CASL Compliance for Email and SMS Marketing: The 2026 Guide for Canadian Businesses

01. The Quick Answer: CASL Compliance for Email and SMS Marketing

• What CASL requires: express or implied consent before sending a commercial electronic message, plus sender identification, valid contact information, and a working unsubscribe mechanism on every message.
• Does it apply to B2B email: yes, a cold prospecting email to a business contact is a commercial electronic message like any other, with only narrow exemptions.
• What expires: implied consent, 2 years from a transaction or 6 months from an inquiry. Express consent does not expire on its own.
• What it costs to get wrong: penalties up to 10 million dollars CAD per violation for organizations, with CRTC enforcement activity rising through 2025 and into 2026.

02. At a Glance: CASL vs CAN-SPAM vs GDPR

Why it matters: a Canadian brand selling into the US, covered in our cross-border ecommerce guide, cannot simply apply CAN-SPAM's opt-out logic to its Canadian contacts. CASL is the stricter standard, so building marketing operations around CASL first tends to clear the other two with less rework than the reverse order.

03. What CASL Actually Covers

CASL applies to any commercial electronic message, a message that encourages participation in a commercial activity, sent by email, text or SMS, or through social media platforms. It applies whenever the recipient is in Canada, regardless of where the sending business is located, and it applies just as much to a Canadian business emailing its own Canadian customers.

Why it matters: many SMB marketers treat CASL as the law that governs newsletters and assume cold outbound sales email is exempt. It is not exempt. A prospecting email to a new business contact is a commercial electronic message the same as a promotional blast, and the CRTC has been auditing B2B prospecting tools specifically because this assumption is common.

04. Express Consent vs Implied Consent

Express consent means a recipient affirmatively opted in, typically by checking an unchecked box or submitting a form that clearly states what they are agreeing to receive. It does not expire on its own and does not need to be renewed unless the recipient withdraws it.

Implied consent exists without that opt-in step in two situations. The first is an existing business relationship: a purchase, lease, or contract within the past 2 years, or an inquiry that did not convert within the past 6 months. The second is contact information the recipient has conspicuously published or disclosed in a context relevant to the message, such as a business email listed on a company website, without a published statement that they do not want unsolicited messages.

Why it matters: implied consent is the trap that catches growing Canadian businesses. A customer who bought once three years ago feels like an active contact, but CASL's clock already reset that relationship to zero, and continuing to market to them without express consent is a violation even though they were, at one point, a real customer.

05. What Every CASL-Compliant Message Needs

• Sender identification. The message has to clearly identify who sent it, and any organization on whose behalf it was sent.
• Valid contact information. A mailing address plus a phone number, email address, or website, valid for at least 60 days after the message is sent.
• A working unsubscribe mechanism. No cost to the recipient, no login requirement, and honoured within 10 business days.

Why it matters: most CASL complaints trace back to a missing or broken unsubscribe link, not a legal dispute over whether consent existed. This is the mechanical checklist that is easiest to get right and most costly to get wrong.

06. Record-Keeping: Proving Consent for Three Years

CASL puts the burden of proof on the sender. A business needs to be able to show how and when consent was obtained, and what the recipient was told they were consenting to, for 3 years after the business relationship ends. For a contact who never converts, the same clock runs from the inquiry that created the implied consent.

Why it matters: a contact list with no record of how consent was captured is treated the same as a list with no consent at all if the CRTC ever investigates, regardless of how the list was actually built.

07. Enforcement in 2026: Why CRTC Audits Are Increasing

Complaint volume to the CRTC reached its highest six-month total since CASL took effect in the first half of 2025, and that enforcement attention has carried into 2026 alongside a specific shift: investigators are increasingly auditing B2B prospecting tools and cold outreach platforms, not only consumer marketing lists. Penalties can reach up to 10 million dollars CAD per violation for organizations, and up to 1 million dollars for individuals, though most enforcement action starts with a warning or an undertaking rather than a maximum fine.

Why it matters: a Canadian business scaling up outbound sales and marketing automation in 2026 is operating in a more actively enforced environment than the one it may have built its list-building habits under a few years ago.

08. Auditing Your HubSpot or Klaviyo Setup for CASL

• Audit every contact list by its consent source. Segment contacts into express consent, implied consent from a transaction, implied consent from an inquiry, and no documented consent, since each category has different rules and, for implied consent, a different expiry date.
• Replace pre-checked consent boxes with unchecked opt-ins. Shopify checkout, HubSpot forms, and Klaviyo signup flows can all default a marketing consent checkbox to checked, which does not qualify as express consent under CASL. The recipient has to take the action themselves.
• Add a consent-source and consent-date property to every contact record. A custom property in HubSpot or a consent field in Klaviyo that records how and when consent was captured is what turns a marketing list into a defensible record instead of an assumption.
• Flag implied-consent contacts approaching their expiry window. Build a HubSpot workflow or Klaviyo flow that surfaces contacts nearing the 2-year transaction window or the 6-month inquiry window, so the team can seek express consent or move them off marketing sends before the window closes, not after.
• Sync suppression and unsubscribe status across every connected tool. A contact who unsubscribes in Klaviyo but is still marketed to through a HubSpot workflow, or vice versa, is a CASL violation regardless of which system technically honoured the request.
• Test the unsubscribe link on every active template. An unsubscribe link that requires a login, takes longer than 10 business days to process, or simply breaks is treated the same as never having an unsubscribe mechanism at all.

Why it matters: neither HubSpot Marketing Hub nor Klaviyo configures CASL compliance by default. Both give a marketing team the tools to be compliant, but the consent capture, tagging, and suppression syncing have to be built deliberately, and gaps most often appear where two tools in the same stack disagree about a contact's status.

09. How AtlanticWorks Helps

AtlanticWorks builds and audits HubSpot and Klaviyo marketing operations for Atlantic Canada manufacturers, wholesalers, retailers, and DTC brands, including consent tracking, suppression list syncing across CRM and ecommerce platforms, and workflow automation that flags implied-consent contacts before their window expires. As a certified Shopify, HubSpot, Google, and Salesforce partner, we scope this around your actual contact list and sending history, not a generic checklist, and this is not a substitute for legal advice on an active complaint or investigation. You keep full ownership of everything we build. It starts with a free assessment of your current marketing consent setup.

10. Key Takeaways

• CASL is opt-in, not opt-out: consent has to exist before the first commercial email or text goes out, and it applies to B2B prospecting emails as much as consumer newsletters.
• Express consent does not expire on its own. Implied consent does: 2 years from a transaction, or 6 months from an inquiry that did not convert.
• Every commercial electronic message needs sender identification, valid contact information, and a working, free unsubscribe mechanism honoured within 10 business days.
• The burden of proof sits with the sender. A contact list with no record of how and when consent was captured is treated the same as a list with no consent at all.
• CRTC complaint volume hit its highest six-month total since CASL took effect in the first half of 2025, and enforcement is increasingly reaching B2B prospecting tools, not just consumer marketing.
• HubSpot and Klaviyo provide the building blocks for compliance, such as consent properties and suppression lists, but neither platform configures CASL compliance automatically.