Canadian outreach rules
Is cold email legal in Canada? On one narrow route, and not the one you have been told about.
CASL wants consent before you send, which puts Canada with Australia rather than with the United States. Everyone writing for B2B senders points at the business-to-business exemption. Read its conditions and it turns out to require a relationship between the two organisations, which a cold email does not have. What is left is one route, and it has three conditions.
General information, not legal advice. Checked against the CRTC on 29 September 2026. For Australia, see the Spam Act rules.
The thing everybody gets wrong
The B2B exemption exists, and it cannot reach a cold email
It is quoted constantly as the reason CASL is manageable for business senders. Its three conditions are in the CRTC's own FAQ, and the second one is fatal to cold outreach.
| The condition | A cold email |
|---|---|
| The message is between employees, representatives, consultants or franchisees of your organisation and the recipient organisation | Passes. This is what an outbound email is. |
| Your organisations have a relationship | Fails, by definition. If you had a relationship it would not be cold. |
| The message concerns the activities of the organisation you are sending to | Usually passes, if you have done the work. |
Two of three is nothing. And the CRTC closes the obvious workaround in the same breath: the mere fact that an employee of one organisation has a relationship with an employee of another does not necessarily result in a relationship between the organisations. Knowing somebody at the company is not a relationship between the companies.
So the exemption is for the email your account manager sends to a client's new procurement lead. It is not for the first email you ever send to a company, and any guidance that tells you otherwise has quoted the first condition and stopped.
What is actually left
Implied consent by conspicuous publication
The one route open to genuine cold outreach, and it will look familiar to anyone who has read the Australian rules, because it is the same three-part shape.
- The address was conspicuously published. On the company website, in a directory, on a public profile. Not inferred, not guessed from a naming pattern, not bought from a vendor who will not say where it came from.
- There is no statement in connection with the address that the person does not want to receive commercial electronic messages at it. A line on the contact page saying no unsolicited approaches removes the consent you were relying on.
- Your message is relevant to that person's business, role, functions or duties. Relevant to their role, not to your quota. A payroll pitch to the head of payroll passes; the same pitch to everyone whose address you could find does not.
If you already run outreach into Australia, you have met this test before. Australian inferred consent uses the same three parts. The difference is what happens when you fail it: in Australia you have breached the Spam Act, in Canada you have sent a message with no consent under a regime whose maximum penalties are ten times larger.
Once you are not cold any more
The other implied consent windows, and how long each lasts
These are what a sequence graduates into once somebody engages, and they are on a clock. Express consent, by contrast, does not expire unless it is withdrawn.
| What happened | How long implied consent lasts |
|---|---|
| They bought or leased goods, services, land or an interest in land from you | Two years from that day |
| They accepted a business, investment or gaming opportunity you offered | Two years from that day |
| They entered a written contract with you, still in existence or expired | Two years from expiry |
| They made an inquiry or application about any of the above | Six months from that day |
The six-month window is the one that catches teams out. Somebody fills in a form, nothing comes of it, and eight months later they land in a nurture sequence on the strength of a relationship that expired two months earlier.
What every message has to carry
Identification, an address, and an unsubscribe that outlives the campaign
These apply whatever your consent basis is. Having consent does not excuse a message that cannot be traced back to you.
- Who you are, and anyone the message is sent on behalf of
- A valid mailing address, usable for at least 60 days after you send
- An unsubscribe mechanism that can be readily performed
- That mechanism kept valid for at least 60 days after you send
- The request actioned without delay, and no later than 10 business days
- A hyperlink is acceptable for the identification details where putting them in the body is not practicable
Sixty days is the number to design around, because it outlives most campaigns. A sequence that is paused, edited or archived a fortnight after it ran still has to have a working unsubscribe link on the day somebody gets around to clicking it.
Whether it reaches you
Sending from outside Canada is not a defence
The CRTC puts it plainly: CASL applies so long as the commercial electronic message is sent using a computer system located in Canada, and the reach extends to the system used to access it.
The exposure is the largest in this cluster. Administrative monetary penalties run to $1 million per violation for an individual and $10 million per violation for a corporation. Against Australia, where ACMA issues infringement notices at a fraction of that, and Singapore, where there is no regulator at all and the remedy is a private suit, Canada is the market where getting it wrong costs the most.
How the five markets compare on the consent question is at cold email laws by country. Singapore is the permissive end: no consent needed before sending. The UK splits by whether the recipient is a company or a person: is cold email legal in the UK. The Philippines has no spam law at all and governs outreach through privacy law instead: is cold email legal in the Philippines.
Before you send into Canada
A checklist you can work through
Written for a team sending from outside Canada, because that is where the assumption that B2B is exempt comes from.
- Stop relying on the B2B exemption for anything cold. Check whether the two organisations have a relationship, and if they do not, you are on the conspicuous publication route instead.
- Record where each address was published, and keep the record. Consent is yours to prove, and a list you cannot trace is a list with no demonstrable basis.
- Check the page the address sits on for a statement refusing unsolicited messages, because that single line removes your basis.
- Test relevance against the person’s role rather than your product. If the same message goes to every title, it is not relevant to any of them.
- Put a real mailing address in the message and keep it usable for 60 days.
- Keep the unsubscribe link working for 60 days after the send, which means it has to survive the sequence being paused or archived.
- Action unsubscribes at once. Ten business days is the outer limit, not the plan.
- Watch the six-month window on inquiries, which expires long before anybody remembers it did.
Where software helps, and where it does not
What Empiraa Signal does about this
Signal sends from your own inbox, stops a sequence the moment somebody replies, and adds and hosts the unsubscribe link so it keeps working after a sequence is paused or archived, which is the part the 60-day rule is really about. It also records where a company entered your workspace, which is the beginning of a provenance record.
What it does not do. Signal does not check whether an address was conspicuously published, does not read the page it came from for a statement refusing messages, and does not judge whether your message is relevant to somebody's role. Those three are the whole of your consent basis in Canada, and they are yours. Any vendor claiming their software makes you CASL compliant is selling you something.
The other markets in this cluster: Australia, the UK, Singapore, and all of them side by side.
Questions people actually ask
Canadian cold email, answered
Is cold email legal in Canada?
Only on a narrow route. CASL requires consent before you send a commercial electronic message, and for someone you have never dealt with the only available consent is implied consent from a conspicuously published address. That requires the address to be published without a statement refusing such messages, and your message to be relevant to that person’s business, role, functions or duties. Miss either condition and you have no consent at all. CRTC guidance on implied consent.
Does CASL have a business-to-business exemption?
Yes, and it does nothing for cold email. The CRTC sets three conditions: the message is between representatives of your organisation and the recipient organisation, the two organisations have a relationship, and the message concerns the activities of the organisation you are sending to. Cold outreach fails the second by definition. The CRTC also says that one employee knowing an employee at another company does not create a relationship between the organisations. CRTC FAQ.
How long does consent last under CASL?
Express consent does not expire unless the person withdraws it. Implied consent is time-limited: two years from a purchase, lease, accepted business opportunity or written contract, and six months from an inquiry or application. Implied consent from a conspicuously published address is not on that clock, but it lasts only while the publication and its conditions still hold.
What must a CASL-compliant email contain?
Who you are, including anyone the message is sent on behalf of, a valid mailing address that stays usable for at least 60 days after you send, and an unsubscribe mechanism that can be readily performed and stays valid for at least 60 days. A hyperlink to a page carrying the identification details is acceptable where including them in the body is not practicable. CRTC FAQ.
How quickly do I have to action an unsubscribe in Canada?
Without delay, and no later than 10 business days after the request. That is the same outer limit as Singapore and twice the five working days Australia allows, but the words without delay sit in front of it, so ten days is a backstop rather than a budget.
Does CASL apply if I am sending from Australia?
Yes. The CRTC states that CASL applies so long as the message is sent using a computer system located in Canada, and the same reach covers the system used to access it. Being outside Canada is not a defence, and the penalties are the largest in this cluster: up to $1 million per violation for an individual and $10 million for a corporation.
Question not answered here? Ask ANI and get a straight answer.
Show your working
Primary sources
Checked against these on 29 September 2026. They are the authority; this page is a plain-English reading of them, and it is general information rather than legal advice.
- CRTC, guidance on implied consent for the conspicuous publication conditions and the two-year and six-month relationship windows.
- CRTC, CASL frequently asked questions for the three conditions of the business-to-business exemption, the statement that an employee-level relationship does not create one between organisations, the identification and unsubscribe requirements, the 60-day validity, the 10 business day deadline, the penalties and the computer-system-in-Canada test.
- Government of Canada, getting consent to send email for express consent not expiring unless withdrawn, and implied consent being time-limited.
Deliberately left out. A great deal of commentary warns about CASL's private right of action, which would let recipients sue. That provision was suspended in 2017 before it came into force, and we could not confirm its status today from a Government of Canada source. So this page neither warns you about it nor tells you it is safely gone. If you are sizing the risk of a Canadian programme, check its current status rather than relying on either a 2017 law firm note or on us.