Businesses that send newsletters: what Canada's anti-spam law actually requires

Three requirements govern every commercial electronic message in Canada: consent, identification and an unsubscribe mechanism. The most expensive one to ignore is the implicit fourth rule: you are the one who must prove consent, not the recipient who must prove they never gave it.

On this page

The three requirements, in order

What follows is written for executives and marketing managers of businesses that send newsletters, promotions or follow-up emails. It describes the federal framework and does not replace legal advice.

The CRTC states them plainly. To send a commercial electronic message to an address, you must have obtained consent, provide identification information, and include an unsubscribe mechanism allowing the recipient to remove themselves from your list.

The last two are easy to meet and rarely at issue. The company name, a contact address, a working unsubscribe link. These are template elements, settled once and for all, at a cost close to zero.

The first is expensive, because it is not settled in the template but in how each address entered your database. It is a process problem, not a tool problem, and it is paid for years later.

Express consent and implied consent

Two forms exist, and they have neither the same duration nor the same strength.

Express consent is consent the person gives actively, in writing or orally. It does not expire. The recipient nevertheless keeps the right to withdraw it at any time. It is the only foundation on which to build a lasting audience.

Implied consent flows from an existing relationship. The CRTC names in particular the existing business relationship, created by a commercial transaction already completed, and the existing non-business relationship, created for example by a membership. It is generally valid for two years following the event that created the relationship. In the case of a subscription or membership, the period starts the day the relationship ends.

This difference weighs heavily on the budget. A business that relies only on implied consent watches its usable list melt continuously as relationships age. It has to buy traffic again to rebuild what it loses. At a cost of $12 per acquired subscriber, replacing 5,000 expired addresses costs $60,000 per year. The expense is entirely avoidable if express consent has been requested at the time of purchase. The cost per acquired subscriber is what advertising costs you to gain each new subscriber. Express consent obtained at the right moment does not lapse, and its marginal cost, meaning what each additional consent costs, is zero.

The trap of the email that asks for consent

This is the point almost nobody knows, and it closes the door on the solution everyone imagines.

The CRTC indicates that an electronic message containing a request for express consent is itself a commercial electronic message. Sending such an email is therefore not a valid way to obtain that consent.

The classic move, writing to your whole list to ask people to confirm their subscription, fixes nothing. If you had no valid basis for writing to those addresses, that email is a problem too.

This rule completely changes how to handle a doubtful list. Regularization does not go through a mass send; it goes through the channels where the person comes to you: a form, a purchase, an event, an inbound call.

The proof is yours to provide

The CRTC is explicit: the onus of proof rests with the sender of the message, who must demonstrate that they obtained the required consent.

This reversal decides everything. An address you cannot trace, whose arrival date and collection method you cannot state, is treated as an address without consent. It does not matter that it was given in good faith six years ago.

Usable proof remains simple to build: the date, the method of collection, the exact wording displayed at the time of consent, and the address itself. Four fields, kept indefinitely for express consent.

Many sending platforms record part of this information. Almost none keeps the wording displayed at the time of collection, which is nevertheless the most contested element. A dated capture of each version of your form settles the problem for a few minutes per year.

Lists without documented origin are common, especially after an acquisition, a platform change or the departure of the person who ran marketing.

The reflex is to segment what is documented and cut the rest. It is painful and it is generally the right decision, because the undocumented portion is a liability that follows you and has no defensible value.

Rebuilding happens through the touchpoints where the person acts on their own. A clear form on the most visited pages, a checkbox at the time of purchase, a request at the end of an inbound call. It is slower than a mass send and it is the only route that produces a solid base.

Put a number on the loss before cutting; the decision will be easier to make. A list of 28,000 undocumented addresses, of which 1.2% buy on each send with an average order of $180 at a 40% margin, represents about $24,000 of margin per send. That is real revenue, and it is also revenue you cannot defend. The question is not whether losing it is pleasant, but whether you accept billing it at that risk.

A useful nuance: implied consent can cover your recent customers, under the conditions set out in the law. A business that sells regularly therefore often has a broader legitimate base than it believes, provided it can date its transactions.

What a non-compliant list costs

Three costs, and only the first is visible.

The direct financial risk. In December 2021, the CRTC reached a $200,000 settlement with a retailer, following messages sent without prior consent and an unsubscribe mechanism that was sometimes missing or hard to use. The investigation was supported by complaints from citizens, a reminder that a single person is enough to set the process in motion.

The cost of the wrong decision. A business with 40,000 addresses of which only 12,000 are documented steers its budget on a false number. It believes its cost per subscriber is $4 when it is $13 on the actually usable base, and it overestimates the value of its audience when weighing email against media buying. That bad trade-off costs more, every year, than compliance itself.

The cost in reputation and deliverability, that ability of your emails to reach the inbox rather than the junk folder. Sending to people who asked for nothing produces complaints and reports, which degrades the deliverability of all your future sends, including those to perfectly consenting customers. You then pay twice: the regulatory risk on one side, and the lost revenue on the healthy part of your list on the other.

The practice that holds

Five rules, and they cost a few minutes per month once in place.

The fifth rule turns compliance into management information. An executive team that knows 40% of its list rests on implied consent about to expire can act now. One that does not know will discover the loss at the moment it needs the list most.

Once the list is clean, the next question is what it is worth. The calculation is in our article on subscriber value.

The effect of consent on your measurement is handled separately in the effect of consent on your measurement.

Building the budget that carries these decisions is detailed in building the marketing budget.

Frequently asked questions about email consent