Answer first: the US CAN-SPAM Act is an opt-out statute — you may send commercial email until the recipient unsubscribes. Canada's CASL (S.C. 2010, c. 23) is an opt-in statute — a commercial electronic message (CEM) requires consent before dispatch. Both bind the sender, the tenant — not the platform — and both map to concrete Devotel Orbit surfaces: sender-domain verification, List-Unsubscribe headers, the suppression ledger, and the Consent API. The two compliance reference pages (US CAN-SPAM and CASL — Canada's Anti-Spam Legislation) carry the full per-requirement mapping; this post is the asymmetry explainer.
What CAN-SPAM actually requires — and what it does not
The FTC summarizes CAN-SPAM (15 U.S.C. §§ 7701–7713) in seven content requirements. For each one, name the surface where the mechanics actually live:
- No false or misleading header information. Orbit's sender-domain verification covers the mechanics: a custom
Fromdomain accepts traffic only once its DKIM, SPF, and DMARC records verify (configure them under Channels → Email → Domains; a daily health re-check drifts a failing record to a bell notification). An unverified domain returns403at send time, so the header always identifies its true origin. - No deceptive subject lines. Your copy. Orbit sends the
subjectyour campaign passes; the statute binds the sender, not the platform. Keep the subject consistent with the body content. - Identify the message as an ad. Also your copy — a disclosure line in the base template satisfies this when the promotional nature is not otherwise obvious.
- A valid physical postal address. A footer block in your template or HTML body — keep the custodial address in a shared footer so every template carries it by construction.
- A clear, conspicuous opt-out mechanism. Every outbound email Orbit sends carries both `List-Unsubscribe` / `List-Unsubscribe-Post` headers (RFC 8058 one-click) and an in-body unsubscribe link. No login wall, no reply-mail step between the click and the suppression.
- Honor opt-outs within 10 business days. The click writes a scope-
emailentry against the recipient in the suppression ledger idempotently, appends anemail.unsubscribedaudit event, and every later send to that address is dropped — Orbit honors the opt-out immediately, well inside the 10-business-day statutory maximum. The full ledger behavior is on the Opt-Out & Suppression Lists page. - Monitor email done on your behalf. If an agent or affiliate sends for you, the engagement and suppression telemetry is yours to audit — bounce/complaint reputation via
GET /api/v1/email/suppressions/reputationplus the Compliance Health view.
What CAN-SPAM does not require: an opt-in. There is no consent-before-send duty, no double-opt-in mandate, and no prohibition on marketing to a list you already hold — the statute's prohibitions target deceptive headers and subject lines, not the absence of prior consent. That is exactly what flips under CASL, and it is where a US tenant selling into Canada gets tripped.
CASL's opposite model — express vs implied consent
CASL's definition scope is the commercial electronic message (CEM): any electronic message whose purpose, given the content, hyperlinks, and contact information, is to encourage participation in a commercial activity. Email is in scope; so are SMS and any electronic message format. Pure transactional or service messages fall outside, but the moment a message tilts toward promotion, CASL applies.
CASL gives you three duties before the content conversation even starts:
- Consent first. The recipient must have given express consent (a documented opt-in, ideally recorded through Orbit's Consent API —
POST /api/v1/compliance/consentwithopt_in: true), or fall under one of the statute's implied consent categories — an existing business relationship, a conspicuously published address relevant to that relationship, or a few narrow carve-outs. Implied consent expires: generally two years after the last transaction for purchases, six months after a bare inquiry. Track the tier on your consent records or you cannot tell a CRTC auditor which basis a given recipient relied on. - Identification. The message must identify the sender and the party on whose behalf it is sent, with a valid postal address (or a readily reachable electronic one). The same sender-domain verification plus shared footer block maps onto this, exactly as CAN-SPAM requirements 1 and 4 map.
- Unsubscribe. The message must carry an unsubscribe mechanism that is readily performed and stays valid at least 60 days — a property Orbit's signed
List-Unsubscribeand in-body links satisfy by construction, the same surface as the CAN-SPAM side.
And a three-year record-keeping duty on consent evidence: a CRTC audit asks for the record, not your recollection. The Consent ledger is the audit surface.
The reciprocal relationship between the two regimes shows up constantly in a North America program: the US team publishes the flow narrative and sample messages under TCPA/TCR discipline, then the Canadian arm needs CASL consent records on top. The US vs Canada A2P SMS playbook is the cross-reference — read both before a cross-border program launches.
One scope distinction worth internalizing: a recipient's unsubscribe click writes an email-scope suppression entry by default, so a CAN-SPAM opt-out stops email only. Under CASL the safer posture is scope all routed through the Consent API or the bulk-import channel column, because consent is opt-in — many operators revoke every channel at once for Canadian recipients. The opt-out suppression page covers the per-entry-point scope defaults; pick deliberately rather than inheriting the default.
Per-channel asymmetry — email vs SMS vs voice
The opt-in/opt-out split is not an email-only question. Each channel has a different statutory posture in the US and Canada:
| Channel | US baseline | Canada | Default Orbit policy surface |
|---|---|---|---|
| Email (marketing) | CAN-SPAM — opt-out, send until suppressed | CASL — opt-in (express or narrowing implied consent) | Sender-domain verification + List-Unsubscribe headers + suppression ledger |
| Email (transactional) | CAN-SPAM content rules largely n/a for pure transactional; header integrity still applies | CASL CEM test decides if the message tilts commercial | Same suppression ledger; suppression scope email still bounds |
| SMS | TCPA — opt-in prior express consent for marketing sends; TCR message_flow carries the wording | CASL consent + CEM classification; STOP keywords expected by carriers | Consent API + quiet-hours tenant gate + per-country sender-id filing |
| Voice (outbound marketing) | TCPA federal window (8 AM–9 PM recipient-local) plus prior-express consent — measured against seven state-level mini-TCPA overlays | CASL opt-in; CRTC National DNCL for telemarketing lists | Campaign/dialer voice is hard-blocked on the federal window; ad-hoc voice is tenant-gated |
The table is a posture map, not a gate map: where the row says "tenant-gated" it means Orbit gives you a control, not that Orbit mandates it. The one platform-level hard guard in the stack is the federal TCPA voice window itself — it fails closed on campaign and dialer traffic and accepts no tenant toggle, because the $500–$1500 per-call federal penalty is not the tenant's to waive.
Configure the posture; Orbit does not mandate it
Everything else on this page is tenant-owned. Orbit surfaces the controls: the suppression ledger, the Consent API, sender-domain verification, quiet-hours gates, the Preference Center, the scope column on bulk import. Your compliance counsel sets the posture; your reviewers keep the footer and the disclosure line in the template. Nothing in the CAN-SPAM/CASL split is imposed by a platform gate beyond the federal voice window, and nothing about consent scope defaults overrides your deliberate jurisdiction choices. Compliance belongs to the tenant; the platform makes the controls auditable. This is an explainer, not legal advice — final posture rests with counsel.
Frequently asked questions
What does CAN-SPAM require of a US commercial email?
Seven content requirements: truthful headers, non-deceptive subject lines, ad identification, a valid physical postal address, a clear opt-out mechanism, honoring opt-outs within 10 business days, and monitoring third parties that send on your behalf. Orbit's sender-domain verification, List-Unsubscribe headers, and suppression ledger carry the mechanical parts; the copy obligations are the sender's.
Does CAN-SPAM require prior opt-in consent?
No. CAN-SPAM is an opt-out statute — you may send until the recipient unsubscribes. There is no consent-before-send duty in the statute; the prohibitions target deceptive headers and subject lines, not the absence of prior consent.
How is CASL different — what counts as a CEM?
CASL requires consent before dispatch, and defines its scope as the "commercial electronic message" (CEM): content, hyperlinks, or contact information that encourages participation in a commercial activity. Consent is either express (a documented opt-in) or implied (existing business relationship, conspicuously published address), and implied consent has an expiry — two years after purchase, six months after inquiry.
Which channels are opt-in and which are opt-out?
In the US: email marketing is opt-out under CAN-SPAM, but SMS marketing and outbound voice are opt-in under TCPA. In Canada: all commercial electronic messages are opt-in under CASL. The asymmetry table above maps the per-channel posture and the Orbit surface that carries it.
Where do I record CASL express consent?
Through Orbit's Consent API — POST /api/v1/compliance/consent with opt_in: true — so the ledger holds the basis, scope, and timestamp against the recipient, and the three-year record-keeping duty is an export away rather than a reconstruction.