Is Cold Email Legal in Canada? What CASL Allows for B2B

A Canadian training company backed its emails with links showing where it found each address online. It lost anyway. The penalty was $200,000.

For cold email to a stranger at a Canadian business, CASL generally requires three things you can prove: the person published the address, didn't say "no solicitations", and your email fits their job.

This is general information, not legal advice. CASL cases turn on facts, so have a Canadian lawyer look at your setup before you build a campaign on it.

Most guides stop at "published address plus relevance", and some say a directory listing is enough. The Canadian decisions are stricter. An address you found is not an address the person published. The regulator calls the rule "a higher standard than the simple public availability" of an address (CRTC Decision 2016-428, para 26).

Here's the line I'd tape to the wall. Under CASL, a findable address is not a permitted address. An email finder hands you the address. It doesn't hand you the proof.

To see how far the published-address rule reaches, we checked 265 Canadian company websites. Of the 174 we could read, only 10% published even one named person's email address.

Does CASL apply if my company isn't in Canada?

CASL applies when the person reads your email in Canada. Section 12(1) of Canada's Anti-Spam Legislation covers a message when "a computer system located in Canada is used to send or access" it (checked October 2026). The CRTC, the Canadian regulator that enforces CASL's email rules, says in its CASL FAQ that messages sent to Canada from another country must comply. In 2019 it confirmed a $100,000 penalty against the CEO of nCrowd, Inc. personally. nCrowd was a US company with a Canadian subsidiary (CRTC notice).

Most teams never decide to email Canada. Canada leaks into the list. A filter set to "North America" does it. So does a US company with a Toronto office, or a VP who works remotely from Vancouver. The real risk isn't a Canada campaign. It's a US campaign with a few hundred Canadians nobody looked at.

What does the conspicuous publication rule actually allow?

The conspicuous publication rule, CASL section 10(9)(b), implies consent only when three things are true at once:

The CRTC's own example is the clearest. A company lists its COO and its marketing officer on its website. Pitching an e-marketing course to the marketing officer is fine. Pitching an admin-assistant course to the COO is not, because it has nothing to do with the COO's job (CRTC guidance on implied consent, checked October 2026).

Shared inboxes get no free pass either. An email to info@ "must still concern the business or functions of that company" (Decision 2017-368, para 72).

The conspicuous publication rule is a narrow door, not a hallway.

Does an address from an email finder or a bought list count?

An address from an email finder or a bought list doesn't count on its own. The CRTC has said so twice, and the Federal Court of Appeal agreed.

• Blackstone Learning (2016). It sent 385,668 emails, mostly to government staff, and argued the addresses were publicly available. It couldn't say "where or how it discovered" them (Decision 2016-428, para 30). A list that a third party copies or sells "on its own initiative" does "not create implied consent on its own" (para 27).
• Compu-Finder (2017). It pointed to directory pages as proof. The CRTC said the rule is no "broad licence ... to contact any electronic address found online" and found no email that met all three tests (Decision 2017-368, paras 67 and 73). The Federal Court of Appeal upheld that in 2020.

Compu-Finder is the training company from the top of this page. On appeal it pointed to its table, which put a link beside each address (2020 FCA 103, para 248). Some links led to directory sites that appeared to copy addresses from other pages (Decision 2017-368, para 68). The court said the law "would not countenance the mining of email addresses from third-party directory websites" (para 249).

That's the trap with modern tools. Some email finders show a source link next to an address. A source link tells you where a tool saw the address. It doesn't tell you who published it.

For bought lists, the CRTC says the sender "must still be able to prove that consent was implied" (CRTC guidance).

Most B2B outbound gets its addresses from email finders, which work out an address from a name and a company domain. We compare them in our B2B email finder guide. A finder answers "is this address real?" CASL asks "did this person publish it, and can you show where?" My reading is that a finder address can still qualify if you trace it back to a page where the person or their employer published it, and you save that page.

How often do Canadian companies publish a named person's email?

We wanted a number, not a guess. On October 9, 2026, we checked 265 Canadian company websites. The first 105 were startups, every active, non-consumer Y Combinator company listing a Canadian location. The other 160 were established businesses picked at random from Wikidata, a public database. A script read each homepage plus up to 14 contact, about, team and press pages, and pulled every address on the company's own domain. We hand-checked every address that looked like a person's. The script couldn't read 91 of the sites, many of them big companies behind bot protection, so treat the established number as a rough guide.

Source: Kenso site check of Canadian company websites, October 9, 2026, n = 174 readable sites (93 startups, 81 established). Bars show 95% confidence intervals.

Only 18 of the 174 readable sites, about 10% (95% CI 7-16%), published even one named person's email address. Startups came in at 8% and established firms at 14%, and the two intervals overlap. Most sites offered a shared inbox like info@ instead, and 36% had no email address anywhere we looked.

Sites that did name people usually named one to three. And 5 of the 11 established firms listed only press or investor-relations contacts. A publicist's address won't carry a software pitch past test 3. Take those five out and it's 13 of 174 sites, about 7%.

We found no "don't send us unsolicited email" notice next to any address, so test 2 rarely trips you up on a company site. Tests 1 and 3 do.

Now compare that with a cold list. Email finders are built to return one person's address, like jane@ or jane.doe@, not info@. That's the whole point of them. You email people, not inboxes.

So a cold list is almost all named people, and 9 in 10 Canadian company sites never publish one. People also publish addresses in press releases, speaker bios and association directories, which our check didn't cover. Even so, for most of a typical list, the published-address door is closed or hard to prove.

What other doors does CASL leave open?

CASL has other ways in, but most need a relationship first. All of these come from the Act or the Electronic Commerce Protection Regulations (checked October 2026).

If you rely on consent or a referral, every email still needs who you are, a mailing address, a way to reach you, and an unsubscribe you honor within 10 business days (CASL s.6(2) and s.11(3), plus the CRTC's identification rules, s.2). The business-to-business exemption lifts those rules too, but it doesn't reach strangers anyway. Our opt-out rules comparison covers that part across CAN-SPAM, CASL and GDPR.

What records should I keep for Canadian contacts?

Under CASL, the sender has "the onus of proving" consent (s.13). The record is your whole defense.

To show a page had no "no solicitations" note, the CRTC suggests "screenshots or ... a contemporaneous record of the publication where the address was listed, including information such as the date, email address and URL" (CRTC guidance). Add the role and why your email fits it, as the appeal court asked (2020 FCA 103, para 255). Blackstone had none of this.

CASL sets no fixed retention period. The CRTC says "there is no prescribed period in the legislation" (CRTC FAQ). But the CRTC can start a case up to three years after it learns of a violation (s.23). My rule of thumb is to keep records for as long as you email the person, plus at least three years.

Written records help a second way. CASL lets a sender avoid liability by showing due diligence (s.33), and the CRTC FAQ says documented, consistent record keeping "may support" that defense.

What are the penalties, and how often does the CRTC enforce?

CASL penalties reach $1 million per violation for an individual and $10 million for a company (s.20(4)). Directors and officers can be personally liable if they directed or went along with the violation (s.31), and a company answers for its employees and agents (s.32). The private right of action, which would have let people sue senders directly, never took effect. The current Act lists those sections as repealed (checked October 2026).

The odds of enforcement are low. The odds of complaints are not.

Source: CRTC semi-annual CASL enforcement reports, April 2018 to September 2025, n = 15 reports. Complaint totals before October 2021 are the reported weekly rate times 26.

Across those 15 reports, Canadians filed about 2.5 million spam complaints. The CRTC issued 21 notices of violation (its formal penalty notices) or undertakings (settlements where a company agrees to pay or fix things). That's about one for every 120,000 complaints. I still wouldn't call that "no risk", for two reasons.

1. Complaints start most cases. "Three out of four investigations start with a report from a Canadian" (CRTC report, April to September 2025). In November 2024 the CRTC focused on about 25 companies with "a noticeably higher number of complaints" (October 2024 to March 2025 report).
2. B2B email draws complaints. "Business to Business" was a top-five category of commercial spam reported through the CRTC's online form in eight reports in a row, April 2021 to March 2025, and second in five of them. The form is a small slice of all complaints (about 2% in 2025), so treat it as a signal, not a census.

The odds are low and the cost is high. And the two B2B decisions at the top of that table look a lot like modern cold email.

So what would I do with Canadian contacts?

1. Tag country before you send. Check where the person is and where the company is. Canada hides inside US lists.
2. Name the door for each Canadian contact. Published address, business card, referral, existing customer or express consent. If you can't name one, you don't have one.
3. Save the proof for published addresses. Keep the page, the date, the role and why your email fits. No proof, no send.
4. Cut the rest, or switch channels. A call, an event or a warm intro can start the relationship that email can't.
5. Keep identification and a working unsubscribe in every email.

If Canada is a small slice of your list, the cheapest compliance move is usually deleting that slice. If Canada is your market, build the list around the published-address rule from day one and have a Canadian lawyer review it.

Frequently asked questions

Is B2B email exempt from CASL?

Only between organizations that already have a relationship, and only when the email concerns the recipient's activities (Regulations s.3(a)(ii)). Compu-Finder tried the B2B exemption and lost, partly because its emails didn't discuss the recipients' own activities (Decision 2017-368, paras 52 and 56).

Can I send one email asking for permission?

Not to a stranger. An email asking for consent is itself a commercial electronic message (s.1(3)), so it needs implied consent or an exemption too. Ask in person, by phone or at an event.

Does CASL apply to LinkedIn messages?

Yes for direct messages. The CRTC's FAQ says messages sent through a social media messaging system, "e.g., Facebook Messenger and LinkedIn messaging", go to "electronic addresses", so CASL applies. Public posts generally don't count (CRTC FAQ). For how the two channels fit together, see LinkedIn vs cold email.

Can I spot Canadians by a .ca email domain?

Not reliably. Of the 265 Canadian company websites in our site check, only 20% were on a .ca domain and 65% were on .com. Among the startups, just 8% used .ca. A company's email addresses usually share its website's domain, so check the person's location and the company's country instead.

How long does implied consent last?

An existing business relationship lasts 2 years from a purchase or 6 months from an inquiry (s.10(10)). Conspicuous publication has no clock in the Act, but you must be able to show the conditions were met, so I'd re-check the page before each new campaign. Express consent doesn't expire until the person withdraws it (CRTC FAQ).

The short version

Canada isn't off-limits for cold email. It's a country where "I found it online" is not an answer. Kenso runs cold email and LinkedIn outreach for B2B companies, done for you, on infrastructure we own, with human copywriters and a human approving before anything sends. If you want to see that on your market, your first campaign is free.