Skip to content
Security & Compliance

CASL Compliance in AcelleMail: What Canadian Senders Need

Canada's Anti-Spam Legislation is one of the strictest in the world — fines reach CAD $10 million per violation. This guide covers express vs implied consent, what every Canadian CEM must contain, and how to record consent inside AcelleMail.

5 min read Intermediate

What this is for

Canada's Anti-Spam Legislation (CASL, in force since 2014) is the strictest commercial-email law in the world. It covers any "commercial electronic message" (CEM) sent to or from a Canadian recipient — so even non-Canadian businesses owe compliance the moment they email someone in Canada. Penalties go to CAD $10 million per violation for businesses and CAD $1 million for individuals.

CASL differs from CAN-SPAM in one big way: CASL is opt-in by default. You need consent before you send. CAN-SPAM is opt-out — you can send first, must allow unsubscribe. If you're emailing both audiences, CASL is the higher bar — meet it and you've automatically met CAN-SPAM.

Express vs implied consent

Every Canadian subscriber on your list needs either express consent or a valid implied-consent category.

Type Definition Expires
Express Subscriber actively opted in — ticked an un-pre-ticked checkbox, filled a signup form, confirmed via double opt-in Never (until they withdraw)
Implied — existing business relationship They bought from you, made an inquiry, or had a contract with you 2 years after the transaction
Implied — non-business relationship They donated to your charity or volunteered 2 years
Implied — membership They are an active member of your club, association, or political party While membership is active
Implied — conspicuous publication They published their business email publicly without a "no spam" notice Only for messages relevant to their role

Key practical rule: the burden of proof is on you, not the regulator. If a Canadian subscriber files a complaint, you must produce when, where, and how their consent was obtained. If you can't, the consent is treated as never having existed.

What every CEM must contain

CASL §6 requires four things in the body of every commercial email:

  1. Your full legal name (or operating name, if different and registered)
  2. A mailing address plus one of: telephone, email, or website URL
  3. A clear, functioning unsubscribe mechanism — link or reply-to instruction
  4. Unsubscribe must be honoured within 10 business days

AcelleMail handles #3 (unsubscribe link is automatic) and #4 (suppression is instant — well under the 10-day ceiling). #1 and #2 you fill in once at Account → Contact — Company info (legal name) + Address card — and AcelleMail injects both into every campaign footer.

Recording consent inside AcelleMail

CASL audits are paperwork-heavy. The fastest way to stay defensible is to record consent origin at signup as a list custom field.

  1. Open Lists → [your list] → Manage list fields
  2. Click Create field and add a text field called consent_source
  3. (Optional) Add a second text field consent_date — type date
  4. In your signup form (built in Forms → [your form] → Edit), include both fields as hidden inputs pre-populated with the source (e.g. homepage-hero-2026-05) and current date
  5. Confirm by opening one new subscriber after signup — both fields should be populated under the subscriber's profile

That gives you a per-subscriber record of where and when consent was obtained, queryable from the subscribers table.

For higher-stakes audits — large lists, regulated industries — turn on double opt-in under Lists → [your list] → Edit → Subscription settings. Double opt-in produces a server-side log entry every time someone confirms, which is admissible as a record of express consent. See Double Opt-In vs Single Opt-In.

The transition period is over

CASL gave a three-year window for "implied consent from before July 2014" to ride out without action — that window closed July 1, 2017. Any consent that was implied-only on July 1, 2014, has long since expired. If you haven't audited your Canadian segment since then, do it now: anyone with neither express consent nor an active implied-consent category must be removed.

The fastest way to surface this in AcelleMail: build a segment filtered by country = Canada AND consent_source IS NULL, export to CSV, and decide row-by-row. See Advanced Segmentation Strategies for the segment builder.

Common issues

What you see What to do
You inherited a list and have no record of how Canadian subscribers were collected Segment them out and re-permission via a single confirmation email ("Do you still want to hear from us?"). Anyone who clicks confirm becomes express-consent. The rest must be removed.
Your form has a pre-ticked consent checkbox Un-tick it. CASL (and GDPR) explicitly disallow pre-ticked boxes as express consent.
consent_source is empty for old subscribers Backfill what you can ("pre-2024-migration") — partial provenance is better than none. Going forward, every new signup should populate it from a hidden form field.

What to do after

  1. Verify Account → Contact has your legal name + mailing address filled in.
  2. If you collect Canadian subscribers, turn on double opt-in on those lists.
  3. Add consent_source + consent_date custom fields to every list that collects email.

Related articles

Tagged

5 comments

4 comments

  1. Akira
    Add audit logging for every admin action. We added a small middleware that logs to S3 — invaluable when answering compliance questions retroactively
    1. Admin
      Middleware to S3 is the right shape for this, mostly because CASL puts the burden of proof on the sender. When a complaint lands you're being asked to show consent as it stood on the send date, not as it stands now, and an append-only log off-box is the only thing that survives someone editing a list later. The gap most people hit is that admin-action logs cover who changed what, but not the consent state of the subscriber at the moment the campaign went out. Worth logging that too if you aren't already, express vs implied and the source, since implied consent expires at 24 months and you'll want the clock start on record. We don't ship an admin audit log today. It's on the list and it keeps getting pushed. Happy to put a note about the middleware pattern in the article, if you can share the rough shape of what fields you capture I'll write it up properly rather than guessing.
  2. Tomas
    passed a soc 2 audit last quarter using this as part of our documentation set. auditors specifically noted the data-flow diagram was helpful.
  3. Olufemi
    for HIPAA — is AcelleMail considered a Business Associate? Looking at whether we need a BAA.
  4. Ahmed
    the gdpr data-export article is what i sent to our dpo. saved us a meeting.

Related reading

More in Security & Compliance

Run your email marketing on your own server, your own terms

Join thousands of companies that have taken control of their email marketing with full source code, no recurring fees, and unlimited sending. One-time $80 license, lifetime updates.

Get the AcelleMail newsletter

Monthly issue with new releases, deliverability tips, and self-hosting playbooks. No spam.