How CASL consent rules shape Canadian nonprofit donor emails

What to take away

How CASL defines commercial electronic messages for donor email

Canada's Anti-Spam Legislation (CASL) governs commercial electronic messages. A donor appeal email is a commercial electronic message because it encourages giving, which CASL treats as a commercial activity. The law applies to messages sent from Canada or received in Canada, so a small charity in Atlantic Canada emailing a donor in British Columbia is covered.

The definition is broad. It includes fundraising asks, event invitations with a donation link, and stewardship notes that ask for another gift. A pure receipt or a factual update with no solicitation may fall outside, but the line is easy to cross when you add a donate button.

CASL applies to the message, not the platform. Whether you send through CanadaHelps, a CRM, or a personal inbox, the same rules apply. Nonprofits often assume registered charity status exempts them. It does not.

The Canada Revenue Agency (CRA) Charities Directorate publishes guidance on charitable activities, and its guidance and policies index frames how compliance guidance is organised for charities, but CASL sits with the CRTC.

One practical consequence: your donor list is not a single asset. It is a mix of people who gave, people who asked for updates, and people who never interacted. Each group carries different consent evidence. Treating them the same invites complaints.

See casl nonprofit email compliance.

Express consent versus implied consent: the two-track model Canadian nonprofits must run

Express consent is a clear, positive action. A donor ticks a box that says they agree to receive email, or signs a paper pledge form with an email field and a consent line. Express consent does not expire under CASL unless the person withdraws it.

Implied consent is weaker and time-limited. It arises from an existing relationship or a conspicuous publication. A donation creates an existing business relationship, which gives implied consent for 24 months from the date of the gift. An inquiry gives implied consent for 6 months.

An email address published on a charity website, with no statement that unsolicited messages are unwelcome, can also support implied consent.

The two-track model means your database must flag which track applies. Express consent records need the date and how consent was given. Implied consent records need the event that created the relationship and its date, so you can calculate expiry.

Common mistakes are predictable. Buying a list gives you no consent. A donor who gave once five years ago has no implied consent left. A volunteer who provided an email for scheduling has not consented to appeals.

Quebec adds a layer. Law 25, Quebec's privacy modernization statute, sets its own consent expectations for organizations operating there. A Montreal charity needs express consent language that satisfies both CASL and Law 25.

A consent request placed at the wrong moment reduces completion. See donor drop-off mapping.

The CRTC enforcement record and what it signals for charity email lists

The CRTC enforces CASL and has issued warnings and penalties to organizations that sent commercial electronic messages without consent or without records. The first CASL penalty, in 2015, was $1.1 million against Compu-Finder, a Quebec training company. Enforcement often follows complaints from recipients, and investigations examine whether the sender can prove consent.

The lesson is record-keeping. A spreadsheet with a date and source answers the CRTC's first question; a donated list with no provenance does not.

The enforcement record also shows that unsubscribe failures attract attention. A working unsubscribe link that processes requests promptly is a basic control. A link that leads to a broken page or an email-only opt-out that goes unanswered creates risk.

Charities in Ontario, Alberta, and the Prairies have faced complaints after acquiring lists from another organization. When two charities merge or share a list, consent does not transfer automatically. The receiving charity needs its own consent or a valid implied consent basis.

Penalties under CASL can reach up to $10 million per violation for a business and up to $1 million for an individual, and directors can face liability. That risk is why the CRTC enforcement record is worth reading before you plan a large acquisition campaign.

Privacy guidance for organizations handling donor data sits with the Office of the Privacy Commissioner of Canada, whose privacy guidance for businesses applies to nonprofit donor data handling. That guidance reinforces the need for clear consent and secure records.

Building a consent workflow: capture, record, and re-permission steps

Run the workflow on a schedule. Review implied consent expiry monthly, and send re-permission messages in batches so you can measure response. A charity in Nova Scotia with a small list can do this by hand; a national organization needs automation.

Document your process so staff changes do not break it. A one-page consent policy that names who updates records and how often is enough to start.

See nonprofit email marketing.

Unsubscribe, identification, and mailing address requirements in every send

CASL sets three requirements for every commercial electronic message. First, the message must identify the sender. Second, it must include a mailing address and one other contact method, such as a phone number, email address, or web address. Third, it must include an unsubscribe mechanism.

The unsubscribe mechanism must be easy to use and must work. A link in the footer is standard. The request must be honoured within 10 business days, and the person must not need to provide a password or pay a fee.

Identification means the message must name the organization and, if different, the person or business on whose behalf it is sent. A charity that sends on behalf of a partner must make that clear.

Mailing address requirements trip up small nonprofits. A PO box is acceptable if it is a valid mailing address. A website contact form alone is not. Include a physical address or PO box in every send.

These rules apply to donor appeals, event invitations, and stewardship messages that contain a solicitation. A plain thank-you note without an ask may not be a commercial electronic message, but most charity emails include a donate link. When in doubt, include the footer.

Provincial rules can add requirements. Quebec Law 25 and BC PIPA both address how organizations handle personal information, and their expectations for identification and consent align with CASL. A single compliant footer can satisfy all of them.

Where CASL overlaps with PIPEDA and provincial privacy law

CASL and PIPEDA are different statutes with different regulators. CASL governs commercial electronic messages and sits with the CRTC. PIPEDA governs how private-sector organizations collect, use, and disclose personal information, and sits with the Office of the Privacy Commissioner of Canada.

For donor email, the two overlap. CASL requires consent to send. PIPEDA requires a lawful basis to collect and use the email address in the first place. A consent checkbox that satisfies CASL may not satisfy PIPEDA if the privacy notice is missing or vague.

The OPC's PIPEDA guidance explains consent, collection, and use of personal information, including in fundraising contexts. It expects organizations to explain why they need the data and how long they will keep it.

Provincial laws add variation. Quebec Law 25 is the strictest, with requirements for privacy officers and breach reporting. British Columbia has its own Personal Information Protection Act (PIPA). Alberta also has a PIPA. Ontario's Freedom of Information and Protection of Privacy Act (FIPPA) applies to public bodies, not charities, but it shapes how some funders handle data.

The OPC publishes a summary of privacy laws in Canada that shows how CASL sits alongside PIPEDA and provincial statutes. Use it to check which law applies to your organization.

A national charity may need to satisfy PIPEDA, Quebec Law 25, BC PIPA, and Alberta PIPA at once. The practical approach is to meet the highest standard across the list, unless you can segment by province. See nonprofit donor privacy laws by state.

Auditing an existing donor email list before the next appeal

Before your next campaign, audit the list. The goal is to know which addresses have valid consent and which need re-permission or removal.

Start with a checklist.

Work through the list in segments. Donors with express consent can receive appeals. Donors with active implied consent can receive appeals until expiry. Donors with expired or missing consent should receive a re-permission email, not an appeal.

Expect the audit to shrink your list. That is normal and healthy. A smaller list of consented addresses delivers better response and lower complaint risk than a large list of uncertain provenance.

Set a recurring audit date. Once a year is enough for most charities, though organizations in Quebec may want to review more often given Law 25.

See common nonprofit marketing strategy questions and nonprofit marketing strategy.

Common questions