Cold email laws
CASL (Canada): What It Means for Cold Email
Only with consent. CASL is opt-in, but consent is implied when the person conspicuously published their work address without a no-solicitation note and your email relates to their role. The CRTC can fine a company up to CAD 10 million per violation.
Not Legal Advice
Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer.
Can You Send B2B Cold Email Under CASL?
In short Only with consent: express, or implied when the person published their work address with no no-solicitation statement and your email relates to their role; every email also needs sender details and an unsubscribe.
CASL section 6 bans sending a commercial electronic message unless the recipient consented, expressly or impliedly, and the message identifies the sender and offers an unsubscribe. It applies when a computer system in Canada is used to send or access the message (section 12(1)), so it covers senders outside Canada writing to Canadian inboxes.
For cold email, the route is implied consent under section 10(9)(b): the person conspicuously published their address, or had it published, without a statement that they do not want unsolicited messages, and your message is relevant to their business role. The CRTC calls this a higher standard than an address simply being public, and says a third party copying contact details on its own initiative does not meet it (Compliance and Enforcement Decision 2017-368).
The B2B exemption in the regulations covers only messages between organizations that already have a relationship, about the recipient organization's activities (SOR/2013-221, section 3(a)(ii)). First-touch prospecting does not fit it. Whoever claims consent has to prove it (section 13).
What Do You Need to Do Under CASL?
In short 7 rules apply to a cold email program under CASL.
| Requirement | What it means | How to do it | Section |
|---|---|---|---|
| Consent | Express or implied consent before you send. Implied consent from publication needs a conspicuous publication by the person, no no-solicitation statement and a message relevant to their role. | For each Canadian contact, store the page where the person (not a data vendor) published the address, check it has no no-solicitation note, and tie the pitch to their role. | CASL s 6(1)(a) and 10(9)(b) to (c) |
| Proof of consent | The person who claims consent has the burden of proving it. | Keep the source page, the capture date, the role and the message sent for every contact. | CASL s 13 |
| Identify the sender | Name the business sending the message, and anyone on whose behalf it is sent. | Put your trading name, and your client's name when you send for a client, in the signature or footer. | CASL s 6(2)(a); SOR/2012-36 s 2(1) |
| Contact information | Include a mailing address and a phone number, email address or web address, valid for at least 60 days after you send. | Put a real postal address and one more contact method in every email. | CASL s 6(2)(b) and 6(3); SOR/2012-36 s 2(1)(d) |
| Unsubscribe mechanism | Let people opt out at no cost, by the same electronic means, through an address or link that is set out clearly and prominently and works for at least 60 days. | Use a visible one-click link or reply-to-unsubscribe in every message, and keep links live for 60 days. | CASL s 6(2)(c) and 11(1) to (2); SOR/2012-36 s 3 |
| Honor opt-outs within 10 business days | Give effect to an unsubscribe no later than 10 business days after it is sent. | Suppress the address automatically across every sequence and mailbox. | CASL s 11(3) |
| Agencies and managers are liable too | Anyone who sends, causes or permits a message can be liable, and so can officers and directors who direct or take part in a violation. Due diligence is a defense. | Write CASL duties into agency and client contracts, and keep records of your checks. | CASL s 6(1), 31, 32 and 33 |
What Are the Penalties Under CASL?
In short Maximum penalty: CAD 10 million per violation.
| Penalty | Maximum | In USD | Section |
|---|---|---|---|
| Administrative monetary penalty per violation, companies | CAD 10,000,000 | about USD 7.1 million | CASL s 20(4) |
| Administrative monetary penalty per violation, individuals | CAD 1,000,000 | about USD 706,200 | CASL s 20(4) |
USD amounts are approximate, converted at the European Central Bank reference rates of 2026-10-16.
The CRTC enforces the message rules through notices of violation and undertakings (sections 21 and 22); penalties aim to promote compliance, not to punish (section 20(2)). Recipients cannot sue: the private right of action never came into force and was repealed on December 31, 2025. The Competition Bureau handles misleading messages and the Privacy Commissioner handles address harvesting.
What Enforcement Has There Been Under CASL?
In short 3 cases from regulator and court records, newest first.
| Date | Company | What happened | Outcome | Source |
|---|---|---|---|---|
| 2021-12-06 | Gap Inc. | The CRTC alleged it sent marketing messages for Gap, Banana Republic and Old Navy without consent or without an unsubscribe that could readily be performed. | CAD 200,000 undertaking | CRTC undertaking |
| 2017-10-19 | 3510395 Canada Inc. (Compu-Finder) | Sent training-course promotions to business addresses without consent, some with a non-working unsubscribe; the CRTC rejected its B2B exemption and published-address defenses. | CAD 200,000 penalty (reduced from CAD 1,100,000) | CRTC Decision 2017-368 |
| 2016-09-01 | Kellogg Canada Inc. | Messages were allegedly sent by Kellogg or its service providers without recipients' consent. | CAD 60,000 undertaking | CRTC undertaking |
Cold Email Checklist for CASL
- For each Canadian contact, store the page where the person published their address, and the date.
- Check that the page has no statement refusing unsolicited messages.
- Tie every email to the recipient's business role.
- Do not treat addresses copied by data vendors or directories as published by the person.
- Name your business, and the client you send for, in every email.
- Include a mailing address plus a phone number, email address or web address that stays valid for 60 days.
- Add a free, easy unsubscribe that works for 60 days, and honor it within 10 business days.
How Ken Helps
In short Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility.
- Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3).
- Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it.
- Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits.
- You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2).
- Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6).
- Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under CASL, that includes proof of express or implied consent for every Canadian contact.
FAQ
Can I cold email a Canadian prospect whose work email I found online?
Only if section 10(9)(b) is fully met: the person published the address themselves, with no statement refusing unsolicited messages, and your email is relevant to their role. The CRTC held that copies in third-party directories do not count.
Does CASL have a B2B exemption?
Only for messages between organizations that already have a relationship, where the message concerns the recipient organization's activities (SOR/2013-221, section 3(a)(ii)). First-touch cold outreach does not fit it.
Does CASL apply if I send from the US?
Yes, when a computer system in Canada is used to send or access the message (section 12(1)), which covers emails opened in Canadian inboxes.
Can recipients sue me under CASL?
No. The private right of action never came into force and was repealed on December 31, 2025. The CRTC enforces the message rules.
How fast must I process an unsubscribe under CASL?
Within 10 business days (section 11(3)), and the unsubscribe link must keep working for at least 60 days after you send (section 11(2)).
The new Ken opens to the waiting list in batches.
Related
- Cold email laws by country
All 12 laws compared
- PIPEDA: What It Means for Cold Email
Exempt if role-relevant; CASL still governs the email
- CAN-SPAM Act: What It Means for Cold Email
Allowed, opt-out
- Spam Act 2003 (Australia): What It Means for Cold Email
Consent first; inferred consent for published work addresses
- Ken anti-spam policy
Sources
Changelog
- Page published.