Is Cold Email Legal in Canada? A CASL Guide for B2B Teams (2026)

Is cold email legal in Canada? Yes, but only under much tighter conditions than in the United States. Canada's Anti-Spam Legislation (CASL) is a consent-first law. Before you send a commercial email to someone in Canada, you need their express or implied consent, and every message must identify you and include a working unsubscribe mechanism.

For B2B teams, one form of implied consent, called conspicuous publication, was written with business contacts in mind, and many U.S. teams misread it. This guide walks through what CASL actually says, with links to the statute and the regulator's guidance.

Not legal advice. This article is general information based on the text of CASL, its regulations, and published guidance from the CRTC and Innovation, Science and Economic Development Canada (ISED), current as of October 2026. It is not legal advice. Facts matter under CASL, so talk to a qualified Canadian lawyer about your specific situation.

What CASL is and when it applies

CASL is the common name for a federal statute with a very long official title, often shortened to An Act to promote the efficiency and adaptability of the Canadian economy. Its rules on commercial messages took effect on July 1, 2014. Three agencies enforce different parts of it: the Canadian Radio-television and Telecommunications Commission (CRTC), the Competition Bureau, and the Office of the Privacy Commissioner, as ISED explains on its Understanding CASL page.

For cold outreach, the section that matters is section 6. The CRTC's CASL FAQ boils it down to two tests. CASL applies when (1) you send a commercial electronic message (2) to an electronic address. If both are true, you need consent, identification information, and an unsubscribe mechanism.

What counts as a commercial electronic message (CEM)

The CRTC asks one question: is one of the purposes of the message to encourage the recipient to take part in a commercial activity? A cold email that offers your service, pitches a demo, or invites a prospect to a sales call clearly qualifies.

A logo or signature link alone does not make a message a CEM. A line promoting a product or encouraging a purchase does. In practice, assume every B2B cold email is a CEM.

What counts as an electronic address

CASL defines an electronic address as an email account, a telephone account, an instant messaging account, or any similar account. That reaches further than email. According to the CRTC FAQ, messages sent through social media messaging systems, such as LinkedIn messaging and Facebook Messenger, count as messages to electronic addresses. A public post or a general broadcast on social media usually does not.

So a LinkedIn InMail pitching a Canadian prospect is held to the same consent standard as a cold email.

Is cold email legal in Canada without permission?

Not without some form of consent. Section 6(1) of CASL prohibits sending a CEM unless the recipient "has consented to receiving it, whether the consent is express or implied." That single sentence is the biggest difference between Canada and the U.S., where CAN-SPAM lets you send the first email without consent.

So the real question is not "can I email Canada?" It is "which consent do I have for this person, and can I prove it?"

CASL consent types: express and implied

CASL recognizes two forms of consent. The CRTC's Guidance on Implied Consent covers both in plain language.

Express consent

Express consent means the person actively agreed to receive your messages, in writing or orally. It must be opt-in. The CRTC says pre-checked boxes do not count, and silence or inaction is never consent.

When you ask for express consent, the Electronic Commerce Protection Regulations (CRTC) require you to state the purpose, your business name, your mailing address plus a phone number, email or web address, and a statement that the person can withdraw consent. Express consent does not expire, though the person can withdraw it at any time.

One trap: you cannot cold email someone to ask for express consent. The CRTC states that an email requesting consent is itself a CEM. You need implied consent to send that request in the first place.

Implied consent

Section 10(9) of CASL lists the only situations where consent is implied. Three matter for B2B outreach.

1. Existing business relationship (EBR). Under section 10(10), you have an EBR when the recipient, within the two years before your message:

• bought or leased a product, service, land or interest in land from you,
• accepted a business, investment or gaming opportunity you offered,
• bartered with you, or
• had a written contract with you that is still in force or expired within that two-year window.

An inquiry or application about any of those things creates an EBR for six months. If a prospect fills out your contact form or asks for pricing, you can follow up with commercial messages for six months from that inquiry. After that, the implied consent lapses unless something new happens. For subscriptions and accounts, section 10(14) says the two-year clock starts when the subscription or account ends.

2. Conspicuous publication. Under section 10(9)(b), consent is implied when all three of these are true:

1. The person published their email address, or caused it to be published.
2. The publication is not accompanied by a statement that they do not wish to receive unsolicited commercial messages at that address.
3. Your message is relevant to their business, role, functions or duties in a business or official capacity.

Most B2B cold outreach into Canada depends on this route, and the CRTC calls it a "higher standard" than public availability. An address is conspicuously published when it is directly available to the public, typically indexed by a search engine. One found only through queries in a corporate database is not.

A third party that copies or sells addresses "on its own initiative" does not create implied consent, the CRTC says. The person or their employer must have published it. On relevance, the CRTC's example: a training company emailing a COO about an administrative assistant course cannot rely on conspicuous publication, but emailing the marketing officer about a social media marketing course could.

3. Disclosed address, including business cards. Section 10(9)(c) covers addresses the person gave you directly. The CRTC's business card example says you may have implied consent if your message relates to the person's role, functions or duties in a business capacity, and they did not say when handing you the card that they do not want promotional messages at that address.

These two categories have no two-year or six-month clock in the Act, so the conditions need to hold each time you send. If a prospect changes roles, or a "no solicitations" line appears next to their address, your basis can disappear.

Narrow exemptions that rarely help cold outreach

• The B2B exemption. The Electronic Commerce Protection Regulations exempt messages between employees or representatives of two organizations, but only if the organizations already have a relationship and the message concerns the recipient organization's activities. The CRTC says the focus "is on relationships between organizations." A brand-new prospect has no relationship with you, so true cold outreach does not qualify.
• The referral exemption. You can send one CEM without consent after a referral, if the referrer has a qualifying relationship with both you and the recipient, and your message names the referrer in full and states that it follows a referral. Only one message is allowed. After that, you need consent.

Identification and unsubscribe requirements

Section 6(2) dictates what each message must contain.

Identification information

Section 2 of the CRTC regulations requires every CEM to include:

• the name you carry on business under, or your own name,
• if you send on behalf of someone else, their business name too, plus a statement of who is sending and on whose behalf,
• a mailing address, and
• a telephone number with access to an agent or voicemail, an email address, or a web address.

Section 6(3) of the Act says this contact information must stay valid for at least 60 days after you send. The CRTC FAQ confirms you do not need to publish a home address. A P.O. box or other valid mailing address works, as long as you can be reached there.

This matters if you use an agency. The CRTC says anyone with a material role in the content or the choice of recipients must be identified. A platform that only delivers mail need not be named. An agency that writes copy and picks the list likely must be, alongside the client.

Unsubscribe mechanism

Section 11 of CASL and section 3 of the regulations set the rules:

• The recipient must be able to opt out at no cost, using the same electronic means you used, or another electronic means if that is not practicable.
• You must provide an email address or a web link where the request can be sent.
• The mechanism must be set out clearly and prominently and be "readily performed." The CRTC gives a six-step login-to-unsubscribe flow as an example of a non-compliant mechanism.
• The unsubscribe address or page must stay valid for at least 60 days after sending.
• Requests must take effect "without delay, and in any event no later than 10 business days" after they are sent, with no further action required from the recipient.

The CRTC adds that a request to stop sent "by another form of communication," such as a reply, must also be respected within 10 business days.

Record keeping: the burden of proof is on you

Section 13 of CASL is short and unforgiving: a person who claims consent "has the onus of proving it." If the CRTC asks why you emailed a Canadian prospect, it is your job to show the basis.

For conspicuous publication, the CRTC FAQ lists the supporting information you should keep:

1. where or how you found the address,
2. when you obtained it,
3. whether the publication was conspicuous,
4. whether a "no unsolicited messages" statement accompanied it, and
5. how you decided your message was relevant to the recipient's role.

The CRTC's implied consent guidance suggests screenshots or a contemporaneous record showing the date, the email address and the URL. It also says that if you buy or rent a list, you are still the sender and still have to prove consent, so take "all reasonable steps" to confirm the list meets CASL's requirements. A vendor's "CASL compliant" badge does not shift the onus.

The law sets no retention period. The CRTC says to keep consent records as long as you rely on them, along with unsubscribe logs and written policies, which also support the due diligence defense in section 33.

CASL penalties, enforcement and the private right of action

Section 20(4) caps administrative monetary penalties (AMPs) at C$1,000,000 per violation for an individual and C$10,000,000 per violation for any other person, such as a corporation. Factors include the scope of the violation, past history, financial benefit and ability to pay.

The CRTC's enforcement report for October 2020 to March 2021 describes a C$75,000 penalty against an individual who sent more than 670,000 emails without consent. The same report notes that the Federal Court of Appeal upheld CASL's constitutionality in a case involving a training company found to have sent 317 messages without consent or a working unsubscribe mechanism, and that the Supreme Court of Canada declined to hear the appeal.

Other tools include warning letters, undertakings and notices of violation. Section 23 allows proceedings up to three years after the CRTC learns of a violation.

Is the private right of action in force?

No. CASL originally included a private right of action that would have let individuals and companies sue senders for violations. It was scheduled to start on July 1, 2017, but the government suspended it in June 2017. The current consolidated Act on the Justice Laws website now lists sections 47 to 51, the private right of action, as "repealed before coming into force." Today, enforcement runs through the regulators, not class actions.

Who is liable

Liability under CASL reaches past the person who clicks send:

• Anyone who sends, causes or permits a message to be sent is covered by section 6(1). That includes the company whose product is promoted.
• Directors and officers are personally liable under section 31 if they directed, authorized, assented to, acquiesced in or participated in the violation.
• Employers are liable for employees and agents acting within the scope of their roles under section 32.
• Anyone who aids a violation can be liable under section 9. The CRTC says businesses using third parties to market on their behalf should have written contracts and compliance policies in place.

If an agency sends for you, both of you can be on the hook.

Does CASL apply to U.S. companies emailing Canada?

Yes. Section 12(1) says a person contravenes section 6 if a computer system located in Canada is used to send or access the message. The CRTC FAQ states it directly: CEMs sent to recipients in Canada from another country must comply with CASL.

A U.S. company emailing a Toronto prospect is covered when the prospect opens the email in Canada. Your U.S. compliance work under CAN-SPAM, which we cover in our guide to U.S. cold email law, is a starting point but not enough.

CASL vs CAN-SPAM: side-by-side comparison

Here is how Canada's law compares with the U.S. rules described in the FTC's CAN-SPAM compliance guide.

The short version: CAN-SPAM regulates how you email. CASL also regulates whether you may email at all.

CASL compliance checklist for B2B cold outreach into Canada

This is the process we would follow before adding any Canadian contact to a sequence.

1. Flag Canadian contacts. Route any lead with a Canadian location into a separate CASL review.
2. Pick a consent basis for each contact. Express, EBR (with the date), conspicuous publication, or disclosed address. If you cannot name one, the contact does not get emailed.
3. Source addresses from the person's own publications. Team pages, press releases and bios the person or employer published, not a third-party list alone.
4. Check for "no solicitation" statements near the address.
5. Capture evidence. Save a screenshot or record with the URL, the address and the capture date.
6. Match the message to the role. Write down why your offer is relevant to this person's job. Pitch HR software to the head of people, not the CFO's assistant.
7. Add full identification. Your business name, a mailing address, and a phone, email or web address. If an agency sends for you, name both parties and say who is sending on whose behalf.
8. Include a clear, one-step unsubscribe. A plain link or "reply to unsubscribe" line, valid for at least 60 days.
9. Process opt-outs fast. The legal ceiling is 10 business days. Aim for same day, and treat any reply asking to stop as an opt-out.
10. Maintain a global suppression list. One list that covers every campaign, inbox and domain, owned by you, not your vendor.
11. Track EBR expiry dates. Six months for inquiries, two years for purchases and contracts. Remove contacts when the clock runs out unless you have obtained express consent.
12. Put it in writing. A short CASL policy and agency contract terms on consent and opt-outs support a due diligence defense.

Common CASL myths

Myth 1: "B2B email is exempt from CASL."

Only when the two organizations already have a relationship. Cold outreach to a new prospect does not meet that test.

Myth 2: "If the email address is online, I can use it."

The CRTC says conspicuous publication does not give senders "a broad licence to contact any electronic address they find online." The person must have published it, there must be no "no solicitation" statement, and your message must fit their role.

Myth 3: "We're a U.S. company, so CASL doesn't apply."

If your prospect reads the message in Canada, section 12 says CASL applies.

Myth 4: "I'll just send one email asking for permission."

A consent request is itself a CEM. Without implied consent, that first email already breaks the rule. The same logic covers LinkedIn: the CRTC names LinkedIn messaging as sending to an electronic address.

How we approach Canada in practice

We keep Canadian contacts out of default U.S. campaigns. When a client wants Canadian pipeline, the work shifts from volume to documentation: smaller, role-matched lists built from prospects' own published details, with evidence captured at the source. You can see how that fits our wider workflow on our 4-step outreach process page, and how we handle the market on our B2B appointment setting in Canada page.

CASL-safe lists are smaller and slower to build. But the habits CASL forces, like verified lists, role relevance and fast opt-outs, also drive replies: our agency client campaign from June 1 to October 19, 2026 produced 2,429 replies from 82,671 emails with a 1.64% bounce rate. See the live dashboards on our results page.

Frequently asked questions

Is cold email legal in Canada for B2B?

Yes, if you have consent. For B2B cold outreach, that usually means implied consent through conspicuous publication: the prospect or their employer published the address, there is no statement refusing unsolicited messages, and your offer is relevant to their role. Every message also needs full sender identification and an unsubscribe mechanism. Without a valid consent basis, a cold email to a Canadian contact breaks CASL.

Does CASL apply to U.S. companies?

Yes. CASL applies when a computer system in Canada is used to send or access the message, and the CRTC says messages sent to recipients in Canada from other countries must comply. A U.S. sender emailing a prospect who reads the message in Canada needs consent, identification information and a working unsubscribe mechanism, just like a Canadian sender.

How long does implied consent last under CASL?

It depends on the type. An existing business relationship from a purchase, lease, accepted opportunity or written contract lasts two years. An inquiry or application lasts six months. Conspicuous publication and addresses disclosed directly, such as on a business card, have no fixed clock in the Act, but the conditions, including relevance to the person's role, must hold whenever you send.

How fast must I process an unsubscribe under CASL?

Without delay, and no later than 10 business days after the request is sent. The unsubscribe link or address must stay valid for at least 60 days after your message, must cost the recipient nothing, and must be readily performed. The CRTC says a multi-step flow that forces people to log in before unsubscribing is not compliant.

What are the penalties for violating CASL?

The CRTC can impose administrative monetary penalties of up to C$1 million per violation for individuals and C$10 million per violation for businesses. Amounts depend on factors such as the scope of the violation, past history, financial benefit and ability to pay. Directors and officers can be personally liable, and employers are liable for employees and agents acting within their roles.

Can people sue me under CASL?

Not today. CASL's private right of action would have allowed lawsuits for violations, but the government suspended it in June 2017, shortly before it was due to take effect. The consolidated Act now lists those sections as repealed before coming into force. Enforcement comes from the CRTC, the Competition Bureau and the Privacy Commissioner instead.

Can I buy an email list for Canadian outreach?

You can, but the purchase does not give you consent. The CRTC says a third party copying or selling addresses on its own initiative does not create implied consent, and you, as the sender, must still prove consent for every contact. If you use a list, verify where each address was published and keep evidence before sending anything.

About the authors

Syed Asim Hussain and Syed Ali Hassan run WayneFlow, a done-for-you B2B appointment setting agency for U.S. companies. Every number in this guide comes from campaigns we ran ourselves or from the sources linked. See our live dashboards.