CASL — Canada's Anti-Spam Legislation
Qué es CASL?
Esta entrada está disponible actualmente solo en inglés.
CASL (S.C. 2010, c. 23) is Canada's opt-in statute for commercial electronic messages, enforced by the CRTC: consent must exist before you send, unlike the US CAN-SPAM opt-out model that permits sending until a recipient unsubscribes. Express consent or the statute's narrowing implied-consent tiers, sender identification with a valid address, and a readily performed unsubscribe that stays valid for at least 60 days are its three core duties.
More detail
CASL's consent tiers are the part operators misjudge. Express consent is the durable tier — an affirmative opt-in you can document. Implied consent covers an existing business relationship, but it expires: generally two years after the last transaction for purchases, six months after an inquiry. Track which tier each recipient sits in on your consent records, or you cannot answer a CRTC audit. A three-year record-keeping duty applies to that consent evidence.
The statute's other two duties map to concrete Orbit surfaces. Sender identification with a valid postal address lives in your template footer, and message authenticity rides on sender-domain DKIM/SPF/DMARC verification. The unsubscribe duty — readily performed and valid for at least 60 days — is covered by the List-Unsubscribe / List-Unsubscribe-Post headers plus the in-body link every outbound email carries, and the scope-`email` suppression entry a recipient click writes.
Because consent is opt-in, the suppression-scope decision carries more weight under CASL than under CAN-SPAM. A Canadian unsubscribe click defaults to scope `email`, but many operators route Canadian opt-outs through the Consent API with scope `all` so the revocation also propagates to SMS and voice. The defaults are per-entry-point, not per-jurisdiction — pick the scope deliberately rather than inheriting the per-channel default.
The tenant, not the platform, owns the posture. CASL carries administrative monetary penalties and a private right of action; Orbit supplies the consent ledger, the suppression surfaces, and the audit trail, but consent capture, identification text, and unsubscribe mechanics are sender obligations that your counsel should review.
Preguntas frecuentes
- What is the difference between implied and express consent under CASL?
- Express consent is an affirmative, documented opt-in — the durable tier. Implied consent is granted by an existing business relationship but expires: generally two years after a purchase, six months after an inquiry. CASL audits ask for the record of which tier a recipient was in, so stamp the tier on every consent record.
- Does CASL cover SMS?
- Yes. The statute regulates commercial electronic messages, which covers SMS as well as email sent to Canadian recipients — consent, identification, and unsubscribe duties all apply. Unsubscribe flows default to scope `email`; route Canadian revocations through the Consent API with scope `all` if the opt-out should also block SMS and voice.
- How does CASL differ from the US CAN-SPAM Act?
- CASL is opt-in — consent must exist before dispatch. CAN-SPAM is opt-out — you may send until the recipient unsubscribes. For a cross-border program, treat each jurisdiction's consent posture separately; the blog explainer can-spam-casl-email-sms-opt-out-vs-opt-in walks the per-channel asymmetry.
- How long must CASL consent records be kept?
- The statute imposes a three-year record-keeping duty on consent evidence. Keep consent records and the suppression ledger exportable so a CRTC audit is answered from the record, not from recollection.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.