Email consent: CASL and CAN-SPAM basics

Marketing email is regulated in both Canada and the United States. The rules are different in each country, but the spirit is the same: be honest about who you are, and respect people’s choices. This guide covers the essentials.

Why it matters

Following the rules isn’t only about avoiding penalties. Email sent to people who agreed to receive it gets opened, gets fewer spam reports and reaches more inboxes. Email sent without permission does the opposite, and mailbox providers like Gmail and Outlook notice.

Canada: CASL

Canada’s Anti-Spam Legislation (CASL) applies to commercial electronic messages sent to or accessed from computers in Canada. Its starting point is consent: you need permission before you send a marketing email.

Express consent

The person actively agreed, for example by ticking an unticked box or filling in a signup form. When you ask, say who you are, what you’ll send, and that they can unsubscribe at any time. Pre-ticked boxes don’t count. Express consent lasts until the person withdraws it.

Implied consent

In some situations consent is implied, usually for a limited time:

• Existing business relationship: they bought from you, leased from you or entered a contract with you in the last two years, or made an inquiry or application in the last six months.
• Conspicuous publication: their business address is published, for example on a company website, without a statement that they don’t want marketing email, and your message is relevant to their role.
• Disclosure: they gave you their address directly, without saying they don’t want messages, and your message relates to their business or role.

Because implied consent can expire, it’s good practice to ask those contacts for express consent while it’s still valid.

What every message needs

• Identification: who is sending, and on whose behalf, with a mailing address and at least one way to contact you (phone, email or website).
• A working unsubscribe that’s easy to use and free. It must keep working for at least 60 days after you send, and unsubscribes must take effect within 10 business days.

If you’re ever asked, it’s up to you to show that you had consent, so keep records of how and when each person agreed. Penalties for serious violations can reach $10 million per violation for a business.

United States: CAN-SPAM

The US CAN-SPAM Act doesn’t require consent before you send, but it sets firm rules for every commercial email:

• Honest headers: the From, To and Reply-To information must accurately identify you.
• Honest subject lines that reflect what’s in the email.
• Identify the message as an advertisement, unless the person has given you permission to email them.
• Include a valid physical postal address.
• Explain how to opt out, keep the opt-out working for at least 30 days after sending, and honour requests within 10 business days. Don’t charge a fee or ask for more than an email address to opt out.
• Stay responsible: even if someone else sends on your behalf, you’re accountable for following the law.

Each email that breaks the rules can bring a separate penalty, so the costs add up quickly.

What every email needs

Each law has requirements the other doesn’t, so the simplest approach is to meet both. In practice, every marketing email should:

• Go only to people who agreed to receive it, or who have a valid implied-consent relationship with you.
• Clearly show who it’s from, with your business name and mailing address.
• Have an honest subject line and an accurate From name.
• Include an unsubscribe link that works, and honour it promptly.
• Make it clear the email is promotional when it goes to US recipients who haven’t given you permission.

How BumbleBlast helps

• Consent on record: when you add or import contacts, you record how they agreed: express consent, or one of CASL’s implied-consent situations, with a note on where and when.
• An automatic footer: your business name, mailing address and licence details are added to every campaign, along with an unsubscribe link.
• One-click unsubscribe, supported in Gmail and other inboxes, that takes effect immediately for every campaign and automation.
• Suppression: people who unsubscribe, bounce or report spam are never emailed again, and an import never re-subscribes them.
• No bought lists: every import confirms that the contacts agreed to hear from you and the list wasn’t bought or scraped.

A quick checklist

1. Do I have express or valid implied consent for everyone on this list?
2. Are my business name and mailing address complete in Settings → Compliance?
3. Is the From name one my subscribers will recognise?
4. Does the subject line honestly describe the email?
5. Have I asked contacts with implied consent for express consent before it expires?