Is cold email legal in Canada?

If your cold email playbook was written for the US market, it's probably illegal in Canada. The reason is simple: Canada's Anti-Spam Legislation (CASL), in force since 2014, flips the American default. Under US CAN-SPAM, you can send first and offer an opt-out after. CASL is consent-first — no permission, no send. As one compliance analysis puts it, "CASL flips the default — no consent, no send."

This matters even if you never set foot in Canada. Jurisdiction follows the recipient, not the sender. A startup in Austin emailing a procurement lead in Toronto is subject to CASL even if it has no Canadian presence. A campaign that is perfectly legal in the US can accumulate six- and seven-figure exposure the moment it crosses into a Canadian inbox.

And the exposure is real. The maximum penalty is CAD $10 million per violation for businesses and $1 million for individuals. Enforcement isn't reserved for spam empires, either. In 2021, the CRTC fined CompuFinder for sending just 317 emails without consent or a working unsubscribe mechanism. Volume is not a prerequisite for a violation.

The CRTC — one of three bodies enforcing CASL, alongside the Privacy Commissioner and the Competition Bureau — also issued a $75,000 penalty to an individual that same year for sending messages without consent. Personal liability is on the table, and CASL's vicarious liability provisions mean companies can be held responsible for their employees' and contractors' sends.

What trips senders up most often:

• Purchased or scraped email lists, which lack verifiable consent by definition
• Mass "just checking in" blasts with no relevance to the recipient's role
• Missing sender identification or a functional unsubscribe link
• Assuming a US-legal template covers Canadian recipients

The complaint data backs this up. In a six-month CRTC reporting period, consent-related complaints were the largest category — 3,950 of 7,654 total — and rose month over month from 482 to 807. Notably, over 76% of reported messages came from affiliate marketers or legitimate businesses, not obvious fraudsters. The CRTC isn't just hunting scammers; it's auditing ordinary companies.

For small businesses running outreach — whether in-house or through an automated system — the takeaway is that Canadian recipients need to be treated as their own compliance segment. That means tagging contacts by consent type, tracking when implied consent expires, and keeping records of where each address came from. The CRTC's guidance is explicit: the burden of proving consent rests on the sender. If you cannot prove it, you do not have it.

Cold email into Canada remains viable. It just rewards precision over spray-and-pray — and punishes the US playbook that ignores the difference.

The good news for anyone running B2B outreach north of the border: CASL doesn't ban cold email outright. It bans sending without a valid consent basis — and the legislation carves out two narrow pathways that make compliant Canadian outreach genuinely workable. The catch is that both require precision, and the CRTC places the burden of proving consent squarely on the sender.

The first pathway is implied consent through an existing business relationship. If a prospect bought from you, signed a contract, or engaged your services, you can keep emailing them for 24 months after that relationship. If they merely made an inquiry — a quote request, a demo ask, a pricing question — the window shrinks to 6 months, per the CRTC's implied consent guidance and corroborating legal analysis. Once the clock runs out, you need express consent or you need to stop sending.

The second pathway is what practitioners call the conspicuous publication exception — widely described as "the legal backbone of compliant Canadian cold email." When a business professional posts their work email publicly — on a company website, directory listing, or professional profile — without a statement rejecting unsolicited messages, you may email them. But there's a hard condition: the message must be relevant to their role. As one compliance guide puts it, emailing a published [email protected] about an accounting tool can qualify; blasting that same address about unrelated SEO services likely does not.

Both pathways demand documentation, because the sender must be able to answer two questions for every contact:

• Where did this address come from, and when?
• Which consent basis applies — implied relationship, inquiry, or conspicuous publication?
• When does that consent expire (24 months, 6 months, or upon role change)?
• Is the message actually relevant to this recipient's job?

What never qualifies is a purchased or scraped list. These lack any verifiable consent basis and carry exposure of up to CAD $10 million per violation, according to CASL compliance analysis. Enforcement isn't theoretical, either: CRTC records show a violation involving just 317 emails, and one company was fined $1.1 million CAD for sending without proper consent, per a CASL compliance guide.

This is why outreach tooling matters as much as copywriting. Systems like AI Business Sites' outreach module handle consent tracking, suppression lists, and relevance targeting as built-in guardrails rather than afterthoughts — because in Canada, the list you build legally beats the list you buy.

Getting the consent right is only a third of the job. Once you have permission to send, the CRTC requires every commercial electronic message to clear two more hurdles — and miss any one of the three, and the message is non-compliant even if the other two are perfect.

According to the CRTC's official guidance, every commercial email must (1) be sent with valid consent, (2) identify the sender, and (3) offer a working unsubscribe mechanism. These aren't weighted or prioritized — they're a pass/fail checklist, and enforcement doesn't care whether the failure was sloppy or subtle. CompuFinder was found in violation over a campaign involving just 317 emails that lacked both consent and a functioning unsubscribe — proof that volume is not a prerequisite for a penalty.

Sender identification means your email must include your name, your business's name, a physical mailing address, and a valid reply-to address. The subject line must be honest — no misleading "Re: your invoice" tricks on a first-touch pitch. The physical address has to remain valid for at least 60 days after sending, so a virtual mailbox you're about to drop won't cut it.

The unsubscribe mechanism carries its own deadlines:

• Unsubscribe requests must be honored within 10 business days — not "eventually"
• The unsubscribe link must stay functional for at least 60 days after the send
• It must work in one step — no login walls, no "manage your preferences" mazes
• Opted-out addresses belong on a permanent suppression list, not a "clean later" folder

The unsubscribe requirement is where automation earns its keep. Platforms that handle outreach — including the compliant cold email workflows many Canadian B2B teams now run — bake one-click unsubscribe links and suppression lists into every send, because doing it manually across a growing campaign is how mistakes happen. At AI Business Sites, we treat this as table stakes for any outbound system touching Canadian inboxes: compliance logic lives in the pipeline, not in someone's memory.

Remember the stakes. CASL penalties reach CAD $10 million per violation for businesses, and the burden of proving consent rests entirely on the sender. A message with a flawless unsubscribe link and a perfect signature block is still illegal if the consent behind it can't be documented. Three requirements, one standard: all of them, every time.

Most business owners assume Canada's anti-spam law only catches overseas spam operations. The enforcement record tells a different story — and it reaches far smaller senders than most people expect.

In March 2021, the CRTC issued a $75,000 penalty to an individual, Scott William Brewer, for sending commercial electronic messages without consent. That case proves personal liability is real, not just a line in a compliance guide.

The same enforcement report shows CompuFinder was found in violation for sending just 317 emails without consent and without a functioning unsubscribe mechanism. Volume is not a prerequisite for enforcement.

The stakes scale quickly. One company was fined $1.1 million CAD for sending emails without proper consent, and typical settlements land between $100,000 and $200,000 even for first offenses. And these cases are not anomalies targeting fraudsters: over 76% of reported messages involved affiliate marketing or legitimate businesses selling goods and services.

Consent-related complaints were the largest category in the CRTC's reporting period, climbing from 482 in October 2020 to 807 in March 2021. During that same window, the regulator issued 143 Notices to Produce, 17 Preservation Demands, and 10 Warning Letters.

The burden of proof sits squarely on the sender. According to the CRTC's own guidance, "the onus of proving consent, be it express or implied, is on the person who claims they have consent." If you cannot prove consent, you do not have it. In practice, that means documenting:

• Where each address came from and why it qualified for outreach
• ## Building a Compliant Cold Email Workflow The gap between knowing the rules and running compliant campaigns is where most businesses stumble. Since the burden of proving consent rests on the sender — and as the CRTC puts it, if you cannot prove consent, you do not have it — your workflow needs to capture that proof before the first email goes out. It starts with where your addresses come from. Build lists only from publicly published business emails — company websites, directories, professional profiles — with no "no unsolicited messages" notice. This is the conspicuous publication exception, described as the legal backbone of compliant Canadian cold email. Never buy or scrape lists: purchased data lacks verifiable consent, and enforcement reaches legitimate senders — one company was found in violation over just 317 emails. Next, treat Canadian contacts as their own segment in your CRM. Because CASL applies based on the recipient's location, a campaign that's legal in the US can accumulate six- and seven-figure exposure the moment it crosses into Canadian inboxes. For each contact, tag the consent type and track its lifespan:
  • Implied consent via business relationship — valid 24 months after a purchase or contract, 6 months after an inquiry
  • Implied consent via conspicuous publication — valid only while the message stays relevant to the recipient's role
  • Express consent — no expiry, but keep records for three years after the relationship ends
  Set automated flags for expiring implied consent so a contact never receives an email after their window closes. Every message itself needs the three mandatory elements — consent basis, sender identification with a physical mailing address, and a functional unsubscribe honored within 10 business days. Here's the reframe worth adopting: the senders who win treat CAS as a forcing function for better targeting rather than a wall. Because you can only email people whose published roles match your offer, your lists get smaller but dramatically more relevant — and relevance is what drives replies anyway. For small businesses that don't want to become compliance experts, tooling can carry much of this load. AI Business Sites' Outreach add-on builds these safeguards in: consent handling, unsubscribe footers, and suppression lists are part of the system rather than an afterthought, so outbound campaigns run with the guardrails already in place. Combined with its Lead Generation add-on, which sources business contacts with their details and context, the targeting discipline CASL demands becomes the default rather than an extra chore. Compliance, done this way, stops being overhead and becomes a filter for quality.