CASL basics for automated emails and texts

Automated follow-ups are one of the most useful things a small business can set up: a quote reminder, a check-in after a job, a monthly newsletter. In Canada, though, commercial messages you send by email or text fall under Canada's Anti-Spam Legislation, usually called CASL.

This is a practical overview for business owners setting up automation. It is not legal advice. CASL has exceptions and fine print, so confirm your specific setup with a lawyer and with the official guidance at fightspam.gc.ca and from the CRTC.

What CASL covers

CASL applies to commercial electronic messages, often shortened to CEMs. The federal government's guidance says these include emails and texts, as well as similar channels like instant messaging. Broadly, a message is commercial if one of its purposes is to encourage someone to take part in a commercial activity. A newsletter with a promotion counts. So, generally, does a text nudging someone to accept a quote before it expires.

According to the government's guidance, a commercial message generally needs three things:

• Consent from the recipient
• Clear identification of who is sending the message
• A working unsubscribe mechanism

Automation does not change these rules. It just means a mistake can repeat itself hundreds of times before anyone notices.

Express and implied consent

CASL recognizes two kinds of consent, and the difference affects how long you can keep sending.

• Express consent means the person actively agreed to receive your messages, for example by ticking an empty checkbox on your form. The government's guidance says there is no time limit on express consent unless the person withdraws it.
• Implied consent applies only in specific situations, such as an existing business relationship. It is generally time-limited. The official guidance describes up to two years for customer relationships, such as after a purchase, and up to six months after an inquiry or application.

Implied consent is a starting point, not a permanent licence. A well-built system tracks when each contact's implied consent began and asks for express consent before it runs out.

Identification and unsubscribe requirements

Every commercial message should make it clear who sent it. The government's guidance calls for:

• The name of the business sending the message, and anyone it is sent on behalf of
• A current mailing address, plus a phone number, email address or website
• Contact information that stays valid for at least 60 days after the message is sent
• An unsubscribe mechanism that is easy to use and free for the recipient

Unsubscribe requests must be acted on within 10 business days. In email, an unsubscribe link in the footer is typical. In texts, ask your SMS provider exactly how they handle opt-outs, and check that the business name and a way to unsubscribe appear in your messages.

Building CASL into your automations

The safest approach is to design consent into the system rather than bolt it on later. When we build follow-up workflows, these are the checks we put in place:

• Record consent with context: the date, the form or source, and the exact wording the person agreed to.
• Store the consent type and its expiry: tag each contact as express or implied, and note when implied consent ends.
• Sync unsubscribes across every channel, so an opt-out in your email tool also stops texts and CRM sequences.
• Separate transactional messages from promotional ones. Confirming a booked appointment is different from a sale announcement. Some message types have specific exemptions from the consent requirement, so get advice on which of yours qualify.
• Think hard before importing old or purchased lists. You need to be confident that valid consent exists for every contact.

Common mistakes to avoid

• Treating one inquiry as permanent consent and keeping someone in a sales sequence for years
• Adding every customer to a newsletter without asking
• Unsubscribe links that require a login or lead to a broken page
• Texts that do not identify the business by name
• Assuming CASL is only about email when it also covers texts

Most of these are not deliberate. They happen because a tool was set up quickly and nobody revisited the settings.

Our recommendation

Before you switch on any automated email or text sequence, write down where each contact came from and what kind of consent you have. Add a clearly worded, unchecked consent box to your forms, and test your unsubscribe process on every channel. Then have a lawyer familiar with CASL review the setup, especially if you send texts, import lists or market across borders. That review costs far less than cleaning up a problem afterward.

Written by Vishal Singh

Founder of Byte Harbor and a senior frontend and web platform engineer. He builds websites, custom software and AI automation for businesses across Canada and the US.

About Byte Harbor