A Third Consent Regime North of an Already-Covered Border
CAN-SPAM and GDPR are already covered on this site as the two consent regimes a SaaS company most commonly plans around. Canada runs its own, separate law, Canada’s Anti-Spam Legislation, commonly shortened to CASL, and it does not map cleanly onto either of the other two. Treating “Canada” as a US-adjacent market with US-style rules is the mistake this guide exists to prevent.
CASL is administered by Innovation, Science and Economic Development Canada, per the Government of Canada’s own official program page, confirming the legislation’s scope and administration as a real, currently active regime, not a dated or symbolic law.
What CASL Requires Before You Send a Message
The statute’s own text, Section 6(1), states plainly: it is prohibited to send a commercial electronic message to an electronic address unless the recipient has consented to receiving it, whether that consent is express or implied. That is a default-to-no starting position, different from a regime where a lack of an opt-out is treated as tacit permission.
For a US-based SaaS company used to CAN-SPAM’s opt-out model, a message can be legal to send now and become non-compliant only if the recipient asks it to stop. CASL’s starting assumption runs the other direction: a message needs a basis for consent to exist before it is sent at all.
The Implied-Consent Exceptions, and Why They Are Narrower Than They Sound
Section 6(6) of the Act lists specific situations where implied consent exists without a prior opt-in: messages that facilitate, complete, or confirm a transaction the recipient already agreed to, warranty, recall, or safety information about a product the recipient owns, and factual notifications about an active subscription, membership, or account the recipient already holds.
Every one of those categories describes an existing, specific relationship tied to a real prior transaction. None of them cover a cold first-touch message to a prospect who has never bought anything, requested anything, or signed up for anything, which is exactly the category most outbound prospecting falls into.
How This Differs From the “Existing Business Relationship” Logic in US Compliance Content
US compliance guidance, built around CAN-SPAM, frequently references a looser “existing business relationship” concept as a reason prior outreach might be treated more permissively. CASL’s implied-consent categories, read directly from the statute, do not offer that same broad, general allowance. They tie implied consent to a specific prior transaction, a warranty or safety notice, or an active subscription relationship, not to a general sense that a company has talked to a contact before.
A US team that assumes its CAN-SPAM instincts transfer directly to CASL is applying a broader standard than the Canadian statute’s own text supports.
What CASL’s Penalty Regime Involves, and What This Guide Will Not Guess At
CASL carries administrative monetary penalties for violations, set out in a separate section of the Act from the consent requirements quoted above. This guide does not state a specific maximum penalty dollar figure. That section of the statute was not independently confirmed this session, and commonly cited figures found elsewhere should be verified directly against the Act itself before being treated as current or repeated in a sales conversation.
What is confirmed is that the penalty framework exists and that CASL is an actively administered, currently enforced law, not a dormant statute. Treat the absence of a specific number here as intentional caution, not an indication the exposure is minor.
Building a Consent Record That Would Survive a Review
Practitioner guidance: given CASL’s consent-first default, the safer operational posture for a US-based company reaching into Canada is documenting the specific basis for each contact, an active subscription relationship, a completed transaction, or express opt-in, rather than assuming a general prior-contact standard will hold up.
A simple log noting which implied-consent category, if any, applies to a given Canadian contact is a meaningfully stronger position than no documentation at all, and it costs far less than sorting out the answer after a complaint has already been filed.
Where This Fits Before You Add Canada to a Target List
None of the above is a reason to avoid the Canadian market. It is a reason to treat it as its own jurisdiction with its own consent logic, checked before a Canadian list gets the same treatment as a US one.
Human + AI SDRs can build that consent check into a Canadian outreach motion from the start, rather than discovering the gap after messages have already gone out.
What this means for you
- CASL Section 6(1) prohibits sending a commercial electronic message unless the recipient has consented, express or implied, a default-to-no starting position distinct from CAN-SPAM’s opt-out model.
- Section 6(6)’s implied-consent categories are tied to a specific prior transaction, warranty notice, or active subscription, narrower than the general “existing business relationship” concept common in US compliance content.
- This guide does not state a specific CASL penalty figure. That section of the Act was not independently confirmed this session, and any number cited elsewhere should be verified directly against the statute before being treated as current.
Sources
The external data in this guide draws on the sources below. Figures described in the text as estimates or industry triangulations are directional and are not attributed to a single dataset.
- Government of Canada, Justice Laws Website, Canada’s Anti-Spam Legislation, Section 6
- Government of Canada, Canada’s Anti-Spam Legislation program page