Rules
Canadian Content Marketing Compliance: CASL, PIPEDA and Quebec’s French Rules
Canadian content marketing compliance runs on three regimes at once: CASL consent, PIPEDA data duties and Quebec's French-first rules. What each one asks of you.
What to take away
- Most Canadian campaigns answer to three regimes: CASL for commercial email, PIPEDA for personal information, and Quebec's French-language rules for commercial publications.
- CASL consent needs a date and a source on file, and every message needs sender identification plus a working unsubscribe.
- PIPEDA expects a stated purpose, collection limited to it, and a route for people to ask what you hold.
- Quebec's Charter reaches websites, forms and social posts, not only printed advertising.
- Breaches end at a regulator, so keep the records that show what you sent, to whom, and why.
Who has jurisdiction over a Canadian campaign
One send can sit under several regulators at once. The CRTC enforces the Canadian Anti-Spam Legislation. The Office of the Privacy Commissioner of Canada enforces PIPEDA for commercial activity. Inside Quebec, the Office quebecois de la langue francaise enforces the Charter of the French Language.
The overlap is where most out-of-country guidance stops being useful. A newsletter going to a list with Quebec subscribers touches all three areas. Provincial privacy law answers to the regulator of the province where the person lives.
| Regime | Enforcer | What it covers in a campaign |
|---|---|---|
| CASL | CRTC | Consent, sender identification and unsubscribe for commercial electronic messages |
| PIPEDA | Office of the Privacy Commissioner | Collection, use, disclosure and access to personal information |
| Quebec privacy law | Commission d'acces a l'information | Privacy duties owed to Quebec residents |
| Charter of the French Language | Office quebecois de la langue francaise | French-first commercial publications |
The Government of Canada page on CASL sets out the consent, identification and unsubscribe tests.
What a compliant disclosure contains
Sender identification means a legal name, a mailing address and a contact method that stays valid for 60 days after the send. The message states its purpose. An unsubscribe mechanism must be obvious and must take effect within 10 business days.
Consent records carry the rest. Write down how the address arrived, what the person was told, and what they agreed to receive. A tick box proves little if the form never named the sender. Teams that plan campaigns against a written set of content marketing strategy questions settle this early, because consent wording sits beside the campaign goal.
For PIPEDA, the notice states what you collect, why, how long you keep it, who receives it, and how to reach the privacy officer. The Privacy Commissioner's overview of PIPEDA covers what counts as personal information. Quebec expects French to be markedly predominant in commercial advertising, and brochures and catalogues need a French version.
Records to keep and how long
- Consent records with the date, source and the wording the person saw
- A copy of each campaign as sent, unsubscribe line included
- An unsubscribe log showing the gap between request and removal
- Privacy requests and the answer you gave
- French and English versions of every Quebec-facing asset
Keep them together. Under CASL the burden of proving consent sits with the sender, and an inbox is not an evidence file. A content audit that finds gaps is a workable way to test the records before a complaint forces the question.
What happens when a campaign breaks the rules
The CRTC can issue a notice of violation against a sender, and it has published those notices. The sender then has to answer, by contesting the finding or by complying, and the process drags the consent evidence into the open.
A complaint to the Privacy Commissioner can lead to an investigation, a published finding, and an application to the Federal Court for an order. The Office quebecois de la langue francaise can require a business to correct commercial publications that fall short.
Consent that cannot be produced on request is consent you cannot rely on.
Where the rules differ by province
Quebec is the outlier, and content teams feel it first in the publishing calendar. French first applies to forms, product pages and social posts, not only print. Quebec's privacy law also adds breach notification duties.
Elsewhere the stack is CASL plus PIPEDA, with Alberta and British Columbia running their own private-sector privacy statutes. Breach reporting thresholds differ, so one incident can trigger more than one report. Planning the content distribution schedule around the strictest province avoids a second round of approvals.
Common questions
Does CASL apply to messages sent to businesses? Yes. CASL covers commercial electronic messages sent to businesses as well as to individuals, though an existing business relationship can create implied consent for a limited period.
Can we run one consent flow for Canada and the United States? It is possible but unwise. The United States works on an opt-out model, while Canada wants documented consent before the send, plus a record of where that consent came from.
How much French does a Quebec campaign need? French has to be markedly predominant in commercial advertising, and a French version has to exist wherever the publication appears. Treat the French asset as a source file, and content repurposing becomes a planning step rather than a translation afterthought.
Who answers if a freelancer writes the email? The sender does. The account that sends the message carries the consent record, so brief freelancers on the wording and hold the sign-off in your own files.
