Canada's Anti-Spam Legislation (CASL) is an opt-in law with one door left open for cold B2B email: implied consent by conspicuous publication. The CRTC sets three conditions. The address was conspicuously published, there was no statement refusing unsolicited messages, and the message is "relevant to the person's business, role, functions or duties". It adds that "merely finding an address online doesn't establish consent". The sender carries the burden of proof, message by message.
That burden is what matters for software. An address found by pattern-guessing and SMTP verification (Email verification) was never published, so it cannot carry implied consent. Most of the lead data the market sells looks like that (Contact data and enrichment). Under CASL, provenance determines legality as well as list quality.
What CASL requires
| Element | Rule | Source |
|---|---|---|
| Consent | Express, or implied (existing business/non-business relationship, conspicuous publication, or business card handed over) | CRTC FAQ |
| B2B exemption | Messages between employees/representatives of organisations that have a relationship, about the recipient organisation's activities. Two individuals knowing each other does not count | CRTC FAQ |
| Identification | Identify the sender and anyone on whose behalf it is sent; a visible hyperlink is acceptable where space is limited | CRTC FAQ |
| Unsubscribe | Process "without delay, and no later than 10 business days" | CRTC FAQ |
| Aiding (s.9) | Prohibits aiding, inducing or procuring a violation, which reaches platforms and intermediaries | BLG on 2018 enforcement |
| Penalties | Administrative monetary penalties up to C$1M (individuals) and C$10M (businesses) per violation | CRTC FAQ |
The B2B exemption is narrower than its name. It covers messages between organisations that already deal with each other. It does not cover a first email to a prospect. For cold outreach, conspicuous publication is the only route.
CASL's private right of action, which would have allowed class-style statutory damages, was suspended in 2017. We believe it is still not in force as of October 2026 but did not re-verify this. We also did not re-verify the time limits on implied consent from an existing business relationship (commonly cited as two years after a purchase, six months after an inquiry).
The case that defines cold B2B under CASL
Compu-Finder sold management training to businesses and built lists by "scouring websites". That is the business model of a modern scraped-list cold emailer. The CRTC issued a C$1.1M notice of violation in March 2015, noting the firm "accounted for 26% of all complaints submitted within its industry sector". In Compliance and Enforcement Decision 2017-368 the Commission cut the penalty to C$200,000 but rejected the defences. It examined who published each address and whether the training pitch matched recipients' roles. It dismissed the B2B exemption claim and held senders to "a high onus of proof" for every message. The Federal Court of Appeal later upheld CASL as constitutional in the same litigation.
Compu-Finder lost on evidence, not on principle. The CRTC accepted that conspicuous publication can justify a cold B2B email. The firm could not show, per address, where it was published and why the message fit the role. That evidence is a database column, and no sequencer we checked records it.
Enforcement since then: small numbers, slow cadence
The CRTC's enforcement list shows few CASL actions in recent years:
| Party | Date | Type | Amount |
|---|---|---|---|
| Jimmy Genesse | 13 Aug 2025 | Notice of violation (s.7(1)(a)) | C$50,000 |
| Hudson's Bay Company | 10 Jun 2024 | Undertaking + compliance programme | C$120,000 |
| Gap Inc. | 6 Dec 2021 | Undertaking + compliance programme | C$200,000 |
| Notesolution / OneClass | 21 Sep 2020 | Undertaking | C$100,000 |
| Brian Conley | 23 Apr 2019 | Decision (s.6 consent) | C$100,000 |
Recent cases are retail email programmes and individual bad actors, not B2B prospecting. The C$10M statutory ceiling has never come close to being used. Fines in the C$50k–200k range are typical, and undertakings that mandate a compliance programme are the CRTC's preferred tool for companies.
We could not fetch a 2025 CASL year-in-review (the BLG series blocks automated access). The table relies on the CRTC's own list, which may lag. Any 2026 CASL actions are not captured here.
Section 9: the provision aimed at platforms
CASL s.9 prohibits aiding, inducing or procuring a breach. In July 2018 the CRTC fined two ad-tech intermediaries, Datablocks (C$100,000) and Sunlight Media (C$150,000), for enabling malvertising. It named what they lacked: written contracts requiring client CASL compliance, monitoring of how clients used the service, and internal compliance policies. The CRTC has also published guidance on intermediary liability for IT and infrastructure providers.
For a cold-email platform this is the most explicit statement anywhere of what a regulator expects from a sending tool: contractual compliance terms, active monitoring, and a policy you can show. See Platform liability: what the sequencer itself risks.
What this means for an entrant
- Capture publication evidence at import. Store source URL, capture timestamp and a snapshot or hash of the page for every lead that might be Canadian. Flag "pattern-guessed" addresses as not eligible for implied consent. This turns the Compu-Finder failure into a feature.
- Score role relevance before sending. CASL, Australia and Japan all ask whether the pitch fits the recipient's job. An LLM check of offer against title is cheap (AI personalisation) and produces an audit trail.
- Offer a Canada mode. Recipient-country detection, mandatory sender identification block, unsubscribe processed well inside 10 business days, and a send block for leads without recorded provenance. Agencies with Canadian clients will pay for it, and it doubles as a strong sales message for EU buyers (Non-English markets).
- Treat s.9 as your own exposure. Written user terms that require CASL compliance, abuse monitoring, and a documented policy are what the CRTC faulted intermediaries for lacking. Build them before you have Canadian revenue, not after a complaint.
- Don't overweight the risk. Enforcement is infrequent and mostly B2C. Canada is a compliance differentiator and a credibility signal, not a market that will make or break the business.