CASL for developers: consent, unsubscribes and records

1. What CASL covers
2. Commercial, transactional or neither
3. Consent: express or implied
4. What each commercial message must say
5. STOP and unsubscribe
6. Records that prove it
7. What HonkIO handles, and what stays with you
8. A checklist for your next release

This guide explains Canadian rules in general terms for people who build software. It is not legal advice: for your own situation, talk to a lawyer.

CASL governs commercial electronic messages: texts, email and other electronic messages whose purpose, or one of whose purposes, is to encourage commercial activity. It applies when a computer system in Canada is used to send or to access the message, so a text from a server abroad to a phone in Canada is covered.

Section 6 sets three requirements for every commercial message:

• Consent. The recipient agreed, expressly or by implication, and you can prove it.
• Identification. The message says who sent it and how to reach them.
• Unsubscribe. The message carries a way to opt out that costs nothing and keeps working for at least 60 days.

Administrative monetary penalties reach $1 million per violation for an individual and $10 million for any other person, such as a business. The law is enforced by the CRTC, with the Competition Bureau and the Privacy Commissioner covering related parts.

The first question for each message your system sends is whether it is commercial. A promotion, an offer or a nudge to buy is. A sign-in code that does nothing but let someone sign in is generally not, because its purpose is not commercial.

Section 6(6) lists messages that are commercial but do not need consent, because they solely:

• give a quote or estimate the person asked for
• facilitate, complete or confirm a transaction the person already agreed to
• give warranty, recall, safety or security information about something they bought or use
• give factual information about an ongoing subscription, membership, account or loan
• give information about their employment or a related benefit plan
• deliver a product, service, update or upgrade they are entitled to under an earlier transaction

These messages still need the identification and unsubscribe content. And the exemption covers a message that does only those things: add a promotion to an order confirmation and the whole message needs consent, like any other marketing.

Tag each message type in your code as commercial or not. It makes the rule reviewable in a pull request, and it lets your sending layer check consent wherever the law asks for it, without exceptions sprinkled through the codebase.

Express consent

The person actively agreed. Express consent does not expire: it lasts until they withdraw it. The request has to say what the consent is for, name who is asking (and the business it is for, if different), give a mailing address and one other way to reach them, and say that consent can be withdrawn.

The CRTC’s guidance is that consent has to be an action the person takes: a box they tick, a form they submit, a keyword they text. A pre-checked box or a clause buried in your terms of service is not express consent.

Implied consent

Consent the law infers from a relationship, set out in section 10. It runs on a clock:

• a purchase, lease or contract: two years from the purchase, or from the end of the contract
• an inquiry or application: six months from the inquiry
• an address published conspicuously, or given to you, with no statement refusing messages: only for messages relevant to the person’s role or business

Implied consent is the one that fails quietly. Nothing changes on the day it lapses, so store when it started and why, and compute its expiry at send time. A boolean flag cannot do that.

What to store for each consent

• the phone number or email address it covers
• its type, and for implied consent the relationship and the date it started
• where and when it was given: the form, the checkout step, the keyword reply, the call
• the wording the person saw, versioned so you can show it later
• evidence such as the IP address for a web form, or the inbound message for a keyword opt-in
• when and how it was withdrawn

For a worked example on the SMS side, with the API calls, read What CASL actually requires before you send a text.

Every commercial message has to identify the sender, and the business it is sent for if that is someone else, and give a mailing address plus a phone number, email address or web address. That contact information must keep working for at least 60 days after the message is sent.

A text has no room for a mailing address. The CRTC’s regulations allow for this: when it is not practicable to put the information in the message, it can sit on a web page reached by a link that is clear and prominent in the message, at no cost to the recipient.

In practice, a commercial text names your brand first, says what it is about, and ends with how to opt out:

Maple Dental: 20% off whitening until November 30. Details and contact: mapledental.ca/info. Reply STOP to opt out.

An email has room for all of it, so it usually goes in the footer: the business name, mailing address, a contact link and the unsubscribe link.

The unsubscribe mechanism has to use the same electronic means the message came by, or another electronic means where that is not practicable. It must cost the recipient nothing, be readily performed and keep working for at least 60 days. You must give effect to a request without delay, and in any case within 10 business days.

For texts

The expected mechanism is a reply. Treat STOP and its common variants (STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT) and the French ARRET as a withdrawal, confirm it once, and stop sending until the person opts back in, usually with START.

Ten business days is the legal ceiling, not a target. Someone who replied STOP and gets another promotion an hour later will complain, and carriers watch complaints.

For email

Put an unsubscribe link in the footer of every commercial email, and add the one-click List-Unsubscribe header defined in RFC 8058 so mail clients can offer the unsubscribe themselves. Scope the unsubscribe to what the person left: someone leaving your newsletter still expects their receipts and password resets.

If a complaint reaches the CRTC, your consent records are your defence. They need to survive account deletions, list cleanups and migrations between providers.

• keep each consent record and its source for as long as you rely on it
• keep withdrawals, so a re-import cannot quietly re-add someone who opted out
• log which messages were sent as commercial, to whom and when
• version your consent wording, so you can show what each person agreed to

Privacy law pulls the other way: PIPEDA and Quebec’s Law 25 expect you not to keep personal information longer than you need it. One way to satisfy both is to delete a person’s data when they ask, but keep a minimal record that the number or address opted out, so it is never messaged again by mistake.

HonkIO checks consent on every text before it is sent. Record consent through the consent API; a send with nothing on file, with implied consent past its expiry date, or to someone who opted out is refused with HTTP 451 (NO_CONSENT, CONSENT_EXPIRED or OPT_OUT_BLOCKED) and is not charged.

Replies of STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT and ARRET opt the sender out within seconds, START and UNSTOP opt them back in, and each one reaches you as a signed webhook event. Erasing a number’s data keeps its opt-out.

For email, consent is recorded per address through the same API. A commercial email without it is refused, and every commercial email carries an unsubscribe footer and the one-click header. Mark marketing email as commercial: HonkIO treats email as transactional unless you do. The email compliance docs have the details.

What stays with you: deciding which messages are commercial, the wording of your consent requests, and the identification line in your message text. Implied consent expires two years after the transaction date by default; for consent that comes from an inquiry or application, set expires_at six months after it. Texts are not checked against the CRTC Do Not Call List, which covers telemarketing calls and faxes; CASL consent governs texts. The compliance page lists everything HonkIO enforces today.

• Every message type is tagged commercial or not, in code
• Consent is recorded when it is given, with its source, wording version and evidence
• Implied consent has a start date, and the send path checks its expiry
• Commercial messages name the sender and link to contact details that work for 60 days
• STOP, ARRET and email unsubscribes take effect at once, not in 10 business days
• Opt-outs survive deletions, imports and changes of provider

Choosing where to send from is the other half of the job: the guide to SMS providers in Canada covers number types, carrier rules and costs.

Does CASL apply to SMS?

Yes. A text message is an electronic message, so a commercial text to a Canadian number needs consent, identification and an unsubscribe mechanism, the same as commercial email.

Do I need consent to send a sign-in code or a receipt?

A sign-in code whose only purpose is to let someone sign in is generally not a commercial message. A receipt or order confirmation is exempt from consent under section 6(6) as long as it does nothing else, but it still needs the identification and unsubscribe content. Adding a promotion to either one means it needs consent.

How long does implied consent last?

Two years from a purchase or from the end of a contract, and six months from an inquiry or application. Express consent does not expire: it lasts until the person withdraws it.

How fast must I act on STOP or an unsubscribe?

Without delay, and no later than 10 business days after the request. Acting on it immediately is better practice; HonkIO does so for SMS keyword replies.

What are the penalties under CASL?

Administrative monetary penalties of up to $1 million per violation for an individual and up to $10 million for any other person, such as a business.

Is this guide legal advice?

No. It explains the law in general terms for people who write software. For your own situation, talk to a lawyer who knows CASL.

1. Canada’s Anti-Spam Legislation, S.C. 2010, c. 23 (Justice Laws)
2. Electronic Commerce Protection Regulations (CRTC), SOR/2012-36
3. CRTC Compliance and Enforcement Information Bulletin 2012-548
4. Canada’s anti-spam legislation (Government of Canada)
5. RFC 8058: Signaling one-click functionality for list email headers

• SMS API

  Send and receive SMS with Canadian local and toll-free numbers, with CASL consent and STOP replies enforced in the API.

• Email API

  Send transactional email from your own domain and receive replies over the API, with CASL checks and data stored in Canada.