Is Cold Email Legal in Canada? CASL Rules for B2B Senders

Cold email to Canada is legal when each message fits a route that Canada's Anti-Spam Legislation (CASL) allows, and illegal when it fits none. Section 6 of the Act prohibits sending a commercial electronic message unless the recipient has consented. The message must also identify the sender and include an unsubscribe mechanism.

Five routes matter to a B2B sender:

1. Express consent
2. Implied consent from an existing business relationship
3. Implied consent from an address the person published, when your message fits their role
4. A narrow exemption for organizations that already deal with each other
5. Messages the prospect asked for, plus one first message after a qualifying referral

A first email to a stranger that matches none of these breaks the law. A director's title and a work address do not change that. Government buyers work differently: selling to the Government of Canada as a supplier starts with registration, not email.

Every rule below comes from the Act, its two sets of regulations and guidance from the CRTC, the regulator that enforces CASL. Treat it as a practical reading for sales teams and get legal advice for your own case.

My team runs cold email campaigns mostly to the US, the UK and Europe. For Canada, make the consent record part of the list itself. No route, no send. Good copy cannot fix a contact you had no right to email, the same point I make about scraped lists and cold email. For other markets, cold email laws by country lists the official sources.

When does a sales email count as a commercial electronic message?

CASL calls a sales email a commercial electronic message, or CEM. A message is commercial when one of its purposes is to encourage the reader to take part in a commercial activity. That includes offers to buy, sell, barter or lease products, goods, services or land.

Almost every prospecting email qualifies. A first message proposing a call about your service is commercial. So is a soft "quick question" email whose real goal is that call. Calling the email research or networking changes nothing when the purpose behind it is a sale.

Which CASL rules apply to a B2B cold email?

CASL has no legitimate-interest route, unlike the European approach in legitimate interest assessment for cold email.

How do express and implied consent work under CASL?

Consent under CASL comes in two kinds, express and implied, according to the CRTC's guide to CASL compliance.

Express consent means the person agreed to receive your messages by taking an active step, such as signing up on your website. The CRTC's CASL FAQ adds that a pre-checked box does not count, and neither does silence or inaction.

SOR/2012-36 sets what a request for consent must contain, and the request can be made orally or in writing. One required detail is a statement that the person can withdraw consent.

So a prospect can give express consent on a discovery call or at a trade show stand, as long as the request names you, says what you will send, gives your contact details and says they can withdraw. Write down who agreed, when and how.

Implied consent exists only in situations the Act lists. B2B sellers meet the existing business relationship most often. Under the Act, that relationship means the person bought or leased something from you within the 2 years before your message, or made an inquiry or application to you within the 6 months before it. A contractor who asked for a quote 4 months ago leaves you about 2 more months from that inquiry alone.

Proof sits with you. The FAQ says the sender carries the onus of proving consent. Keep one record per contact with the route, the date it began and the evidence: a form entry, a call note, an invoice or a page link. If you cannot show it, count it as missing.

Does the B2B exemption cover cold email?

CASL applies to business-to-business email. The CRTC FAQ confirms that. The B2B exemption, set out in SOR/2013-221, covers messages between employees or representatives of organizations that have a relationship, when the message concerns the activities of the organization receiving it.

Both conditions must hold:

1. The two organizations already have a relationship. A company yours has never dealt with has none, so a true cold email fails here before its content matters.
2. The message concerns the recipient organization's activities. A supplier writing to a current client's operations lead about work that client does fits.

For most first emails, the published-address route is the one to test.

Can you email an address you found on a company website?

Sometimes, and this route is easy to misread. Under section 10(9) of the Act, consent is implied when all three conditions hold:

1. The person conspicuously published the address, or someone published it on their behalf.
2. The publication carries no statement that they do not want unsolicited commercial messages.
3. Your message relates to their business, role or duties in their working capacity.

The CRTC guide applies those tests to addresses found online. Section 10(9) of the Act also covers an address the person disclosed to you directly without saying they refuse messages.

A made-up example of the relevance test. A head of procurement at a civil engineering firm is listed with her email on the firm's team page. An offer of temporary site fencing for the firm's projects fits her role. A pitch about her personal retirement savings fails, because the address was published for her job.

Three assumptions that break down:

1. A visible inbox only passes the first test. Being online says nothing about refusal statements or relevance.
2. A data-tool record proves little. It does not show where the address was published or what sat next to it. If you cannot find a public source, you cannot prove the route.
3. A generic inbox such as info@ is a weak fit. It has no role to test relevance against.

The research that finds the right decision-maker should also save the page that published the address, with the date you saw it. How we think about that research is in our lists and targeting FAQ.

What does every commercial email to Canada need to contain?

SOR/2012-36 sets the identification details, and the Act requires them in every commercial email as well as in every consent request. For a cold email, that comes down to four items:

1. The name you carry on business under. If the message goes out on behalf of someone else, add their name too. When an agency or outsourced SDR sends for you, both names belong in the email.
2. A mailing address. Add at least one more contact method: a phone number, an email address or a website.
3. An unsubscribe that is easy to use (CASL's words: readily performed). The Act adds that it must be free and work through the same electronic means as the message or, if that is not practicable, another electronic means.
4. Visible placement. If the message cannot hold these details, put them on a web page and link to it clearly.

The CRTC FAQ sets the clock: unsubscribe requests must be processed within 10 business days of receipt. An opt-out has to stop every mailbox, tool and teammate that might write to that person, so keep one shared suppression list that every sender reads.

The footer adds lines, so keep the body to a length that fits cold email. Short, human emails beat templates that sound like a robot wrote them. A plain signature with company name, mailing address, website and one unsubscribe line covers CASL and still reads human.

How big are CASL penalties, and who enforces them?

The CRTC enforces CASL. Its 2026 CASL enforcement and compliance update puts administrative monetary penalties at up to CAD 10,000,000 per violation for a business and CAD 1,000,000 per violation for an individual.

The same update describes a "heightened expectation of compliance" for anyone sending commercial electronic messages to Canadians, and mentions a high volume of complaints.

Real cases sit far below the ceiling, but they are not small. The CRTC's list of enforcement actions shows a June 2024 undertaking with Hudson's Bay Company: a CAD 120,000 payment plus a compliance program for alleged CASL violations. In August 2026, Indeed Canada Corp. signed an undertaking with a CAD 200,000 payment and a compliance program.

Sending from abroad gives no cover. Under section 12 of the Act, a person contravenes section 6 only if a computer system located in Canada is used to send or access the message. An email read in Toronto falls in scope even when it left a server in Prague or Texas.

For a small campaign, the everyday risk is plainer. Any recipient can report a message to the government's Spam Reporting Centre, so 500 emails with no consent route hand 500 people that option.

How do you decide whether a first email to a Canadian prospect is allowed?

CASL answers this one contact at a time. Run each contact through these questions in order. If question 1 is a no, the consent rules do not apply. From question 2 on, stop at the first "yes".

1. Is the email commercial? If any purpose is to move the reader toward a commercial activity, yes. Almost every prospecting email is.
2. Did they ask for it? Paragraph 3(b) of SOR/2013-221 exempts messages sent to a person who requested or otherwise solicited them. Yes: reply.
3. Did someone refer them to you? The Electronic Commerce Protection Regulations (SOR/2013-221) cover one first message after a qualifying referral. The conditions are in the questions at the end. After that one message you need consent.
4. Is express consent on record? Yes: send.
5. Is there an existing business relationship still inside its window? Yes: send, and put the expiry date in your CRM.
6. Do the two organizations already have a relationship, and is the email about the recipient organization's activities? Yes: the B2B exemption may apply.
7. Was the address published or given to you, with no refusal statement, and does the email fit their role? If you also saved the proof, yes: implied consent.
8. None of the above? Do not email. Find a route first, for example a referral, a meeting in person or a form on your own site, and let the prospect ask for your email.

Step 8 is close to how I like to run outreach anyway: the email comes after a LinkedIn touch, never before it. But LinkedIn is no loophole. The CRTC's answer on social media messages says a message sent to a social media account counts as a message to an electronic address. A LinkedIn inbox is that kind of account, so a cold pitch there needs a route too.

When a prospect replies on LinkedIn and asks for details by email, that email answers a request, so step 2 covers it.

LinkedIn first can carry most of a campaign, because conversations come first and calls come out of conversations. The same route check still applies to every email in it. One financial advisory client in Canada ran on LinkedIn content, LinkedIn outreach and follow-up emails after the LinkedIn touch. It booked 19 sales calls in month 1, 26 in month 2 and 32 in month 3, then 421 over 12 months, all meetings that came out of LinkedIn and email conversations.

Three leads, three answers

A made-up example. You sell temporary site fencing and want to email three people at Canadian construction and civil engineering firms.

Lead 1 is the procurement head from earlier. Her address sits under her name on the team page with no statement against marketing, and your offer fits what she buys. Route: published address. Save the page link, a dated screenshot and one line on why it fits, then send with the full footer.

Lead 2 is an operations director at a construction company whose address came from a data tool. It appears nowhere public, and the company's contact page says it does not accept unsolicited sales offers. Route: none. If his address turned up on that same site, that statement would likely block the route there too.

Lead 3 is a project manager at a contractor who filled in your quote form 5 months ago and never bought. Route: implied consent from an inquiry, with about 1 month left. Email now and use that month to earn express consent, for example with a pricing update they opt in to receive.

Before the first send

1. Every contact has a consent route, a start date and evidence next to it. A contact with no route comes off the list.
2. Every published-address contact has a page link, a capture date, a refusal-statement check and a one-line relevance reason.
3. Every relationship-based contact has its expiry date in the CRM.
4. Every template carries the full footer, and the unsubscribe link has been tested.
5. Opt-outs reach every mailbox and tool inside the deadline.
6. Sending infrastructure is ready before day one: domains, SPF, DKIM and DMARC set up, and every mailbox warmed up.

If you are planning a first outreach list for Canada and want a second opinion on the consent record behind it, I can review a sample. Book a call.