Rules
CASL for nonprofits: how consent rules change your email list
CASL nonprofit email compliance sets a stricter consent bar than US rules. What Canadian charities must disclose, keep and face if they get it wrong.
What to take away
- Canada's anti-spam legislation covers any message with a commercial purpose, and the CRTC treats a fundraising appeal as commercial in most cases.
- Consent must exist before the send. The American opt-out model does not transfer.
- A compliant message names the sender, gives a mailing address and a second contact method, and carries a working unsubscribe.
- Implied consent runs on a clock24 months from a donation or a volunteer shift, 6 months from an inquiry.
- The sender carries the burden of proof, and the CRTC can publish a notice of violation.
Your donor file is the asset most exposed to Canadian consent rules, often built on habits imported from American advice. The sender holds the obligation, not the platform, so switching email providers changes nothing.
Teams rebuilding a list should read the nonprofit email marketing notes on deliverability, since consent and inbox placement fail in the same week.
Who has jurisdiction over your list
The CRTC is the main regulator under Canada's Anti-Spam Legislation. The full text of the Act on the Justice Laws website carries the consent definitions that decide your case. The Competition Bureau and the Privacy Commissioner hold other parts of the file.
The regulated item is a commercial electronic message: any message that encourages participation in a commercial activity. Fundraising appeals fall inside that definition. A narrow exemption covers a message sent by or on behalf of a registered charity whose primary purpose is raising funds. Add a sponsor, a gala ticket or a merchandise offer and the exemption stops applying.
What a compliant disclosure contains
A compliant message carries four elements.
- Sender identificationthe legal name of the charity sending the message.
- A mailing address for the sender.
- A second contact method, such as a phone number, an email address or a web address.
- A working unsubscribe mechanism, honored within 10 business days.
Four Required Disclosure Elements
- Sender name plus any on-behalf organization
- Current physical mailing address
- Second contact method, live 60 days
- Easy, free unsubscribe honoured in 10 days
Missing one of these turns a routine appeal into a violation, even where consent is clear.
What counts as consent
Canadian law splits consent into express and implied. The Act's consent provisions keep the two categories apart, and only one of them expires.
Express vs Implied Consent
Express consent
- How given
- Positive act
- Examples
- Ticked box, form, recorded yes
- Expiry
- Does not expire
- Pre-ticked boxes
- Do not count
Implied consent
- How given
- Relationship or role
- Examples
- Donation, inquiry, published address
- Expiry
- Expires or until objection
- Pre-ticked boxes
- Not applicable
Express consent is a positive act: a box the donor ticks, a form they submit, a spoken yes someone records. Pre-ticked boxes do not count. Addresses with no consent record are suppressed at each send, which is where donor retention work begins.
| Situation | How consent is implied | How long it lasts |
|---|---|---|
| Donation or volunteer work | Existing business relationship with a registered charity | 24 months from the last gift |
| Inquiry or application | Existing business relationship | 6 months from the inquiry |
| Conspicuously published address | Message is relevant to the person's role | No fixed expiry, until they object |
A donor who last gave in 2023 has no implied consent left. With no express consent on file, that address comes off the send list.
Example: the consent records to keep
Consent you cannot produce is consent you do not have. Build the record when the donor gives it, not in a cleanup project two years later.
- Date, time and channel of the consent
- The exact wording the donor saw or heard
- The sourceweb form, event sheet, pledge card, phone log
- The staff member or system that captured it
- The scope the donor was told about, such as email only
This answers the only question the CRTC asks: can you show consent for that address on that date. The nonprofit marketing analytics guide covers where those fields sit in a donor database.
What happens if you do not comply
The CRTC issues a notice of violation and publishes it on its website. The Act sets administrative monetary penalties up to $10 million for businesses and up to $1 million for individuals. The regulator can also order you to stop sending to named addresses.
The harder cost is evidentiary. CASL puts the burden of proving consent on the sender, so an appeal to 12,000 people with no records is a defence you cannot mount. A handful of complaints can start a review.
Where the rules differ by place
Canadian law requires consent before the first message. The CAN-SPAM guidance in the United States describes the opposite: a sender may mail until the recipient opts out. An American playbook applied to a Canadian list inverts the obligation.
Provincial privacy law adds a layer. Quebec requires clear, specific consent to collect personal information, and an email address is personal information. Alberta and British Columbia each have a Personal Information Protection Act, both known as PIPA. A list that crosses provinces should meet the strictest standard it touches.
The nonprofit marketing strategy questions piece is a reasonable start for that mapping.
