Your rights under Canada's Anti-Spam Legislation, what counts as consent, and how to report violations to the CRTC.
This page provides legal information, not legal advice. Consult a qualified privacy lawyer or CIPP/C-accredited privacy professional before taking action on access requests, breach response, complaints to a Privacy Commissioner, or Federal Court applications.
Last verified: September 2026
TL;DR
CASL requires commercial electronic messages (CEMs) to have your consent (express or implied), clearly identify the sender, and contain a working unsubscribe mechanism. Violations can be reported to the CRTC and can result in significant penalties.
What CASL requires
A commercial electronic message (email, SMS, social DM) must:
Have your consent (express or implied).
Clearly identify the sender and their contact information.
Include a working, free, easy-to-use unsubscribe mechanism that works for at least 60 days.
Process unsubscribe requests within 10 business days.
Express vs. implied consent
Express consent is specific and opt-in. It must be documented.
Implied consent applies in limited circumstances, such as existing business relationships (purchase in past 2 years) or inquiries (past 6 months).
Reporting CASL violations
Spam is reported to the Spam Reporting Centre (fightspam-combattrelepourriel.ised-isde.canada.ca or spam@fightspam.gc.ca). The CRTC investigates and can impose administrative penalties. CASL's private right of action was never brought into force and was repealed on December 31, 2025.