Canada CASL Requirements

Canada’s Anti-Spam Legislation (CASL) is one of the strictest anti-spam laws in the world. TextFlow is built with CASL compliance at its core, helping you send messages legally to Canadian recipients.

What is CASL?

CASL (Canada’s Anti-Spam Legislation) came into effect July 1, 2014. It regulates:

Commercial Electronic Messages (CEMs)
Email, SMS, and other electronic communications
Consent requirements for commercial messages
Penalties for non-compliance

Who Does CASL Apply To?

CASL applies if you:

Send commercial messages to Canadian recipients
Send from Canadian infrastructure
Are a Canadian business

Important: CASL applies based on recipient location, not sender location. If you send commercial SMS to someone in Canada, CASL applies.

CASL Core Requirements

Before sending commercial messages, you must have:

Express Consent (Preferred):

Recipient explicitly opted in
Written or verbal agreement
Clear understanding of what they’re subscribing to
Record of when and how consent was obtained

Implied Consent (Limited):

Existing business relationship (within 2 years of purchase)
Existing non-business relationship (within 2 years of donation/membership)
Conspicuously published contact info (business-to-business only)
Inquiry or application (within 6 months)

2. Identification

Every commercial message must include:

Sender identity - Who is sending the message
Contact information - How to reach the sender
Physical address - Valid mailing address

3. Unsubscribe Mechanism

Every commercial message must:

Include clear opt-out instructions
Process opt-outs within 10 business days
Be free of charge to use
Remain valid for at least 60 days

TextFlow CASL Compliance Features

Automatic Opt-Out Processing

TextFlow automatically processes these keywords:

STOP - Standard English opt-out
ARRET - French opt-out
UNSUBSCRIBE - Alternative opt-out
CANCEL - Alternative opt-out
END - Alternative opt-out
QUIT - Alternative opt-out

When a recipient sends any of these keywords:

They’re immediately marked as opted out
No further messages can be sent to them
The action is logged in the audit trail
They receive a confirmation of their opt-out

Quiet Hours Enforcement

TextFlow enforces messaging windows:

9:00 AM - 9:00 PM in recipient’s timezone
Messages scheduled outside these hours are held until the next window
Emergency messages can bypass quiet hours (with proper justification)

TextFlow maintains records of:

When consent was obtained
How consent was obtained (import, signup form, etc.)
Consent type (express or implied)
Opt-out history

Audit Logging

All messaging activity is logged:

Message sent timestamp
Recipient information
Consent status at time of sending
Opt-out requests and processing

When using TextFlow signup forms:

Include clear consent language
Explain what messages they’ll receive
Don’t pre-check consent boxes
Link to your privacy policy

Example Consent Language:

"By providing your phone number and checking this box,
you consent to receive promotional SMS messages from
[Business Name]. Message frequency varies. Msg & data
rates may apply. Reply STOP to unsubscribe."

Import Requirements

When importing contacts:

Only import contacts who have given consent
Record the source and date of consent
Tag contacts by consent type
Don’t import purchased lists

CWTA Guidelines

The Canadian Wireless Telecommunications Association (CWTA) provides additional SMS guidelines:

Message Content

Clearly identify the sender
Include opt-out instructions
Don’t send deceptive content
Respect frequency preferences

Opt-Out Compliance

Immediate cessation of messages
Confirmation of opt-out
No re-subscription without new consent
10 business day maximum processing time

Carrier Compliance

Register with carriers (for high-volume senders)
Follow throughput limits
Maintain sender reputation
Report spam complaints

Penalties for Non-Compliance

CASL has significant penalties:

Violation	Maximum Penalty
Individual	$1,000,000 per violation
Corporation	$10,000,000 per violation

Additional consequences:

Injunctions and consent orders
Class action lawsuits (private right of action)
Reputational damage
Carrier suspension

CASL vs. US Regulations

Requirement	CASL (Canada)	TCPA (US)
Express Consent	Required	Required for marketing
Implied Consent	Limited (2 years max)	More permissive
Opt-Out Timeframe	10 business days	10 business days
Sender Identification	Required	Required
Physical Address	Required	Not required for SMS
Penalties	Up to $10M	Up to $1,500 per message
Private Right of Action	Yes (suspended)	Yes

Transactional vs. Commercial Messages

Not all messages require consent:

Exempt Messages (Non-Commercial)

Order confirmations
Shipping notifications
Appointment reminders
Account security alerts
Two-factor authentication
Emergency notifications

Sales and promotions
New product announcements
Special offers
Marketing campaigns
Loyalty program updates
Re-engagement messages

Gray Area: Messages that contain both transactional and commercial content are considered commercial and require consent.

Best Practices Checklist

Before Sending

Verify consent status for all recipients
Check that opted-out contacts are excluded
Include sender identification
Include opt-out instructions
Review message for commercial content

Document consent source and date
Use double opt-in when possible
Honor implied consent expiration (2 years)
Regularly clean your contact list
Keep records for 3+ years

Opt-Out Handling

FAQs

If the reminder is purely transactional (time, date, location only), no. If it includes promotional content, yes.

Keep records for at least 3 years, or longer if you have ongoing campaigns.

Can I import my email list for SMS marketing?

Only if your email consent explicitly included SMS. Email consent doesn’t automatically transfer to SMS.

What if someone gives me their business card?

A business card implies consent for business-to-business communication only, and only for a limited time. It’s not consent for marketing messages.

Do I need French opt-out keywords?

For campaigns targeting Quebec or bilingual recipients, yes. TextFlow automatically processes ARRET as an opt-out.

Resources

Continue to: