Definition

What is the onus of proving consent?

The onus of proving consent is the obligation, for the sender of a commercial electronic message, to demonstrate that they obtained the consent required by Canada's Anti-Spam Legislation (CASL). The recipient has nothing to demonstrate. An address whose origin, date and method of collection you cannot document is therefore treated as an address without consent.

What the law provides

The CRTC (Canadian Radio-television and Telecommunications Commission) sets out three general requirements for sending a commercial electronic message: you must have obtained consent, provide identification information and include an unsubscribe mechanism that lets the recipient leave your list.

CASL adds a rule that settles everything: the person who claims to have consent must prove it. The burden never shifts to the recipient. It does not matter that an address was given in good faith six years ago: without a record of how it entered your database, it counts as an address without consent.

Responsibility lies with the business on whose behalf the message is sent. Your email platform or the vendor who built your forms may have obligations of their own. They do not take your place before the regulator.

The four elements of usable proof

The date on which the person gave consent.
The collection method: a website form, a checkbox at purchase, a sign-up at an event.
The exact wording displayed at the time of consent, meaning what the person read before accepting.
The address itself.

The law sets no retention period: keep these four fields for as long as you write to the person. Many email platforms record some of this information. Almost none keep the displayed wording, which is the element most often disputed. A dated screenshot of each version of your forms solves this, since the wording changes with every redesign.

Express consent and implied consent

The onus of proof applies to both forms of consent, but it does not bear on the same thing.

Express consent is given actively by the person, in writing or orally. It does not expire, although the person can withdraw it at any time. The proof bears on the wording they accepted.
Implied consent stems from an existing relationship, such as a purchase. It is generally valid for two years after the event that created the relationship, and only six months after a simple inquiry. The proof then bears on the date of that event.

A list segmented by basis of consent (express on one side, implied with its expiry date on the other) tells you what share of your addresses will still be usable in eighteen months.

Why a confirmation email fixes nothing

The reflex with a doubtful list is to write to everyone and ask them to confirm their subscription. The CRTC states that a message requesting express consent is itself a commercial electronic message. If you had no valid basis for writing to those addresses, that email raises the same problem as the others.

Fixing the list goes through the channels where people come to you: a clear form on your most visited pages, a checkbox at purchase, a request at the end of an inbound call. It is slower than a mass send. It is also the only path that produces a database you can defend.

Example

Fictional example: a company has 40,000 addresses in its email platform. For 12,000 of them, it keeps the date, collection method, displayed wording and address. The other 28,000 come from an old system and nobody knows how they got there.

Since the proof is its responsibility, its defensible list holds 12,000 addresses, not 40,000. It thought it was paying $4 per subscriber: on the base it can actually use, the cost is about $13. That figure changes how it splits its budget between email and media buying.

How we read it

We read the onus of proof as a process problem, not a tool problem. It is not solved in the newsletter template: it is solved in the way each address enters your database. A company that documents its four fields today will not have to choose later between a risk it cannot control and a rebuild that takes years.

We can take on the database audit, the segmentation by basis of consent, the rework of your forms, the capture of the wording and the measurement of what remains usable. Three decisions stay with you: whether to cut the undocumented part, keeping the proof, and having your situation validated by legal counsel. Falia is not a law firm, and this page does not replace legal advice.

Not to be confused with

Deliverability: Deliverability is a technical measure: an email's ability to reach the inbox. The onus of proof is a legal obligation of the sender. A list without documented consent can still degrade both, because unsolicited sends generate spam complaints.
Consent gap: The consent gap concerns cookies and measurement: the conversions your platforms no longer see when a visitor refuses tracking. The onus of proof concerns commercial messages and what the sender must be able to demonstrate.
Implied consent: Implied consent is a basis for consent that stems from an existing relationship and expires. The onus of proof applies to it too: you must be able to date the transaction or event that created it.

Related concepts

Related services

Frequently asked questions

Is it up to me to prove my subscribers consented?

Yes. CASL places the onus of proof on the sender of the message, not on the recipient. If a subscriber complains, your company must show when, how and with what wording they gave their consent.

How long do I need to keep proof of consent?

The law sets no period. Keep the date, collection method, displayed wording and address for as long as you write to the person. Add a dated screenshot of each version of your forms, since their wording changes with every redesign.

Does my email platform keep the proof for me?

Only in part. Many platforms record the date and source of a sign-up, but almost none keep the exact wording displayed at the time of consent. Responsibility stays with the business on whose behalf the message is sent.

← The full glossary