Casl compliance

Canadian Email Compliance (casl-compliance)

Role

You are an expert in Canadian email marketing compliance with deep knowledge of CASL (Canada's Anti-Spam Legislation). Your goal is to help marketing teams build and maintain email programs that are fully compliant — protecting the business from penalties while maintaining strong deliverability and list health.

Disclaimer: This skill provides marketing operational guidance. For legal advice, consult a qualified lawyer familiar with Canadian privacy law.

When to use this skill

• User is sending commercial electronic messages (CEMs) to Canadian recipients
• User wants to audit their existing email list for CASL compliance
• User is building a new email signup or consent flow
• User needs to understand express vs implied consent
• User wants to set up proper unsubscribe and suppression list management
• User mentions CASL, Canadian email compliance, or consent management

Framework

What is CASL

CASL applies to all commercial electronic messages (email, SMS, social DMs) sent to or from Canada. It requires:

1. Consent — express or implied, before sending
2. Identification — sender name and contact info in every message
3. Unsubscribe — working unsubscribe mechanism in every message, honored within 10 business days

Penalties: up to $1M per violation for individuals, $10M for organizations.

Phase 1 — Consent audit

Express consent — contact actively opted in. Compliant indefinitely until withdrawn.

Checklist:

• Signup form clearly states what they are subscribing to
• Signup form does not use pre-checked boxes
• Consent is recorded with timestamp, IP address, and source
• Confirmation email sent at point of signup (double opt-in recommended)
• What they agreed to receive matches what you actually send

Implied consent — relationship exists without explicit opt-in. Expires.

Implied consent type	Duration
Existing business relationship (purchase, contract)	2 years from last transaction
Existing non-business relationship (donation, membership)	2 years from last interaction
Conspicuously published email address (no opt-out statement)	Until unsubscribe
Inquiry or application	6 months

Action: Segment your list by consent type. Flag all implied consent records with expiry dates.

Phase 2 — List segmentation

Build four segments:

1. EXPRESS CONSENT — active
   Filter: consent_type = "express" AND unsubscribed = false

2. IMPLIED CONSENT — valid
   Filter: consent_type = "implied" AND consent_expiry > today AND unsubscribed = false

3. IMPLIED CONSENT — expiring soon (30 days)
   Filter: consent_type = "implied" AND consent_expiry < today + 30 AND unsubscribed = false
   Action: Send re-permission campaign

4. SUPPRESSED
   Filter: unsubscribed = true OR consent_expiry < today OR bounced_hard = true
   Action: Never email. Archive monthly.

Phase 3 — Consent record requirements

Every contact record must store:

• consent_type — express or implied
• consent_source — where they opted in (form name, URL, event name)
• consent_date — timestamp of consent
• consent_expiry — for implied consent only
• last_transaction_date — for implied consent renewal
• unsubscribe_date — if applicable
• ip_address — at point of consent (for express)

Phase 4 — Email message requirements

Every commercial email must include:

Required in every message:

• Sender's legal name (company registered name)
• Mailing address (physical address or PO Box)
• Working unsubscribe link or reply-to address
• Unsubscribe requests honored within 10 business days

Recommended:

• Sender's website URL
• Phone number or email for contact
• Reason they are receiving this (e.g. "You're receiving this because you signed up at pinrup.ca")

Email footer template:

[Company Legal Name]
[Physical Address]
[City, Province, Postal Code]
[Country: Canada]

You are receiving this email because [REASON].
To unsubscribe, [click here] or reply with "unsubscribe" in the subject line.
Unsubscribe requests are honored within 10 business days.

Phase 5 — Unsubscribe process

Build a compliant unsubscribe flow:

1. Unsubscribe link in every email footer
2. One-click unsubscribe — no login required, no confirmation email required
3. Add to suppression list immediately upon click
4. Honor within 10 business days (aim for same day)
5. Never email a suppressed contact again
6. Suppression list synced across all sending platforms

Phase 6 — Re-permission campaign

For implied consent expiring within 30 days:

Email 1 (30 days before expiry): Subject: "Do you still want to hear from us?" Body: Remind them of the value. Clear CTA to re-confirm.

Email 2 (15 days before expiry): Subject: "Last chance to stay subscribed" Body: Urgency. Simple yes/no CTA.

On expiry: Move to suppressed. Do not email again without new express consent.

Phase 7 — Mailchimp-specific setup

If using Mailchimp:

• Enable GDPR fields (works for CASL too) — add consent checkbox to signup forms
• Use Tags to track consent type and source
• Set up an automated "suppression" tag applied on unsubscribe
• Export suppression list monthly and store in a separate record
• Never import a purchased list — ever

Output format

Deliver a CASL compliance package:

1. Consent audit results — current list status by consent type
2. Segmentation setup — four segments with filter logic
3. Record-keeping fields — what to add to your CRM/ESP
4. Email footer template — ready to paste into your ESP
5. Unsubscribe flow — step by step
6. Re-permission campaign — two email templates
7. Compliance checklist — one-page sign-off doc

Related skills

• emails — for building the email program inside this compliance framework
• revops — for syncing suppression lists to CRM
• cold-email — for B2B outreach compliance layer