Canada's Law on Spam and Other Electronic Threats

About the law

Video: How do I know if Canada's anti-spam legislation applies to my business or organization?

Canada's anti-spam legislation (CASL) came into effect July 1, 2014. It is in place to protect Canadians while ensuring that businesses can continue to compete in the global marketplace.

If you use electronic channels to promote or market your organization, products or services, Canada's new anti-spam law may affect you.

On January 15, 2015, new rules about installing computer programs came into force. It is now illegal to install programs, such as malware, on someone's computer without consent.

It is your duty to understand and comply with the law.

Compliance Basics

Do you use email, SMS, social media or instant messaging to send commercial or promotional information about your organization to customers, prospects and other important audiences?

Do you install software programs on people's computers or mobile devices?

Do you carry out these activities in or from Canada?

To send a commercial electronic message to an electronic address, you need to have the recipient's consent, to identify yourself, to offer an unsubscribe mechanism and to be truthful.

Consent: You must have a form of valid consent.
How can I obtain express consent?
What's the difference between express consent and implied consent?
Identification: Clearly identify yourself and your organization. You must include your mailing address. You must also include a phone number for accessing an agent or a voice messaging system, an email address, or a web address for you or the person on whose behalf you are sending the message.
Unsubscribe mechanism: Provide an unsubscribe mechanism that is functional for 60 days. See examples of acceptable unsubscribe mechanisms.
Truth in advertising: Your messages must not be false or misleading. They must not have false or misleading sender information, subject matter information, URLs and/or metadata.

To install a program on someone else's computer or mobile device, you must have his/her express consent. Learn more about how to obtain consent in this case.

CASL allows Canadian enforcement against spammers operating in Canada.

Note: This website provides plain language information about the law but is not a substitute for the law itself. You are strongly advised to review our information bulletins and seek your own legal advice regarding how to comply.

Tweet us

Tweets by @industrycanada

Protect Yourself

Watch the webinar

Get the facts

MYTH: I won't be able to use
email or my current email list
to promote my products
and services.

Fact: You can continue to use email if you have express or implied consent from recipients. During the 36-month transition period, you can continue to use your current email list if

you have previously provided your products or services to them and
they haven't told you to stop.

MYTH: It's illegal to send promotional emails, text or instant messages, or to
post promotional information
on social media.

Fact: It is not illegal to send commercial electronic messages, but you need consent.
CASL applies to emails, text and instant messages, and any similar messages sent to electronic addresses.
CASL does not apply to promotional information you post online in places like blogs or social media.

MYTH: Pre-CASL express consent is invalid.

Fact: Express consent received before July 1, 2014, remains valid and does not expire until the recipient withdraws it.

MYTH: CASL will stop all spam, including that from overseas.

Fact: No law will eliminate all spam, including that from overseas. CASL allows Canadian enforcement against spammers operating in Canada.

MYTH: Compliance is going to be onerous and costly for businesses.

Fact: Businesses that already comply with privacy laws and use common best practices for email marketing will require little effort to comply with CASL.
The 36-month transitional provision provides time to adjust and seek express consent from pre-existing clients.

MYTH: I heard that I could be fined up to $10 million for sending an email and that there could be class actions.

Fact: There are no automatic penalties. The CRTC has a range of enforcement tools available, from warnings to penalties (up to $1 million for individuals and $10 million for businesses).

Key Date

July 2017

July 1, 2017—the private right of action comes into force

Private individuals and organizations that are affect by a violation of CASL will be able to seek legal redress through civil actions.

Government Action Timeline

Better safe than sorry—Violating CASL has a price

Better safe than sorry Legitimate complaints about unsolicited emails may be turned over to the CRTC, which may investigate to determine if the message violates CASL.

If you are judged to be in violation, the CRTC has a range of enforcement tools available.

There are no automatic penalties for violations. The CRTC judges each case based on a series of factors, including the nature of the violation, your history with CASL, whether you benefited financially from the violation and your ability to pay a penalty.

Penalties for the most serious violations of the Act can go as high as $1 million for individuals and $10 million for businesses. Civil cases cannot be brought before the courts until July 2017.

top of page