CASL Implied Consent for AI Email and SMS Agents

Quick answer: CASL covers commercial emails and texts sent from or opened in Canada, B2B included; its B2B exemption needs an existing inter-organisation relationship and a message about the recipient’s activities. Implied consent lasts 2 years after a purchase, 6 months after an inquiry; a published address counts only if its owner published it without an opt-out statement and the message fits their role. Unsubscribes: 10 business days.

This page covers Canada’s Anti-Spam Legislation (CASL, S.C. 2010, c. 23) and its two regulations, SOR/2013-221 (Governor in Council) and SOR/2012-36 (CRTC). The Canadian Radio-television and Telecommunications Commission (CRTC) enforces it; Innovation, Science and Economic Development Canada (ISED) publishes guidance. In scope: email, SMS, and direct messages on LinkedIn or Facebook Messenger, which the CRTC’s FAQ treats as electronic addresses. Calls are covered in our guide to whether AI cold calling is legal in Canada under the CRTC rules. Statute text was read from the Justice Laws consolidation current to 21 September 2026; this is a plain-language reading, not legal advice.

Does CASL apply to B2B cold emails sent by an AI agent?

Yes. Section 6(1) prohibits sending, or causing or permitting to be sent, a commercial electronic message (CEM) to an electronic address unless “the person to whom the message is sent has consented to receiving it, whether the consent is express or implied” and the message carries the identification and unsubscribe content in section 6(2). Section 6 does not distinguish software from a person, or a business inbox from a personal one.

Section 1(1) defines an electronic address as one used to reach “(a) an electronic mail account; (b) an instant messaging account; (c) a telephone account; or (d) any similar account”, so SMS is in scope. Section 12(1) catches a sender abroad: a contravention needs only that “a computer system located in Canada is used to send or access the electronic message.” A sequence run from Sydney that lands in a Toronto inbox is accessed in Canada.

The quotable line: CASL has no cold-email carve-out for B2B; a cold B2B email is lawful only when an implied-consent limb in section 10(9) fits that specific message, or it is the first message after a qualifying named referral (regulation 4(1) of SOR/2013-221). A message that consists solely of an inquiry or application to a business about its own commercial activity is outside section 6 (s.6(5)(b)), but it cannot carry a pitch.

What counts as a commercial electronic message

Under section 1(2), a message is a CEM if, “having regard to the content of the message, the hyperlinks in the message to content on a website or other database, or the contact information contained in the message,” it is reasonable to conclude that encouraging participation in a commercial activity is its purpose “or one of its purposes.” A follow-up step that links to a booking page is a CEM on that test. Two boundary rules matter for AI outreach:

• Asking for consent is itself a CEM. Section 1(3): a message “that contains a request for consent to send a message described in subsection (2) is also considered to be a commercial electronic message.” An agent cannot cold-email a stranger to ask permission.
• Some voice traffic is excluded. Section 6(8) excludes a CEM that is, “in whole or in part, an interactive two-way voice communication between individuals”, one “sent by means of a facsimile to a telephone account”, or “a voice recording sent to a telephone account.” The CRTC’s FAQ says live voice and automated telemarketing calls fall under the Unsolicited Telecommunications Rules. The SMS that follows the call is back inside CASL.

Is there a CASL B2B exemption?

Yes, and it is narrower than its nickname. Regulation 3(a)(ii) of SOR/2013-221 takes a message outside section 6 if an employee, representative, consultant or franchisee sends it “to an employee, representative, consultant or franchisee of another organization if the organizations have a relationship and the message concerns the activities of the organization to which the message is sent.” Two conditions, and a cold prospect fails the first. The CRTC’s FAQ: “The mere fact that an employee of an organization has a relationship with an employee of another organization does not necessarily result in a relationship between the organizations.”

The counterpoint is that where it applies, it is complete: “consent is not required to send the CEM, nor is there any requirement to add CASL information requirements or an unsubscribe mechanism.” It suits an existing account’s other departments, not a prospect list.

When does CASL implied consent expire? The consent clock

Section 10(9) says consent “is implied only if” (a) there is an existing business or non-business relationship, (b) the recipient conspicuously published the address or caused it to be published, (c) the recipient disclosed the address to the sender, in both cases with no statement refusing unsolicited CEMs and a message relevant to their business role, or (d) the message is sent in circumstances set out in the regulations. If none fits, there is no implied consent. The relationship can be with any person who “sent or caused or permitted to be sent the message” (s.10(10)), so a client’s relationship still counts when an agency or AI platform presses send. The table turns each limb into what the agent must check on the day it sends, which is the day the Act measures from.

Consent basis (CASL section)	How long it lasts	Clock starts	What the agent must check before each send
Express consent (s.6(1)(a), s.10(1))	No expiry; ends when withdrawn	Opt-in date	A stored record of the opt-in and its scope; no unsubscribe since
Purchase or lease of a product, goods, service, land or interest in land (s.10(10)(a))	2 years	Date of the most recent purchase or lease	Latest transaction date is inside the 2-year window
Subscription, account, loan or similar ongoing relationship (s.10(14)(a))	2 years	The day the subscription or account terminates	Account is active, or ended less than 2 years ago
Acceptance of a business, investment or gaming opportunity; bartering (s.10(10)(b), (c))	2 years	Date of acceptance or barter	Date inside the 2-year window
Written contract not covered above (s.10(10)(d))	While in force, then 2 years	The day the contract expires	Contract live, or expired less than 2 years ago
Inquiry or application about a purchase, lease, opportunity or barter (s.10(10)(e))	6 months	Date of the inquiry or application	Inquiry date inside the 6-month window
Conspicuously published address (s.10(9)(b))	No fixed period in the Act	n/a	Published by the recipient or at their instigation; no statement refusing unsolicited CEMs; message relevant to their business, role, functions or duties
Address disclosed to the sender, e.g. a business card (s.10(9)(c))	No fixed period in the Act	n/a	Disclosed to the sender (or the person causing or permitting the send); no wish-not-to-receive indicated; message relevant to their role
Existing non-business relationship: donation, volunteering or meeting (charities, parties, candidates); membership of a non-profit club, association or voluntary organisation (s.10(13); regulation 7 of SOR/2013-221)	2 years	Gift, volunteer work or meeting date; membership end	Sender is the kind of body the limb names, and the gift, volunteering, meeting or membership end is inside the 2-year window
Purchased or scraped list, with no limb above	None	n/a	Do not send

Three details get dropped. The inquiry limb covers an inquiry “in respect of anything mentioned in any of paragraphs (a) to (c)” (purchases, leases, opportunities, barters), not contracts under (d). Section 10(14) starts the subscription or account clock on termination, so a live customer never ages out. And s.10(12) passes a relationship to whoever buys the business, while the CRTC’s implied consent guidance says selling only a list “does not constitute the sale of a business.”

The quotable line: Under CASL, a demo request buys an AI agent 6 months of outreach, a purchase buys 2 years, and a bought list buys nothing unless each address separately passes the publication test.

When a published email address counts as implied consent

Conspicuous publication, s.10(9)(b), is the limb that makes some cold B2B email lawful. All three conditions must hold: the recipient “has conspicuously published, or has caused to be conspicuously published” the address; the publication “is not accompanied by a statement that the person does not wish to receive unsolicited commercial electronic messages at the electronic address”; and “the message is relevant to the person’s business, role, functions or duties in a business or official capacity.”

The CRTC reads these strictly. Its FAQ says the limb “sets a higher standard than the simple public availability of electronic addresses”, that an address found only through “specific queries in a corporate database” is not conspicuously published, and that a third party that reproduces an address or sells a list “on its own initiative” creates no implied consent by doing so. Its worked example: a course on being an administrative assistant sent to a published COO address fails the relevance test; a social media marketing course sent to the published marketing officer passes.

A bought list is not automatically dead. The implied consent guidance covers a list of addresses “collected from websites or other media publications where they were conspicuously published”: the sender “must still be able to prove that consent was implied” and should “take all reasonable steps to assure itself that the list it is relying on meets the requirements.” The evidence for each address is the proof, not the vendor’s assurance. The FAQ lists five things to keep: where or how you found the address; when; whether the publication was conspicuous; whether a no-CEMs statement accompanied it; and how you judged relevance.

The business card rule

Section 10(9)(c) implies consent when the recipient “has disclosed, to the person who sends the message, the person who causes it to be sent or the person who permits it to be sent” the address, “without indicating a wish not to receive” CEMs there, and the message is relevant to their business role. The CRTC’s FAQ answers the business card question with “It depends”, on the same two conditions. A card handed to your client’s rep at a trade show can support your client’s AI follow-up; an address a list vendor collected elsewhere was not disclosed to the sender, so this limb does not apply. If you confirm the disclosure by email, the CRTC warns that email “may be considered a CEM”.

Messages that need no consent, or no CASL at all

Messages under s.6(6) still need identification and an unsubscribe; those under s.6(5) and regulation 3 are outside section 6 altogether.

Instrument	What it covers	Still needs ID and unsubscribe?
CASL s.6(6), seven paragraphs (a) to (g)	A message that solely: gives a requested quote or estimate; facilitates, completes or confirms an agreed transaction; gives warranty, recall, safety or security information about a product or service the recipient uses, has used or has bought; gives factual information about an ongoing subscription, membership, account or loan; relates to a current employment relationship or benefit plan; delivers a product or update the recipient is entitled to under an earlier transaction with the sender; or serves a purpose in the regulations	Yes (only consent is waived)
CASL s.6(5)	Personal or family relationship between individuals, as narrowly defined in regulation 2 of SOR/2013-221 (both require direct, voluntary, two-way communication); a message to a business that “consists solely of an inquiry or application related to that activity”; regulation classes	No (section 6 does not apply)
SOR/2013-221 s.3, eight paragraphs (a) to (h)	(a) within an organisation and about its activities, or between organisations that have a relationship and about the recipient’s activities; (b) a response to a request, inquiry or complaint, or otherwise solicited; (c) satisfying, giving notice of or enforcing a legal obligation, right, court order, judgment or tariff; (d) messages on an electronic messaging service whose interface conspicuously publishes the identification and unsubscribe information, where the recipient has consented; (e) limited-access secure and confidential accounts that only the account provider can send to; (f) messages the sender reasonably believes will be accessed in a listed foreign state and that conform to its law; (g) registered charity fundraising; (h) political contribution requests	No (section 6 does not apply)
SOR/2013-221 s.4(1)	The first message after a referral by an individual with a qualifying relationship to both sender and recipient, naming the referrer in full and stating it follows a referral	Yes, per the CRTC’s FAQ; only the first message is covered

AI agents lean most on regulation 3(b): a reply to an inbound inquiry is outside section 6. That covers the reply, not a nurture sequence weeks later, which usually rests on the 6-month inquiry limb.

How an AI email or SMS agent’s sequence must be gated: the per-send consent test

We call it the per-send consent test: every message in a sequence needs its own consent basis on the day it is sent, because the Act measures each window back from “the day on which the message was sent.” A sequence that was lawful when queued can become unlawful at step four. The natural home for the test is the orchestration layer that picks the next send date (in Zian’s platform, SmartReach AI™ chooses message, channel and timing), because that component knows the send date before the message leaves.

Worked example. A prospect requests a demo on 2 April 2026: an inquiry, so 6 months. The Act states no day-count convention, so we use a conservative one: anchor plus window, minus one day. Last safe send day: 1 October 2026. The agent starts a five-step sequence on 22 September 2026 at day 0, 3, 7, 14 and 28:

Step	Send date	Inside the window (last day 1 Oct 2026)?	Decision
1	22 Sep 2026	Yes	Send
2	25 Sep 2026	Yes	Send
3	29 Sep 2026	Yes	Send; the last scheduled step that can carry an express-consent request
4	6 Oct 2026	No	Block unless express consent was recorded
5	20 Oct 2026	No	Block unless express consent was recorded

Three steps go, two are blocked. A last purchase on 15 October 2024 gives a last safe send day of 14 October 2026; an inquiry on 31 August 2026 clamps to 27 February 2027. The gate in Python, run against those cases plus a published address with a no-CEMs statement, an unsubscribed contact and a scraped contact:

from datetime import date, timedelta
import calendar

def add_months(d, n):
    m = d.month - 1 + n
    y, m = d.year + m // 12, m % 12 + 1
    return date(y, m, min(d.day, calendar.monthrange(y, m)[1]))

WINDOW_MONTHS = {"purchase": 24, "contract_end": 24, "inquiry": 6}

def may_send(c, send_day):
    if c.get("unsubscribed_on"):
        return False, "unsubscribed"
    if c["basis"] == "express":
        return True, "express consent (no expiry)"
    if c["basis"] in ("published", "disclosed"):
        if c.get("no_cem_statement") or not c.get("role_relevant"):
            return False, "s.10(9)(b)/(c) condition fails"
        return True, "published/disclosed + role-relevant"
    if c["basis"] in WINDOW_MONTHS:
        last = add_months(c["anchor"], WINDOW_MONTHS[c["basis"]]) - timedelta(days=1)
        return (send_day <= last), f"window ends {last.isoformat()}"
    return False, "no recorded basis"

Code cannot decide relevance: the role_relevant flag must come from checking the actual message against the recipient’s role, with evidence stored. The Act sets no expiry for the published and disclosed limbs, so re-checking the source page before each new sequence is our practice, not a statutory rule. For the Australian version of this problem, see our guide to inferred consent under the Spam Act for AI agents; the shape is similar, the limbs and time limits are not.

How to turn implied consent into express consent before it runs out

Express consent lasts, per the CRTC, “until the recipient notifies you that they no longer want to receive them.” Getting it by email is the catch: the guidance says a consent request “is not a method through which express consent can be obtained” and “the only way to obtain express consent via e-mail is if you have implied consent to send the message.” The ask has to go out while a window is open.

The request has content rules. Section 10(1) requires the purpose, identification of the requester and anyone they act for, and other prescribed information. SOR/2012-36 s.4 says consent “may be obtained orally or in writing”, must be “sought separately” for each act in sections 6 to 8, and must give the requester’s name, the name of anyone it is sought for and which is which, a mailing address plus a phone number reaching an agent or voice messaging system, an email address or a web address, and “a statement indicating that the person whose consent is sought can withdraw their consent.” The CRTC’s FAQ rules out pre-checked boxes and silence.

A voice agent has a route email lacks. CRTC Bulletin 2012-548 accepts oral consent that “can be verified by an independent third party” or where “a complete and unedited audio recording of the consent is retained.” That matters because section 13 puts on the sender “the onus of proving it.”

Unsubscribe and identification rules for AI email and SMS

Every CEM needs an unsubscribe mechanism under section 11(1): the recipient can opt out, “at no cost to them”, of all CEMs or “any specified class of such messages”, by the same electronic means or, if not practicable, other electronic means, via an electronic address or web link the message specifies. It must stay valid for 60 days (s.11(2)), and the opt-out takes effect “without delay, and in any event no later than 10 business days after the indication has been sent, without any further action being required on the part of the person who so indicated” (s.11(3)). SOR/2012-36 s.3 requires it be “readily performed” and set out “clearly and prominently”; for SMS, Bulletin 2012-548’s example gives the user the choice of replying STOP or Unsubscribe and a link to an unsubscribe web page (the CRTC’s FAQ treats the link as another option).

For AI agents, the implied consent guidance says a stop request “through your unsubscribe mechanism or by another form of communication” must be respected within 10 business days, so a plain-English reply asking to be taken off the list counts. See our guide to what an AI agent must do after a mid-conversation opt-out. Ten business days is a ceiling: steps already queued must be cancelled at the opt-out, not at the next batch.

Identification (SOR/2012-36 s.2(1)) means the sender’s name, anyone it is sent for, which is which, and a mailing address plus a phone number reaching an agent or voice messaging system, an email address or a web address; where that will not fit an SMS, s.2(2) allows a clear link to a web page. The sentence that cuts against every AI vendor, us included, is in the CRTC’s FAQ: “where the email service provider plays a role in the content of the CEMs being sent, for example by adapting messages based on customer profile information and behaviours, then they must be identified in the CEMS.” A platform that writes or personalises messages may be on the named side of that line; it is staff guidance, so put it to counsel.

What happens if an AI agent sends without consent

Section 20(4) caps the administrative monetary penalty at C$1,000,000 per violation for an individual and C$10,000,000 for any other person. Liability spreads: section 6(1) covers anyone who would “send or cause or permit to be sent” the CEM, section 9 bans aiding or inducing a contravention, section 52 reaches officers and directors who “directed, authorized, assented to, acquiesced in or participated in” it, and section 53 makes you liable for an agent “acting within the scope of their authority.” Section 54(1) provides a due diligence defence. The private right of action in sections 47 to 51 is shown as “Repealed before coming into force” in the consolidation current to 21 September 2026.

When the answer changes

• Nothing is sent or accessed from Canada: section 12(1) is not met. Canadian senders writing abroad can use regulation 3(f) if they reasonably believe the message will be accessed in a listed state (the schedule includes Australia, the United Kingdom and the United States of America) and it conforms to that state’s law on similar conduct.
• The message is not commercial: per the CRTC’s FAQ, a genuine survey, or a message solely offering a position at your own organisation; a recruitment firm’s messages more often are CEMs.
• The organisations already work together and the message concerns the recipient’s activities: regulation 3(a)(ii).
• Guidance moves: the CRTC says its bulletins “do not impose binding obligations” and “Other practices may satisfy legal requirements imposed by CASL.”

CASL does not replace privacy law: ISED reminds senders they “must comply with both CASL and PIPEDA.” For other jurisdictions, see our AI outreach compliance guide to the Spam Act, TCPA and GDPR.

Frequently asked questions

Is cold emailing legal in Canada?

Sometimes. A cold commercial email to a Canadian address is lawful only if implied consent applies to that message (or it is the first message after a qualifying named referral, or consists solely of an inquiry or application to a business about that business’s own commercial activity under s.6(5)(b)), most often because the recipient conspicuously published the address, with no statement refusing unsolicited messages, and the email is relevant to their business role (CASL s.10(9)(b)). A bought or scraped list does not create implied consent on its own.

Does CASL apply to B2B emails?

Yes. The B2B exemption in regulation 3(a)(ii) of SOR/2013-221 covers only messages between organisations that already have a relationship, and only when the message concerns the recipient organisation’s activities. A cold prospect has no relationship, so the full CASL rules apply.

How long does CASL implied consent last?

Two years from a purchase, lease, accepted opportunity or barter, or from the end of a written contract or subscription; six months from an inquiry or application. The CASL text at section 10(10) measures both periods back from the day each message is sent. Published and disclosed addresses carry no fixed period but must meet their conditions every time.

Can an AI agent email someone to ask for their consent?

Only if it already has implied consent to email them. Section 1(3) of CASL makes a request for consent a commercial electronic message in its own right, and the CRTC’s guidance on implied consent says it is not a method through which express consent can be obtained.

Does CASL apply to SMS text messages?

Yes. A telephone account is an electronic address under section 1(1), and the CRTC’s CASL FAQ confirms commercial text messages need consent, identification and an unsubscribe mechanism. Replying STOP or Unsubscribe, or using a web link, are the examples the CRTC gives.

How fast must an unsubscribe be processed under CASL?

Without delay, and no later than 10 business days after the request is sent (section 11(3)). The unsubscribe address or link must keep working for at least 60 days after the message.

What is the maximum CASL penalty?

C$1,000,000 per violation for an individual and C$10,000,000 for any other person, under section 20(4). The stated purpose of a penalty is to promote compliance, not to punish.

Where every figure on this page comes from

Figure	Who published it	Link	Date read
2-year window after a purchase, lease, opportunity, barter or contract end (s.10(10)(a)–(d)); 2-year non-business window (s.10(13))	Department of Justice Canada (CASL, S.C. 2010, c. 23, consolidation current to 21 Sep 2026)	CASL full text	30 September 2026
6-month window after an inquiry or application (s.10(10)(e))	Department of Justice Canada	CASL full text	30 September 2026
2-year window for subscriptions and accounts starts on termination (s.10(14))	Department of Justice Canada	CASL full text	30 September 2026
10 business days to action an unsubscribe (s.11(3))	Department of Justice Canada	CASL full text	30 September 2026
60 days validity for contact information and unsubscribe address (s.6(3), s.11(2))	Department of Justice Canada	CASL full text	30 September 2026
C$1,000,000 and C$10,000,000 maximum penalties per violation (s.20(4))	Department of Justice Canada	CASL full text	30 September 2026
Seven s.6(6) paragraphs, (a) to (g)	Department of Justice Canada	CASL full text	30 September 2026
Eight regulation 3 paragraphs, (a) to (h); B2B limb 3(a)(ii); referral rule s.4(1); personal and family relationship definitions s.2; club membership s.7	Department of Justice Canada (SOR/2013-221, current to 21 Sep 2026)	Electronic Commerce Protection Regulations	30 September 2026
Identification content, “readily performed”, consent-request content (ss.2–4)	Department of Justice Canada (SOR/2012-36, current to 21 Sep 2026)	Electronic Commerce Protection Regulations (CRTC)	30 September 2026
Five records to keep for conspicuous publication; B2B relationship reading; SMS STOP and link options; vendor identification	CRTC staff (FAQ; crtc.gc.ca blocks our network, so read from an Internet Archive capture of 7 Aug 2026)	CRTC CASL FAQ	30 September 2026
Consent request is not a way to obtain consent; 10 business days for any form of stop request; selling a list is not selling a business; bought-list proof duty	CRTC (read from an Internet Archive capture of 16 Sep 2026)	CRTC Guidance on Implied Consent	30 September 2026
Oral consent: independent verification or complete unedited recording; SMS STOP example	CRTC (Bulletin 2012-548; read from an Internet Archive capture of 12 Jul 2026)	Compliance and Enforcement Information Bulletin CRTC 2012-548	30 September 2026
CASL and PIPEDA both apply	Innovation, Science and Economic Development Canada	ISED: Getting consent to send emails	30 September 2026
Worked example dates (1 Oct 2026, 14 Oct 2026, 27 Feb 2027)	Zian AI calculation, using the conservative anchor-plus-window-minus-one-day convention stated above	This page (code above)	30 September 2026