CRM Costs, Pricing Models and 2026 Rules
CASL and your CRM: express vs implied consent, expiry windows and unsubscribes
How Canada's Anti-Spam Legislation applies to CRM email and texts: express and implied consent, the 2-year and 6-month windows, 10-business-day unsubscribes and penalties.
If your CRM sends commercial emails or text messages to Canadians, Canada's Anti-Spam Legislation (CASL) applies. In general you need the recipient's consent, every message must identify you and include a working unsubscribe mechanism, and unsubscribe requests must take effect without delay and no later than 10 business days after they are sent. Consent is either express (the person actively agreed, and it lasts until withdrawn) or implied in specific situations, the most common being an existing business relationship: two years after a purchase or contract, six months after an inquiry. The CRTC can impose administrative monetary penalties of up to $1 million per violation for an individual and $10 million for a business. A CRM does not make you compliant, but a well-configured one is the best way to prove you are.
This guide is general information as of October 2026, not legal advice. It is part of the CRM costs, pricing models and 2026 rules section.
What counts as a commercial electronic message
A commercial electronic message (CEM) is an electronic message, such as an email, a text or a direct message on some platforms, that has as one of its purposes encouraging participation in a commercial activity: offers, promotions, newsletters with offers, invitations to buy, event invitations for sales purposes. A message can be commercial even if most of it is informational.
Some messages are exempt from the consent requirement, for example certain messages that only provide a quote or estimate the person requested, or that complete a transaction they already agreed to. These messages (CASL s. 6(6)) still need the identification and unsubscribe information. Others are exempt from section 6 altogether under section 3 of the Electronic Commerce Protection Regulations, such as messages between employees of an organisation about its activities, messages to employees of another organisation with which yours has a relationship, and messages sent in response to a request, inquiry or complaint. The rules are detailed; check the CRTC's guidance before relying on an exemption.
Express vs implied consent
| Express consent | Implied consent | |
|---|---|---|
| How you get it | The person actively agrees, for example by ticking an unticked box or replying "yes" | Arises from a situation set out in the Act |
| How long it lasts | Until withdrawn | Limited period for business relationships; otherwise as long as the situation applies |
| Typical sources | Website sign-up form, checkout opt-in, signed form, recorded verbal consent | Purchase within two years, inquiry within six months, published business address, business card handed over |
| What you must record | Date, time, how it was obtained, the request wording | The basis, the start date and the expiry date |
| Risk | Low if documented | Expires quietly; must be refreshed |
Requesting express consent. The request must state the purpose, identify who is seeking consent (and on whose behalf), and say that the person can withdraw consent. A pre-ticked box does not count as express consent. Keep the exact wording of each form version in your records.
Implied consent windows. Under the existing-business-relationship rules in section 10 of CASL:
- a purchase or lease of a product or service, or a written contract, gives implied consent for two years (for a contract, counted from its end);
- an inquiry or application gives implied consent for six months.
Implied consent also arises when someone has conspicuously published their business email address without saying they do not want unsolicited messages, provided your message relates to their business role, or when they gave you their address (for example on a business card) without such a statement, again for messages relevant to their role.
Setting up your CRM for CASL
Your CRM should store, for every contact who might receive marketing:
- Consent type: express, implied (purchase), implied (contract), implied (inquiry), implied (published address), none.
- Consent date and source (form name, event, invoice number).
- Expiry date for implied consent, calculated automatically.
- Unsubscribe status and date, synchronised across every tool that sends messages.
- Form wording version for express consent.
Then automate the basics:
- A workflow that asks implied-consent contacts for express consent a few weeks before their window closes.
- A suppression rule that moves contacts to non-marketing status when consent expires.
- An unsubscribe link in every commercial template that updates the CRM immediately.
- Sender identification in every template: business name, mailing address, and a phone number, email or web address.
The unsubscribe mechanism must be easy to use, at no cost to the recipient, and the address or link must remain valid for at least 60 days after the message is sent. Ten business days is the outer limit; most CRMs can process unsubscribes instantly, so do not use the full window.
Worked example (illustrative)
A Saskatoon equipment dealer sold a mower to a customer on 15 March 2025. That purchase gives implied consent until 15 March 2027. The customer also asked about snow blowers on 10 September 2026, which gives implied consent from the inquiry until 10 March 2027, but the purchase window is longer, so the CRM uses 15 March 2027. A workflow sends a "stay in touch" request for express consent in February 2027. If the customer clicks yes, consent becomes express and no longer expires; if not, the contact moves to non-marketing status on 15 March 2027 unless a new purchase restarts the window.
Penalties and enforcement
The CRTC enforces the anti-spam provisions, while the Competition Bureau and the Office of the Privacy Commissioner handle related parts of the law. Maximum administrative monetary penalties are $1,000,000 per violation for an individual and $10,000,000 for any other person, such as a corporation. Directors and officers can be liable if they directed or acquiesced in a violation, and businesses can be liable for the acts of employees and agents. A due-diligence defence is available, which is why documented consent records and written procedures matter. The private right of action that was in the Act (ss. 47–51) was repealed before it ever came into force.
Common CASL mistakes with a new CRM
- Importing an old customer list and marking everyone as "subscribed".
- Treating a trade-show badge scan as express consent without telling people what they are agreeing to.
- Sending newsletters from a second tool that does not receive unsubscribes from the CRM.
- Forgetting that texts and some direct messages are covered too.
- Buying or renting a list. Consent obtained by someone else rarely covers your messages.
See data migration and clean-up for how to bring consent data across safely, and contact-based pricing for why clean lists also cost less.
FAQ
Does CASL apply to emails to other businesses?
Yes, in general. B2B emails need consent too, although some messages between organisations with an existing relationship are excluded, and implied consent from published business addresses is common in B2B. Check the CRTC's guidance.
Does CASL apply to my US or foreign customers?
CASL applies to messages sent to or accessed from computers in Canada. Messages to people abroad may fall under other countries' laws instead.
How long should I keep consent records?
As long as you rely on the consent, and long enough afterward to answer a complaint. Keep them in the CRM or an export, not in someone's inbox.
Is a "reply STOP" enough for texts?
The Act requires an unsubscribe mechanism that points to an electronic address or a web page and that can be readily performed. For SMS, the CRTC's guidance (Compliance and Enforcement Information Bulletin 2012-548) says the user should have the choice of replying with a word such as "STOP" or "Unsubscribe" or clicking a link to an opt-out web page. So offer both where you can, and make sure the reply updates your CRM.
Sources
- Canadian Radio-television and Telecommunications Commission — CASL guidance, consent requests, unsubscribe mechanisms, enforcement
- Justice Laws Website — An Act to promote the efficiency and adaptability of the Canadian economy (CASL), S.C. 2010, c. 23, ss. 6, 10, 11, 20
- Competition Bureau Canada — false or misleading electronic messages
- Office of the Privacy Commissioner of Canada — address harvesting and collection of personal information
