs, and full admin access. View pre-warmed inbox plans →
Related reading:
CAN-SPAM and GDPR Cold Email Guide · Is Cold Email Legal in 2026? Country Guide · Cold Email Compliance Audit 2026 · SPF/DKIM/DMARC Auto-Setup 2026 · Best Pre-Warmed Inbox Providers 2026 (Ranked)
Key Takeaways
CASL requires prior consent for commercial electronic messages to Canadian contacts — but implied consent applies when contact information is publicly published without an indication against CEMs, and the message is relevant to the recipient's business role.
Every CASL-compliant cold email must include: sender legal identity, physical address, contact mechanism (valid 60 days), and a functional unsubscribe mechanism honoured within 10 business days.
CASL operates on reverse onus — you must prove consent, not the regulator. Document where you found each Canadian contact's information and when, before sending.
If a contact's profile includes any statement against receiving CEMs — "no cold email," "no recruiters" — implied consent does not apply. Remove them from Canadian outreach lists.
Proper DNS authentication (SPF/DKIM/DMARC) supports CASL's sender identity requirements and improves deliverability with Canadian ISPs. Litemail configures all three automatically on inbox delivery.
Penalties up to $10 million CAD per violation make CASL documentation non-optional. Even a simple CRM field noting contact source and collection date provides meaningful protection.
Frequently Asked Questions
Is cold email legal in Canada under CASL?
Yes — B2B cold email to Canadian contacts is legal under CASL when implied consent conditions are met: the contact's email is publicly published without a statement against CEMs, and the message is relevant to their business role. CASL does not ban cold email — it creates specific conditions for sending without express consent. Those conditions are more demanding than CAN-SPAM (US) but not impossible to meet for legitimate B2B outreach.
What is implied consent under CASL for cold email?
Implied consent under CASL Section 10(9)(b) applies when a recipient's business contact information is conspicuously published in a public space (company website, LinkedIn, trade directory) without any indication they don't want commercial messages, and the message is relevant to their professional role or business. This is the primary consent basis for B2B cold email to Canadian contacts without prior express opt-in.
How is CASL different from GDPR for cold email?
Both permit B2B cold email under specific conditions, but CASL is stricter. GDPR's legitimate interests basis applies broadly to B2B commercial outreach when a three-part test is passed. CASL requires that the specific contact's information was publicly published without anti-CEM statements — a narrower test. CASL also has a stricter unsubscribe deadline (10 business days) and operates on reverse onus (you prove consent, not the regulator). Penalty exposure under CASL ($10M CAD per violation) exceeds most GDPR enforcement actions for cold email.
Do I need express consent to email Canadian businesses?
Not always — implied consent applies when CASL Section 10(9)(b) conditions are met. But express consent provides stronger legal standing and is required for consumer outreach (B2C) and for contacts whose information isn't publicly published. For B2B outreach where contact information is on company websites or LinkedIn without anti-CEM statements, implied consent is typically sufficient for compliant cold outreach.
How long do I have to honour unsubscribe requests under CASL?
10 business days. This is a hard legal requirement — not a best practice. Most sending platforms (Instantly, Smartlead, Lemlist) process opt-outs immediately when correctly configured. For CASL compliance, confirm your platform's unsubscribe processing is working before launching any Canadian campaign, and check that opt-out contacts are moved to a permanent suppression list, not just paused from one campaign.
What happens if I violate CASL?
The Canadian Radio-television and Telecommunications Commission (CRTC) enforces CASL. Penalties run up to $1 million CAD per violation for individuals and $10 million CAD per violation for organisations. The CRTC has issued fines against both Canadian and international companies. Private right of action (class action lawsuits) was originally included in CASL but has not been brought into force as of 2026. Enforcement has historically focused on large-scale spammers rather than B2B cold email, but the legal exposure is real.
Does CASL apply if I'm sending from outside Canada?
Yes — CASL applies to commercial electronic messages sent to Canadian electronic addresses, regardless of where the sender is located. If your prospect has a Canadian email address, CASL governs the message. International senders targeting Canadian contacts must comply with CASL's consent, identification, and unsubscribe requirements exactly as Canadian senders must.
Reach Canadian Contacts With CASL-Compliant Infrastructure
Litemail pre-warmed inboxes — $4.99/inbox, automated SPF/DKIM/DMARC for proper sender authentication, OAuth connection for reliable unsubscribe processing, dedicated US and EU IPs for Canadian deliverability. No minimum order. Delivered in 24 hours.
Get Pre-Warmed Inboxes from $4.99 →
No minimum order · Automated DNS · OAuth-compatible · US and EU IPs included
About Litemail — Litemail provides pre-warmed Google Workspace and Microsoft 365 inboxes for cold email outreach. From $4.99/inbox with automated DNS setup, dedicated US and EU IPs, 4 to 12 weeks of genuine warm-up history, and full admin access. View pre-warmed inbox plans →
Related reading: CAN-SPAM and GDPR Cold Email Guide · Is Cold Email Legal in 2026? Country Guide · Cold Email Compliance Audit 2026 · Best Pre-Warmed Inbox Providers 2026 (Ranked)
