Does CASL apply to my SaaS onboarding and marketing emails?

What counts as a commercial message

CASL regulates the commercial electronic message, or CEM. A message is commercial if, looking at its content, its links or its contact details, it would be reasonable to conclude that one of its purposes is to encourage participation in a commercial activity. That covers email, text messages and messages to other electronic addresses.

So the real question is whether any part of the message nudges the reader toward a purchase or upgrade. A welcome email that explains how to log in is one thing. A welcome email that ends with “Upgrade to Pro and save 20%” now has a commercial purpose.

Service messages vs marketing

Section 6(6) exempts certain messages from the consent requirement, including ones that solely give factual information about the recipient’s ongoing subscription, membership or account, and ones that deliver a product or service, including updates or upgrades, the recipient is already entitled to. The word “solely” does a lot of work.

A release note telling paying customers that a feature they already pay for has changed is service content. A “what’s new” email announcing a premium add-on with a “start trial” button is promotion. If you blend the two in one newsletter, treat the whole thing as a CEM.

A cleaner approach is two streams:

• Service stream: password resets, billing notices, security alerts, plan changes the customer made, outage notices.
• Marketing stream: upsells, feature launches tied to paid tiers, webinars, case studies, referral offers, and cart or trial-expiry nudges that push a purchase.

Express and implied consent

Express consent is an active “yes.” The Government of Canada’s guidance says it has no time limit unless the person withdraws it. Under the Electronic Commerce Protection Regulations, a request for express consent must say clearly why you’re asking, identify who’s asking (with a mailing address and a phone number, email or web address) and say the person can withdraw consent. The CRTC’s consent guidelines say a pre-checked box isn’t express consent, and that consent must be sought separately from your general terms and conditions. So ask with an unticked box and plain wording about what people will receive.

Implied consent arises only in situations the Act lists. The most common for software companies is an existing business relationship:

• A purchase or a written contract supports implied consent for two years.
• An inquiry or application, such as a demo request or a pricing question, supports it for six months.
• A conspicuously published business email address can support it, but only if there’s no statement that the person doesn’t want unsolicited messages and the message is relevant to their business role.

Implied consent is a clock, not a permanent licence. A free-trial user who never converts may only give you the six-month window. Ask for express consent at signup and again at checkout.

Keep a record of when, where and how each person agreed. Under section 13 of the Act, the person claiming consent has to prove it.

What every commercial email must include

Even with valid consent, every CEM must:

• Identify the sender by name, and anyone on whose behalf it’s sent.
• Include a mailing address and a phone number, email address or web address.
• Use contact information that stays valid for at least 60 days after sending.
• Include an unsubscribe mechanism.

Unsubscribes must take effect without delay, and no later than 10 business days after the request. The risk usually sits elsewhere: a CRM sync that reimports unsubscribed contacts, a sales tool that never got the suppression list, or an AI outreach platform with its own list. Keep one suppression list and push it to every tool that can send.

AI-written sales outreach

CASL doesn’t care who or what wrote the email. An AI sales agent drafting personalized cold emails is still sending CEMs on your behalf. Some traps specific to AI outreach:

• Scraped lists. Pulling addresses from directories or social profiles doesn’t create consent. The conspicuous-publication route only works where the address was published by the person or with their permission and the message relates to their role.
• Volume. Under section 20(4), administrative penalties are set per violation, up to $1 million for an individual and $10 million for an organization, so a mistake repeated at scale gets expensive.
• Accuracy. The Competition Act prohibits false or misleading representations to the public, whether a model or a person wrote the copy.
• Sender identity. Every message must identify the real business behind it, even if a tool or agency hits send.

If you’re building AI agents that send messages for your own customers, your SaaS agreement and acceptable use terms should say who’s responsible for consent.

Servers outside Canada

Under section 12(1), CASL’s anti-spam rule applies if a computer system in Canada is used to send or access the message. A recipient opening your email in Canada can bring it into scope even if your company and email provider are elsewhere.

Penalties and lawsuits

Administrative penalties are set case by case, up to the maximums above. The Act’s private right of action (sections 47 to 51) was repealed before it ever came into force, so enforcement comes from regulators.

CASL and privacy law

CASL doesn’t replace privacy law. The names and email addresses on your lists are personal information, so PIPEDA applies to how you collect and use them too. See privacy policies for apps and privacy and data.

What to do next

Try our CASL consent checker for a quick read on a single message. We review sign-up and consent flows as an email marketing (CASL) review, at fixed fees on our fees page.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To talk through your email and consent setup, book a free 15-minute consult.