# CASL Compliance in AcelleMail: What Canadian Senders Need

> Canada's Anti-Spam Legislation is one of the strictest in the world — fines reach CAD $10 million per violation. This guide covers express vs implied consent, what every Canadian CEM must contain, and how to record consent inside AcelleMail.

- Canonical URL: https://acellesend.com/kb/articles/casl-canadian-anti-spam-requirements
- Author: Daniel Reyes, Technical Editor
- Category: Security & Compliance — GDPR, CAN-SPAM, CASL, SSL/TLS, encryption, data privacy, audit
- Content type: guide · Difficulty: intermediate
- Tags: Acellemail
- Published: 2026-03-29 · Last updated: 2026-08-15
- Reading time: 5 min
- Publisher: AcelleMail Knowledge Base, https://acellesend.com/kb

---

## What this is for

Canada's Anti-Spam Legislation (CASL, in force since 2014) is the strictest commercial-email law in the world. It covers any "commercial electronic message" (CEM) sent **to or from** a Canadian recipient — so even non-Canadian businesses owe compliance the moment they email someone in Canada. Penalties go to **CAD $10 million per violation** for businesses and **CAD $1 million** for individuals.

CASL differs from CAN-SPAM in one big way: **CASL is opt-in by default**. You need consent before you send. CAN-SPAM is opt-out — you can send first, must allow unsubscribe. If you're emailing both audiences, CASL is the higher bar — meet it and you've automatically met CAN-SPAM.

## Express vs implied consent

Every Canadian subscriber on your list needs **either** express consent or a valid implied-consent category.

| Type | Definition | Expires |
|---|---|---|
| **Express** | Subscriber actively opted in — ticked an un-pre-ticked checkbox, filled a signup form, confirmed via double opt-in | Never (until they withdraw) |
| **Implied — existing business relationship** | They bought from you, made an inquiry, or had a contract with you | **2 years** after the transaction |
| **Implied — non-business relationship** | They donated to your charity or volunteered | **2 years** |
| **Implied — membership** | They are an active member of your club, association, or political party | While membership is active |
| **Implied — conspicuous publication** | They published their business email publicly without a "no spam" notice | Only for messages relevant to their role |

**Key practical rule:** the burden of proof is on **you**, not the regulator. If a Canadian subscriber files a complaint, you must produce **when, where, and how** their consent was obtained. If you can't, the consent is treated as never having existed.

## What every CEM must contain

CASL §6 requires four things in the body of every commercial email:

1. **Your full legal name** (or operating name, if different and registered)
2. **A mailing address** plus **one** of: telephone, email, or website URL
3. **A clear, functioning unsubscribe mechanism** — link or reply-to instruction
4. **Unsubscribe must be honoured within 10 business days**

AcelleMail handles #3 (unsubscribe link is automatic) and #4 (suppression is instant — well under the 10-day ceiling). #1 and #2 you fill in once at **Account → Contact** — *Company info* (legal name) + *Address* card — and AcelleMail injects both into every campaign footer.

## Recording consent inside AcelleMail

CASL audits are paperwork-heavy. The fastest way to stay defensible is to **record consent origin at signup** as a list custom field.

1. Open **Lists → [your list] → Manage list fields**
2. Click **Create field** and add a text field called `consent_source`
3. (Optional) Add a second text field `consent_date` — type `date`
4. In your signup form (built in **Forms → [your form] → Edit**), include both fields as **hidden inputs** pre-populated with the source (e.g. `homepage-hero-2026-05`) and current date
5. Confirm by opening one new subscriber after signup — both fields should be populated under the subscriber's profile

That gives you a per-subscriber record of where and when consent was obtained, queryable from the subscribers table.

For higher-stakes audits — large lists, regulated industries — turn on **double opt-in** under **Lists → [your list] → Edit → Subscription settings**. Double opt-in produces a server-side log entry every time someone confirms, which is admissible as a record of express consent. See [Double Opt-In vs Single Opt-In](https://acellesend.com/kb/articles/double-opt-in-vs-single-opt-in-which-to-choose).

## The transition period is over

CASL gave a three-year window for "implied consent from before July 2014" to ride out without action — that window **closed July 1, 2017**. Any consent that was implied-only on July 1, 2014, has long since expired. If you haven't audited your Canadian segment since then, do it now: anyone with neither express consent nor an active implied-consent category must be removed.

The fastest way to surface this in AcelleMail: build a segment filtered by `country = Canada` AND `consent_source IS NULL`, export to CSV, and decide row-by-row. See [Advanced Segmentation Strategies](https://acellesend.com/kb/articles/advanced-segmentation-strategies) for the segment builder.

## Common issues

| What you see | What to do |
|---|---|
| You inherited a list and have no record of how Canadian subscribers were collected | Segment them out and re-permission via a single confirmation email ("Do you still want to hear from us?"). Anyone who clicks confirm becomes express-consent. The rest must be removed. |
| Your form has a pre-ticked consent checkbox | Un-tick it. CASL (and GDPR) explicitly disallow pre-ticked boxes as express consent. |
| `consent_source` is empty for old subscribers | Backfill what you can ("pre-2024-migration") — partial provenance is better than none. Going forward, every new signup should populate it from a hidden form field. |

## What to do after

1. Verify **Account → Contact** has your **legal name** + **mailing address** filled in.
2. If you collect Canadian subscribers, turn on **double opt-in** on those lists.
3. Add `consent_source` + `consent_date` custom fields to every list that collects email.

## Related articles

- [CAN-SPAM Compliance in AcelleMail](https://acellesend.com/kb/articles/can-spam-compliance-checklist)
- [GDPR Compliance for Email Marketing](https://acellesend.com/kb/articles/gdpr-compliance-guide-for-email-marketing)
- [Double Opt-In vs Single Opt-In: Which to Choose](https://acellesend.com/kb/articles/double-opt-in-vs-single-opt-in-which-to-choose)
- [Creating Effective Signup Forms and Landing Pages](https://acellesend.com/kb/articles/creating-effective-signup-forms-and-landing-pages)

---

## Related articles

- [GDPR Compliance for Email Marketing with AcelleMail](https://acellesend.com/kb/articles/gdpr-compliance-guide-for-email-marketing): GDPR governs how you process EU residents' personal data — and email addresses are personal data. This guide walks the five obligations that touch email marketing (consent, access, erasure, portability, processor agreements) and shows the AcelleMail UI for each.
- [Data Encryption for Self-Hosted AcelleMail](https://acellesend.com/kb/articles/data-encryption-for-self-hosted-platforms): Self-hosting means your subscribers' data lives on your server, not a third party's — which puts encryption in your hands. Here's what actually matters: protecting data in transit, at rest, and in your backups, in plain terms, without a sysadmin wall.
- [CAN-SPAM Compliance in AcelleMail: The 7-Point Checklist](https://acellesend.com/kb/articles/can-spam-compliance-checklist): CAN-SPAM applies to every commercial email you send to a US recipient — fines reach $51,744 per violating message. This checklist walks the 7 rules, marks the ones AcelleMail enforces for you, and tells you exactly where to set the rest.
- [BIMI with VMC — Cost, Process, and Whether It's Worth It](https://acellesend.com/kb/articles/bimi-with-vmc-cost-walkthrough): VMC (Verified Mark Certificate) costs $1,500/yr per domain and takes 4-8 weeks to obtain. This guide walks the cost math, the trademark requirements, the alternative paths, and a decision framework for whether VMC is right for your sending program.
- [Building Your Email Marketing SaaS](https://acellesend.com/kb/articles/building-your-email-marketing-saas): The technology side of an AcelleMail SaaS is solved. The hard part is the business: who you sell to, how you price, how you reach them, and how you keep them. This guide is the GTM + pricing playbook — opinionated, market-tested patterns for launching an email-marketing SaaS on the AcelleMail stack.