> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # CASL (Canada's Anti-Spam Legislation) for Commercial Email > Meet CASL's express/implied consent tiers, sender-identification, and unsubscribe requirements when you send commercial electronic messages to Canadian recipients through Orbit — mapped to the consent ledger and suppression surfaces you already own. # CASL (Canada's Anti-Spam Legislation) for Commercial Email Canada's Anti-Spam Legislation (S.C. 2010, c. 23, enforced by the CRTC) governs **commercial electronic messages** — including email — sent to Canadian recipients. Unlike the US CAN-SPAM opt-out model, CASL is largely an **opt-in** statute: you need consent *before* you send, and the consent has to be documented. CASL came into force on 1 July 2014; the enforcement and private-right-of-action phases are CRTC matters, so check current guidance on [fightspam.gc.ca](https://fightspam.gc.ca) alongside your own counsel. CASL is a **tenant-owned burden**. Orbit never mandates your posture — it gives you the send surfaces (sender domains, templates, headers), the consent ledger, and the suppression layer. This page maps each CASL obligation to the Orbit surface you already have so your reviewers can close the gaps deliberately before you send to Canadian recipients. This page is documentation, not legal advice. CASL carries administrative monetary penalties and a private right of action; have counsel review your consent capture, identification text, and unsubscribe mechanics. Orbit supplies the record-keeping and suppression surfaces — the legal posture is yours. *** ## What CASL actually requires The statute's core duties for a commercial electronic message: 1. **Consent** — the recipient must have given **express consent**, or fall under one of the statute's **implied consent** categories (existing business relationship, conspicuously published address relevant to the relationship, a few narrow carve-outs). 2. **Identification** — the message must identify the sender and the person on whose behalf it is sent, with a valid postal address (or, where the addressee can reach you, a readily reachable electronic address). 3. **Unsubscribe** — the message must carry an unsubscribe mechanism that is readily performed and remains valid for at least 60 days after the message is sent. 4. **Record-keeping** — a three-year record-keeping duty on consent evidence; a CRTC audit asks for the record, not for your recollection. The implied-consent categories are where most operators get this wrong: a customer who bought from you is in an existing business relationship, but that implied consent **expires** (generally two years after the last transaction for purchases, six months after an inquiry). Track the tier on your consent records, or you cannot tell a CRTC auditor whether a given recipient was implied or express. *** ## CASL vs CAN-SPAM — the consent-model difference CAN-SPAM in the US lets you send until the recipient opts out. CASL in Canada requires consent before you send. Map that difference to the two relevant Orbit surfaces: | | CAN-SPAM (US) | CASL (Canada) | | --------------------------- | --------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Consent model | Opt-out — you can send until suppressed | **Opt-in** — consent must exist before dispatch | | Orbit surface for consent | Suppression list alone is sufficient for US posture | **Consent API** — a `POST /api/v1/compliance/consent` record with `opt_in: true` for express consent; implied-consent tiers tracked on your side | | Suppression scope decisions | Default `email` scope writes per click | **Canada-specific scope decision** — decide on the bulk-import `channel` column or the Consent API scope whether a Canadian opt-out blocks only email or every channel you hold | | Enforcement | FTC | CRTC | The scope decision matters more under CASL than it does under CAN-SPAM: a Canadian recipient's unsubscribe click defaults to scope `email` (everything on [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) applies), but because consent is opt-in, many operators route Canadian opt-outs through the [Consent API](/compliance/consent-management) with scope `all` so the revocation propagates to SMS and voice too. Pick your scope deliberately — the defaults are per-entry-point, not per-jurisdiction. *** ## Identification requirements CASL s.6(1) requires the message to identify the sender and to carry a valid postal address (or a reachable electronic one). Orbit's side of this maps the way CAN-SPAM's header-integrity requirement maps: | CASL identification requirement | Where the control lives in Orbit | | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Identify the sender (true origin, no spoofed header) | **Sender domain verification** — your `From` domain only accepts traffic once DKIM, SPF, and DMARC verify (Same posture as requirement 1 on [US CAN-SPAM](/compliance/can-spam#from-identity--sender-domain)) | | Valid postal address (or reachable electronic address) | **Footer block in your template or HTML body** — keep the custodial address in a shared footer so every template carries it by construction | | Identify the sender behind a sending agent | **Your template copy** — if an agent sends on your behalf, name both parties in the message body; the platform sends what you pass | Domain verification is a deliverability gate, not a statutory one — but it is what gives the recipient and the CRTC a verifiable true-origin header, which is the substance CASL's identification clause asks for. *** ## Unsubscribe mechanism CASL s.6(2) requires an unsubscribe mechanism that is readily performed and stays valid for at least 60 days. Two shipped Orbit surfaces satisfy this by construction, and either can carry the burden: * **List-Unsubscribe headers** — every outbound email carries the `List-Unsubscribe` / `List-Unsubscribe-Post` pair for RFC 8058 one-click unsubscribe, plus an in-body unsubscribe link. A click or a provider POST writes an `email`-scope suppression row and an `email.unsubscribed` audit event — silent, no login wall. ([full header behavior](/compliance/can-spam#list-unsubscribe-header-behavior)) * **Preference Center** — a signed per-contact link your customers can reach directly, let them revoke per-channel from one place. Issue it via `POST /api/v1/compliance/preference-center` and the same suppression ledger records the click. ([Preference Center anchor](/compliance/send-gates#preference-center)) Keep both available; the 60-day validity is a property of the signed link, which Orbit's token satisfies by construction. *** ## The consent ledger as CASL evidence CASL s.13 and the record-keeping guidance make the consent record the thing a CRTC audit asks you to produce. Orbit's [Consent API](/compliance/consent-management) is exactly the surface that gives you that record — each entry is timestamped, scoped to a channel, and exportable. A worked request: fetch the express-consent evidence for a Canadian recipient before a campaign runs: ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/compliance/consent/lookup?identifier=camille@example.ca&channel=email" \ -H "X-API-Key: dv_live_sk_YOUR_KEY" ``` A typical response showing the CASL-necessary record: ```json theme={null} [ { "identifier": "camille@example.ca", "channel": "email", "state": "opted_in", "captured_at": "2026-06-01T14:22:10Z", "source": "checkout-form", "scope": "email" } ] ``` An `opt_in: true` (or `state: opted_in`, depending on the endpoint's return shape) entry is the CASL-grade evidence you'd hand to the auditor: timestamped, scoped, and idempotent. If your capture form already writes consent through `POST /api/v1/compliance/consent` at acquisition time, the audit trail exists — CASL's three-year record window is a `GET`/export-away ([Consent Management](/compliance/consent-management)/[export](/compliance/consent-management#export)). For implied-consent tiers, keep the tier note on your own CRM and point the consent entry at the tier you claim — the ledger is the transport, the category is yours. *** ## Canadian numbers and quiet hours — a brief note Canada has **no federal quiet-hours statute** the way the US TCPA defines one for voice. A Canadian recipient simply defaults to whatever window you have configured on the org-wide gate or the campaign fallback window (21:00 → 09:00 recipient-local if you never set one). Configure the window deliberately for Canadian recipients under [Quiet hours configuration](/guides/quiet-hours-configuration) — and if you run voice into Canada, the same recipient-local default window applies there too. *** ## Related references * [Consent Management](/compliance/consent-management) — the record you produce when the CRTC asks for consent evidence. * [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) — scope-`email` vs scope-`all`, bulk CSV import, and the per-entry-point scope matrix. * [US CAN-SPAM](/compliance/can-spam) — the opt-out counterpart; the 'Non-US email is not covered here' section points here. * [Country Compliance Requirements](/compliance/country-requirements) — per-country sender rules and required documentation. * [Quiet hours configuration](/guides/quiet-hours-configuration) — recipient-local gates and the campaign fallback window. * [Send Gates](/compliance/send-gates) — the Preference Center and other suppression entry points.