How Canadian content teams meet CASL consent and unsubscribe rules

What to take away

• CASL compliance for content marketers turns on four things: the right consent category, sender identification, a working unsubscribe, and a three-year record.
• Express consent is the durable option. Implied consent has an expiry date, and Canadian lists decay quietly because of it.
• Every commercial electronic message needs accurate sender identification and a working unsubscribe mechanism, not just a footer link.
• The three-year record-keeping obligation is where most teams are weakest. A log that cannot show when and how consent was given is not a defence.
• CRTC and Competition Bureau guidance should shape the wording you publish, not sit in a folder nobody opens.
• Build consent capture and expiry dates into the editorial calendar so requalification is scheduled work, not a panic.

Express and implied consent under CASL: which category your campaign uses

CASL divides permission into two categories. Express consent is given directly, usually through a sign-up form, a checkbox, or a written request. Implied consent is inferred from a relationship or from conduct. The two carry different lifespans, and mixing them up is the most common source of trouble on Canadian lists.

Express consent under CASL has no fixed expiry. It lasts until the person withdraws it. That is the category worth building campaigns on, because it survives a rebrand, a list migration, and a quiet year. It also demands that you can prove it, which is a records problem, not a copy problem.

Implied consent under CASL comes in a few recognized forms. If someone has bought something from you in the past two years, you can generally rely on implied consent. If they have made an inquiry or applied for something in the past six months, the same applies. Business relationships and conspicuously published addresses can also support it, with conditions.

The distinction matters for planning. A list built on implied consent is a list with a countdown running. A list built on express consent is an asset. Most campaigns use both at once, which is why the categories belong in your campaign brief rather than in a legal memo nobody reads.

Geography adds a layer. Provincial privacy law sits alongside the federal regime, and Quebec's French language rules affect how consent language is presented to that market. Teams working across Ontario, Quebec, British Columbia and Alberta need one consent standard that clears every province, not a patchwork.

The practical reference for how these regimes stack is the Office of the Privacy Commissioner's summary of privacy laws in Canada.

A note on sourcing. Buying or scraping addresses and calling it consent is not a consent category. It is a complaint waiting to happen, and one of the fastest ways to lose a sending domain.

Teams that have done it should read up on whether a common content marketing strategy questions discussion can ever carry a campaign.

Sender identification and unsubscribe mechanics in every message

Every commercial electronic message sent from Canada or received in Canada has to identify the sender. The requirement is specific. The message must set out the sender's name, the name of the person or business on whose behalf it is sent if different, and a mailing address.

A postal address is not optional. A PO box or a business address both work. What does not work is a footer that names a brand with no physical address anywhere in the message.

Contact information must also be included. A phone number, an email address, or a web address is acceptable. The point is that a recipient can reach the sender without hunting. On a newsletter, that usually means a line in the footer with the sender's name, address, and a monitored contact route.

Unsubscribe mechanics are governed by the Electronic Commerce Protection Regulations. The mechanism has to be able to perform its function, and it has to be set out clearly and prominently in the message. The Electronic Commerce Protection Regulations spell out the form and function requirements that content teams should read before designing a footer.

The mechanics are stricter than many publishers assume. The unsubscribe must work without requiring the recipient to log in, pay a fee, or provide information beyond an address. It has to remain live for at least 60 days after the message is sent. A request must be honoured within 10 business days, without further messages.

That 10-day window catches teams who batch unsubscribes weekly. If your process runs on a Monday cron job and a request lands on Tuesday, you are within the window. If it runs on a monthly cleanup, you are not. The fix is a suppression list that updates on receipt, not on schedule.

A single-click link is the safest design. A preference centre is fine as an option, but the plain unsubscribe path has to exist and work on its own. If a recipient can only reduce frequency rather than stop messages, that is not an unsubscribe mechanism.

The statutory basis for all of this sits in the Canadian anti-spam legislation, which covers consent, identification, and unsubscribe duties together. Reading the sections on identification and unsubscribe before you brief a designer is worth the hour.

Consumer-facing obligations also touch marketing practice more broadly. The federal government's consumer affairs guidance is a useful plain-language reference when a client or stakeholder questions why the footer looks the way it does.

The three-year record-keeping obligation and a defensible consent log

CASL requires that consent be recorded. The three-year record-keeping obligation means you keep evidence of consent for three years after it was obtained, and evidence of unsubscribe requests for three years after they were honoured.

This is the part teams underestimate. A CRM flag that says subscribed is not a record. A record shows who consented, when, how, and to what. If the CRTC asks, a flag with no provenance is close to worthless.

A defensible consent log contains a defined set of fields. Build it once and every capture point writes to it.

• The email address or phone number that consented
• The date and time of consent, with time zone
• The method: which form, landing page, event sign-up, or paper card
• The exact consent wording the person saw, including any checkbox text
• The source URL or campaign identifier
• The IP address and user agent where the consent was captured online
• The consent category, express or implied, and any expiry date attached to it

That last field is the one that keeps lists clean. If you store an expiry date for every implied consent record, your requalification campaign writes itself. You know who is about to lapse and when.

Unsubscribe records need the same discipline. Store the request date, the channel it came through, the date it was actioned, and confirmation that the address was added to a suppression list. If someone resubscribes later, that is a new consent event with its own record.

Retention is not forever. Three years is the floor for the consent and unsubscribe evidence. Keep it longer only if another obligation or a contract requires it, and say so in your retention policy. Keeping everything indefinitely creates its own exposure under privacy law.

The Office of the Privacy Commissioner publishes a privacy guide for businesses that covers consent records, opt-outs and unsubscribe handling in practical terms. It is a good companion to your CASL log design, because the two regimes are assessed together in practice.

How CRTC and Competition Bureau guidance shape consent language

The CRTC enforces CASL's consent, identification and unsubscribe provisions. Its guidance is where you find the regulator's reading of what counts as clear consent language and what does not.

The Competition Bureau's interest is different. It looks at the truth of marketing claims, including the claims in your subject lines, landing pages and consent prompts. A consent form that overstates what someone is signing up for can draw attention from both regulators.

In practice, that means consent language should be plain, specific, and honest about frequency and content. Say what someone will receive, roughly how often, and that they can stop at any time. Avoid pre-checked boxes, bundled consent, and wording that hides the commercial purpose.

CRTC guidance also shapes unsubscribe design. The regulator has been clear that the mechanism must be simple and must not create barriers. Anything that asks a recipient to call a number, mail a letter, or complete a survey before leaving is a problem.

Competition Bureau guidance shapes claims in the message itself. If a newsletter promotes a discount, the conditions should be visible, not buried. The same standard applies to the consent prompt that got the person onto the list.

For teams publishing across provinces, one more source matters. Provincial privacy commissioners, notably in Quebec, Alberta and British Columbia, have their own expectations about consent and marketing. A single national standard that meets the strictest of them saves you from maintaining separate lists. This is the ground covered in more detail by Canadian content marketing compliance.

Building a CASL consent checklist into your editorial calendar

Compliance fails when it is a project. It holds when it is a recurring item in the calendar. The editorial calendar already governs what gets published and when, so consent work belongs there too.

Treat consent capture as a content asset. The sign-up page, the checkbox wording, and the confirmation email are all editorial. They deserve a brief, a review, and a version history like any other page.

1. Audit every capture point and list the consent category it produces.
2. Rewrite consent wording so it names the sender, the content, and the unsubscribe right.
3. Tag every new record with source, date, category and expiry where relevant.
4. Schedule a monthly suppression list reconciliation against your sending platform.
5. Run a quarterly requalification campaign for records approaching implied consent expiry.
6. Review sender identification and unsubscribe links across all templates each quarter.
7. Log the review itself, with the date and the person who signed off.

Step five is the one that pays for the rest. A requalification email that asks a lapsed contact to confirm they still want to hear from you converts some of them to express consent and cleans out the rest. It is also a legitimate reason to send a message.

A content creation workflows page is a natural home for these items. If your promotion process already has a pre-send review, add consent category, sender identification and unsubscribe testing to it. Nothing new gets built, and nothing ships unchecked.

Calendar hygiene matters too. Note the 60-day minimum life of an unsubscribe link and the 10-business-day response window as recurring checks. Note the three-year retention clock on every consent record. These are dates, and dates belong in a calendar.

Digital accessibility is worth folding in at the same time. The Accessible Canada Act sets expectations for federally regulated digital services, and accessible email templates tend to have cleaner unsubscribe links and clearer consent text. It is a small addition to the same review.

When implied consent expires and how to requalify a Canadian list

Implied consent expires. Purchase-based implied consent generally runs two years from the transaction. Inquiry-based implied consent generally runs six months from the inquiry. When the clock runs out, the address is no longer mailable under that basis.

The trap is that nothing tells you. The contact stays in the platform, the segment still counts them, and the next campaign goes out. Complaint rates rise, deliverability falls, and the cause is invisible until someone checks the dates.

Requalification is the fix. Send a clear message asking the person to confirm they want to keep hearing from you. Make the confirmation a single action. Record the result as a new consent event with its own date, source and wording.

Timing matters. Start the requalification sequence before the implied consent period ends, not after. Once it has lapsed, you are sending without a basis, which is the thing you are trying to avoid.

A simple sequence works. One clear request, one reminder, then a final notice that the contact will be removed. If there is no response, remove them from active sending and keep the record. Suppression is not deletion, and you still need the record for the retention period.

Segment by province when the content differs. Quebec audiences need French language treatment under the Charter of the French Language, and Bill 96 has tightened expectations there. Teams that publish English-only requalification messages to Quebec lists are creating a separate problem while solving the first one.

Expect the list to shrink. A 20 to 40 per cent reduction after a full requalification is normal for older lists, and the remaining names are worth more. Smaller, consented, engaged lists outperform large lists padded with expired records.

For teams weighing whether a campaign is worth the send, the content promotion guide covers how to judge audience quality against effort. The editorial calendar tools for distributed teams page is a useful check when a stakeholder pushes back on list reduction.

Common questions

Does express consent ever expire under CASL? No fixed expiry. Express consent lasts until the person withdraws it, which is why it is the category worth building on.

How long do we keep consent records? Three years from when consent was obtained, and three years from when an unsubscribe request was honoured.

Can we email someone who bought from us last year? Usually yes, under implied consent, but the clock runs from the transaction and the record needs a date attached.

What must every commercial electronic message include? Sender name, mailing address, a contact method, and a working unsubscribe mechanism that stays live for at least 60 days.

How fast must an unsubscribe be processed? Within 10 business days, with no further messages after that.

Does CASL apply to B2B email? Yes. Business recipients are covered, though conspicuously published business addresses can support implied consent under conditions.