Two beliefs about CASL show up constantly in Canadian B2B, and they are both wrong.

The first is that cold email is simply illegal in Canada. It is not. The second is that the law does not apply to business addresses, because business email is fair game. That one is wrong in the direction that costs money.

Canada's Anti-Spam Legislation has been in force since 2014. It applies to business addresses. It applies to you if your prospects are in Canada, even if your company is not. And when someone complains, the burden of proving you were allowed to send sits with you, not with them.

None of that makes outreach impossible. It makes sloppy outreach expensive.

What CASL actually covers

CASL regulates commercial electronic messages. That means any message sent to an electronic address that encourages participation in a commercial activity. A sales email obviously qualifies. So does a newsletter with a service mentioned in it, a webinar invitation, and a "just checking in" follow-up that ends with a link to your pricing page.

The comparison people get wrong is with the American law. CAN-SPAM is permissive: it broadly allows you to send commercial email to anyone until they opt out. CASL is the opposite shape. You need a reason to send before you send, and then you also need the identification and unsubscribe requirements on top.

A lot of Canadian teams have copied their outreach process from an American playbook, an American sales tool's default templates, or an American course. The process is legal where it was written and not legal where they are running it.

Express consent versus implied consent

There are two ways to have consent.

Express consent is someone actively agreeing to hear from you. A checked box that was not pre-checked, a form submission where the purpose was stated, a verbal agreement you wrote down. Express consent does not expire. It ends when the person withdraws it.

Implied consent comes from a relationship the law recognises, and it expires. The main one is an existing business relationship: someone bought from you, signed a contract, or made an inquiry. A purchase generally supports two years of implied consent from the transaction date. An inquiry generally supports six months.

That expiry is the part that quietly breaks. A contact enters your CRM in March after buying something, and two years later they are still on the monthly list because nothing in the system knows to remove them. The consent ran out and the sending did not.

The exemptions that matter for B2B

Separate from consent, CASL has exemptions. The one that makes B2B outreach workable is conspicuous publication.

It applies when three things are true at once. The person published their electronic address somewhere publicly visible. That publication did not carry a statement saying they do not want unsolicited commercial messages. And your message is relevant to their business role.

An operations director whose email sits on the company contact page, receiving a message about operations software, fits. That same person receiving a message about a personal investment product does not, because the message has nothing to do with their role.

What does not fit: an address you guessed from a first-initial-last-name pattern, an address scraped from a private database, or an address that came from a purchased list. Buying a list does not buy you consent. Someone else's consent for their own sending is not transferable to you, which is worth remembering before the next tool promises you 50,000 verified Canadian contacts.

There is also a referral exemption, which allows a single message when someone you have an existing relationship with refers you, provided you name the referrer in the message. One message. Not a sequence.

What every message must contain

This part applies regardless of which consent or exemption you are relying on, and it is the easiest thing to fix.

  • Who you are, and who you are sending on behalf of if that is someone else.
  • A mailing address.
  • At least one other way to reach you, valid for at least 60 days.
  • A clear, working unsubscribe mechanism, honoured within 10 business days.

Sales teams push back on this because a footer with a mailing address makes a one-to-one email look like a marketing blast. That is a legitimate design problem and it has a solution: put the block in small text at the bottom, keep it to two lines, and stop worrying about it. It is a fraction of the cost of the alternative.

The unsubscribe link is not optional on cold outreach either. If the message is commercial, it needs a way out.

The record-keeping that protects you

Here is the sentence that should change how you run your CRM: the burden of proof is on the sender.

If a complaint lands, nobody has to prove you lacked consent. You have to prove you had it. An email you cannot justify is treated as an email you were not allowed to send.

So the record matters more than the intention. For each contact, you want the source of the address, the date, the basis you are relying on, and, for express consent, the exact wording the person agreed to. If the basis is conspicuous publication, note where the address was published and when you found it.

This is a field in your CRM and a habit, not a project. If you are already working through CRM data hygiene, add consent source as a required field on contact creation and the problem mostly solves itself going forward. The historical records are harder, and honestly, some lists are better deleted than defended.

How this changes your outreach process

For a small team, the practical version is short.

  1. Record the basis at entry. Every contact gets a source and a consent basis when it is created. No exceptions, no backfilling later.
  2. Verify the address is genuinely published. If your process involves pattern-guessing addresses, that part has to stop for Canadian contacts. Verified-from-public-page is the standard.
  3. Put the compliance block in the template. Not in a checklist someone remembers. In the template, so a message cannot go without it.
  4. Run a quarterly expiry check. Contacts whose implied consent has aged out come off the list or get moved to a re-permission campaign.
  5. Keep unsubscribes forever. A suppression list is the one list you never clean.

None of this stops you doing real cold outreach. It stops you doing volume outreach to addresses you cannot account for, which was never the part that worked anyway. The teams getting replies are sending fewer, better-targeted messages to people whose role they actually understood before writing.

The takeaway

CASL asks one thing of you: know where every address came from.

The compliant version of B2B outreach in Canada looks like this: publicly published business addresses, messages relevant to the person's actual job, full identification and a working unsubscribe in every send, and a record for every contact explaining why you were allowed to write to them.

That is also, not coincidentally, what good outreach looks like. Know who you are writing to. Write something relevant. Keep the receipts.

This is general information about how CASL works, not legal advice. If you are running outreach at volume into Canada, have a Canadian lawyer review your specific process once. It is a cheap hour.