Skip to main content

​
CASL (Canada’s Anti-Spam Legislation) for Commercial Email

Canada’s Anti-Spam Legislation (S.C. 2010, c. 23, enforced by the CRTC) governs commercial electronic messages — including email — sent to Canadian recipients. Unlike the US CAN-SPAM opt-out model, CASL is largely an opt-in statute: you need consent before you send, and the consent has to be documented. CASL came into force on 1 July 2014; the enforcement and private-right-of-action phases are CRTC matters, so check current guidance on fightspam.gc.ca alongside your own counsel. CASL is a tenant-owned burden. Orbit never mandates your posture — it gives you the send surfaces (sender domains, templates, headers), the consent ledger, and the suppression layer. This page maps each CASL obligation to the Orbit surface you already have so your reviewers can close the gaps deliberately before you send to Canadian recipients.
This page is documentation, not legal advice. CASL carries administrative monetary penalties and a private right of action; have counsel review your consent capture, identification text, and unsubscribe mechanics. Orbit supplies the record-keeping and suppression surfaces — the legal posture is yours.

​
What CASL actually requires

The statute’s core duties for a commercial electronic message:
  1. Consent — the recipient must have given express consent, or fall under one of the statute’s implied consent categories (existing business relationship, conspicuously published address relevant to the relationship, a few narrow carve-outs).
  2. Identification — the message must identify the sender and the person on whose behalf it is sent, with a valid postal address (or, where the addressee can reach you, a readily reachable electronic address).
  3. Unsubscribe — the message must carry an unsubscribe mechanism that is readily performed and remains valid for at least 60 days after the message is sent.
  4. Record-keeping — a three-year record-keeping duty on consent evidence; a CRTC audit asks for the record, not for your recollection.
The implied-consent categories are where most operators get this wrong: a customer who bought from you is in an existing business relationship, but that implied consent expires (generally two years after the last transaction for purchases, six months after an inquiry). Track the tier on your consent records, or you cannot tell a CRTC auditor whether a given recipient was implied or express.
CAN-SPAM in the US lets you send until the recipient opts out. CASL in Canada requires consent before you send. Map that difference to the two relevant Orbit surfaces: The scope decision matters more under CASL than it does under CAN-SPAM: a Canadian recipient’s unsubscribe click defaults to scope email (everything on Opt-Out & Suppression Lists applies), but because consent is opt-in, many operators route Canadian opt-outs through the Consent API with scope all so the revocation propagates to SMS and voice too. Pick your scope deliberately — the defaults are per-entry-point, not per-jurisdiction.

​
Identification requirements

CASL s.6(1) requires the message to identify the sender and to carry a valid postal address (or a reachable electronic one). Orbit’s side of this maps the way CAN-SPAM’s header-integrity requirement maps: Domain verification is a deliverability gate, not a statutory one — but it is what gives the recipient and the CRTC a verifiable true-origin header, which is the substance CASL’s identification clause asks for.

​
Unsubscribe mechanism

CASL s.6(2) requires an unsubscribe mechanism that is readily performed and stays valid for at least 60 days. Two shipped Orbit surfaces satisfy this by construction, and either can carry the burden:
  • List-Unsubscribe headers — every outbound email carries the List-Unsubscribe / List-Unsubscribe-Post pair for RFC 8058 one-click unsubscribe, plus an in-body unsubscribe link. A click or a provider POST writes an email-scope suppression row and an email.unsubscribed audit event — silent, no login wall. (full header behavior)
  • Preference Center — a signed per-contact link your customers can reach directly, let them revoke per-channel from one place. Issue it via POST /api/v1/compliance/preference-center and the same suppression ledger records the click. (Preference Center anchor)
Keep both available; the 60-day validity is a property of the signed link, which Orbit’s token satisfies by construction.
CASL s.13 and the record-keeping guidance make the consent record the thing a CRTC audit asks you to produce. Orbit’s Consent API is exactly the surface that gives you that record — each entry is timestamped, scoped to a channel, and exportable. A worked request: fetch the express-consent evidence for a Canadian recipient before a campaign runs:
A typical response showing the CASL-necessary record:
An opt_in: true (or state: opted_in, depending on the endpoint’s return shape) entry is the CASL-grade evidence you’d hand to the auditor: timestamped, scoped, and idempotent. If your capture form already writes consent through POST /api/v1/compliance/consent at acquisition time, the audit trail exists — CASL’s three-year record window is a GET/export-away (Consent Management/export). For implied-consent tiers, keep the tier note on your own CRM and point the consent entry at the tier you claim — the ledger is the transport, the category is yours.

​
Canadian numbers and quiet hours — a brief note

Canada has no federal quiet-hours statute the way the US TCPA defines one for voice. A Canadian recipient simply defaults to whatever window you have configured on the org-wide gate or the campaign fallback window (21:00 → 09:00 recipient-local if you never set one). Configure the window deliberately for Canadian recipients under Quiet hours configuration — and if you run voice into Canada, the same recipient-local default window applies there too.