Cold email in Canada: what CASL allows in 2026

Who does CASL apply to?

Canada's Anti-Spam Legislation (CASL) covers any commercial electronic message, or CEM: a message whose purpose, or one of whose purposes, is to encourage someone to buy, sell or take part in a business opportunity. A sales email, every follow-up in a sequence, a pitch in a LinkedIn message and a sales text are all CEMs.

It reaches far beyond Canadian companies. The Act applies when "a computer system located in Canada is used to send or access the electronic message" (section 12), so a team in Texas emailing a buyer in Toronto has to comply. The regulator, the CRTC, says it directly: messages "sent to recipients in Canada from another country must comply with CASL."

• Email, SMS and instant messages are covered.
• LinkedIn messages are covered. The CRTC's guidance names "Facebook Messenger and LinkedIn messaging" as messages to electronic addresses.
• Public posts are generally outside it. A one-way post or a tweet to your followers is broadcast, so CASL usually does not apply.
• Live phone calls and robocalls fall under a different regime, the CRTC's Unsolicited Telecommunications Rules and the National Do Not Call List.
• Asking for permission by email is itself a CEM. Section 1(3) treats a request for consent as a commercial message, so the classic "just one email to ask" needs a consent basis too.

Is there an exemption for B2B email?

Only a narrow one. The regulations exclude messages sent to an employee of another organization "if the organizations have a relationship and the message concerns the activities of the organization to which the message is sent." That fits suppliers, partners and customers. It does not fit cold prospecting, because a relationship between the two organizations does not exist yet.

The leading case shows how narrow it is. Compu-Finder, a Quebec company selling training courses, emailed employees at organizations where a colleague had once bought a course. The CRTC found that one purchase was "not sufficient to demonstrate that the organization had, or intended to create, a relationship" that would let the company "directly solicit every other employee." It also rejected the idea that a history of sending messages builds a relationship on its own. The penalty was $200,000, and the Federal Court of Appeal upheld the decision and the law itself in 2020.

Which consent routes work for cold B2B outreach?

Without express consent, you need one of the implied-consent routes in section 10 of the Act or the regulations. These are the ones that matter for prospecting:

Two rules sit over all of them. The sender must prove consent if challenged (section 13), so records matter as much as the outreach. And a pre-checked box never counts as express consent: the CRTC says "a default toggling state that assumes consent cannot be used as a means of obtaining express consent."

What does "conspicuously published" really mean?

This is the route most cold email relies on, and it is narrower than many teams assume. The CRTC says it "sets a higher standard than the simple public availability of electronic addresses" and "does not provide persons sending CEMs with a broad licence to contact any electronic address they find online."

• The person, or their organization, has to be the one who published it. An address on the employer's own team page can qualify.
• Copies made by others do not count on their own. If a third party reproduces an address or sells a list "on its own initiative," the CRTC says that does not create implied consent.
• It has to be findable. An address that "requires specific queries in a corporate database to be found is not conspicuously published."
• No refusal note. A line next to the address saying the person does not want unsolicited messages ends the route.
• The message must fit the role. The CRTC's own example: a training company emailing a chief operating officer about a course for administrative assistants fails; the same company emailing the marketing officer about a social media marketing course passes.

The practical consequence for data-driven teams: an email address from a data vendor is a lead to research, and consent has to come from somewhere else. If you can trace it to the person's own published page, record that page. A guessed or pattern-generated address was never published, so this route cannot apply to it.

What must every message include?

Consent is half the rule. Every CEM, including every follow-up step, also has to carry the following:

• The name you do business under, and the client's name if you send on someone else's behalf.
• A mailing address, plus a phone number, email address or web address.
• An unsubscribe that is "readily performed": simple, quick and free, by the same channel or by a link.
• Contact details and the unsubscribe have to keep working for 60 days after the message is sent.
• Unsubscribes take effect "without delay, and in any event no later than 10 business days" after the request.

For texts, where space is short, the details can sit behind a clearly shown link, and the CRTC's example of a good unsubscribe is replying "STOP" or "Unsubscribe." Separately, the Competition Act prohibits false or misleading sender information and subject lines, which is where fake "Re:" and "Fwd:" subjects get teams into trouble.

What are the penalties, and is CASL actually enforced?

The maximum administrative penalty is $1 million per violation for an individual and $10 million per violation for an organization (section 20). Directors and officers can be personally liable if they directed or went along with the violation, and an employer answers for its staff and agents. Showing that you exercised due diligence is a defence, which is another reason to keep consent and unsubscribe records.

Private lawsuits are no longer a CASL risk. The private right of action in sections 47 to 51 was suspended in 2017, never came into force, and the current consolidation of the Act shows those sections as "Repealed before coming into force," with the change dated January 1, 2026. Enforcement now sits with three agencies: the CRTC, the Competition Bureau and the Privacy Commissioner.

Enforcement against marketers is infrequent, and complaints drive it. From April to September 2025 Canadians sent 152,603 complaints to the Spam Reporting Centre, about 5,869 a week, and the CRTC says "three out of four investigations start with a report from a Canadian." In the same six months it issued 123 warning letters and one notice of violation. Low odds, high stakes: one complaint from an annoyed prospect can start the process.

How is CASL different from CAN-SPAM in the US?

Going the other way, a Canadian sender writing to US buyers can rely on an exemption in the regulations when it reasonably believes the message will be read in the US and it follows US law. The CRTC still calls it a limited exemption and recommends meeting CASL everywhere, which is the simpler policy if your lists mix both countries.

Can you text Canadian prospects?

CASL treats a sales text exactly like a sales email: consent, identification and an unsubscribe. In practice the carriers are stricter than the law. The Canadian short code rules, updated in January 2026, say "What may be allowed under CASL may not be allowed" under them, require consent before any message, require STOP (and the French ARRET) to work, and allow implied consent only with "explicit approval from the wireless carriers." Carriers also filter business texts sent from ordinary numbers heavily, which is why verified toll-free numbers are the usual route for business texting in Canada.

The working rule on both sides of the border is the same: text people who gave you their mobile number and agreed to hear from you, or who are in an active conversation with you. Keep cold outreach to email and LinkedIn, within the routes above.

A CASL checklist for B2B teams

1. Give every lead a country and a consent basis: express, inquiry (with its date), customer, published address, address given to you, referral, or none. No basis means no message.
2. For published addresses, keep the URL, a screenshot and the date, and check that the person or their employer published it.
3. Check the page for any "no solicitation" wording. If it is there, drop the lead.
4. Write one line on why your offer fits the person's role, and pitch the person who owns the problem.
5. Treat vendor data as a lead and ask your vendor where each address came from. Never use guessed addresses for Canadian leads.
6. Put your business name, mailing address and contact details in every step, plus a one-step unsubscribe.
7. Use honest sender names and subject lines.
8. Suppress anyone who opts out across every channel and every campaign, right away; the legal limit is 10 business days.
9. Track expiry: an inquiry gives you six months, a purchase or contract two years. When a prospect replies with interest, ask for express consent for ongoing messages.
10. Keep the records: consent basis, sources, message templates and unsubscribe logs. They are your due diligence defence.

Common CASL myths

What is still grey?

• How close "relevant to the role" has to be. Clear fits are safe; adjacent roles are judgement calls.
• Industry directories, conference lists and association listings. It depends on who submitted the data and the site's terms.
• Vendor addresses that trace back to the employer's own website. The CRTC says a third party's copy does not create consent on its own; relying on the original publication is untested.
• LinkedIn profiles and connection notes. There is no CRTC decision on whether a profile implies consent to receive a pitch.
• Personal addresses of sole proprietors. The "business or official capacity" wording fits them poorly.

This post is general information about Canadian law as of October 2, 2026, and it is not legal advice. For your own program, speak to a Canadian lawyer.

Where Duckrow fits

Duckrow does not decide consent for you, and no tool can. What it does is make the record-keeping and the opt-outs easier to get right:

• Your lead table can hold a consent basis, a source URL and a date as ordinary columns, so you can filter to the leads you are allowed to contact before you push them into a campaign.
• Every email carries a one-click unsubscribe header and a footer link, and an unsubscribe suppresses that address across the whole workspace.
• A STOP reply to a text opts the lead out before the next send, and texts get opt-out wording added automatically.
• Pushing leads into a campaign skips anyone who has opted out.