Does CASL apply to emails sent from outside Canada to Canadian recipients?
Updated on 17 Oct 2026: We clarified CASL's cross-border scope and the limits of its consent exemptions.
Yes. Canada's anti-spam legislation (CASL) applies to commercial electronic messages sent from outside Canada when a computer system located in Canada is used to access the message. Treat recipients who are expected to access the message in Canada as in scope, and document the basis for any exception you rely on.
The CRTC FAQ says commercial electronic messages sent to recipients in Canada from another country must comply with CASL. Section 12 supplies the cross-border test: section 6 is contravened only if a computer system in Canada is used to send or access the message. Canada does not have to be the sending location.
- Mailing from the United States, Europe, Australia, or an overseas sending platform does not remove CASL duties when the message will be accessed in Canada.
- Have express or valid implied consent, identify the sender, keep contact details valid, and include a working unsubscribe mechanism.
- CASL regulates commercial electronic messages. Personal or family messages, solicited responses, and specific statutory or regulatory exemptions need separate review.
How CASL applies across borders
Commercial electronic messages sent to recipients in Canada from another country must comply with CASL.
CRTC FAQ
Section 6 is the main CASL rule for commercial electronic messages, usually shortened to CEMs. Subject to applicable exceptions, it prohibits sending, or causing or permitting someone to send, a CEM unless the recipient has consented and the message includes the required identification and unsubscribe details. CASL also covers commercial messages sent to other electronic addresses, including SMS and instant messaging accounts, although this page focuses on email.
Section 12 sets the cross-border test. For section 6, the key question is whether a computer system located in Canada is used to send or access the electronic message. If a computer system in Canada is used to access the message, the Canadian connection exists even when the sender and its sending infrastructure are outside Canada. Routing through Canada alone does not satisfy section 12(1).
|
|
|
|---|---|---|
Foreign company emails a lead in Canada | Treat as in scope | Prove consent and message compliance |
Canadian company emails abroad | Canadian sending or access brings section 6 into scope | Check the limited foreign-state exemption |
Message only routes through Canada | Routing alone does not trigger section 6 | Verify the sending and access locations |
Canadian recipient is abroad | Citizenship is not the test | Check access and sending-system location |
Common cross-border CASL scenarios
Outside Canada is not a safe workaround
An overseas sender or server does not avoid CASL when a computer system in Canada is used to access the CEM. If campaign data indicates that recipients will access a commercial message in Canada, build the send around CASL duties.
When the foreign-state exemption applies
Following U.S. CAN-SPAM rules does not replace CASL for a CEM expected to be accessed in Canada. The limited foreign-state exemption in paragraph 3(f) concerns messages the sender reasonably believes will be accessed in a country listed in the regulations, provided the message conforms to that country's law addressing substantially similar conduct. The CRTC FAQ explains the conditions.
An overseas sender targeting recipients expected to access email in Canada cannot use that exemption merely because its headquarters or sending servers are abroad. Before relying on it for an outbound campaign, record the expected access country, confirm that country is listed, and document compliance with its relevant law.
What enforcement means outside Canada
CASL does not create a general exemption for foreign senders. The CRTC investigates complaints, can require records, and cooperates with regulatory partners in other countries on unlawful commercial messaging. Using a foreign sending provider does not remove the sender's compliance obligations.
- Administrative monetary penalties can reach CAD $1 million for an individual and CAD $10 million for any other person per violation. These are statutory maximums, not automatic fines.
- Keep consent records, the message and audience export, unsubscribe events, suppression actions, staff training, and third-party instructions. Retain proof of consent for as long as you rely on it to send CEMs.
- A documented compliance program can support a due-diligence defence, but a policy that was never implemented will not prove reasonable preventive steps.
- Obtain Canadian legal advice when access location, consent, or an exemption depends on disputed facts.
Assign responsibility before launch
Name an owner for CASL approval, suppression processing, consent expiry, and evidence retention. A foreign head office should be able to reconstruct why each Canadian segment was eligible to receive the campaign.
A practical scope test
Decide scope before the campaign is built. Review likely access location, message purpose, consent basis, and unsubscribe readiness. If reliable data indicates that a recipient will access the message in Canada, handle that recipient under CASL rather than trying to reconstruct the decision after complaints arrive.
Flowchart for deciding whether CASL applies to a campaign
- Use country fields, billing and shipping data, event registration, signup IP, CRM notes, and sales context to predict Canadian access. No single field conclusively decides the section 12 test. Because the test concerns computer-system location, a .ca address alone does not establish scope and a .com address does not exclude Canadian access.
- If the message encourages a product, service, trial, sale, partnership, event, or business opportunity, treat it as commercial. Review its content, hyperlinks, and contact information as a whole. A commercial purpose does not have to be the message's main purpose.
- Record the express-consent evidence or the qualifying basis for implied consent. If relying on an exception or exemption, record that legal basis separately.
- Name the sender and any person on whose behalf the message is sent, then provide the required mailing address and contact method.
- Keep evidence that the unsubscribe was present, clear, working, and honoured within the required unsubscribe timeframes.
Whether CASL applies
This is the legal scope question. It looks at the message type, the Canadian computer-system connection, and any statutory or regulatory exception.
- A computer system in Canada used to access the message creates the main cross-border concern.
- A sales or marketing purpose usually pushes the message into CEM analysis.
Whether enforcement happens
This is the practical risk question. It looks at complaints, campaign scale, records, cooperation between regulators, and whether the sender can show a documented compliance process.
- Consent logs and unsubscribe logs matter more than informal intent.
- The organization should know who approved the audience and who actioned suppression requests.
What to include before sending to Canada
When CASL applies, the campaign file should show the consent basis, sender identity, contact details, and unsubscribe path before a single message leaves the platform. Express consent does not expire unless it is withdrawn, but its original scope still limits what you can send. Common implied-consent periods are two years after a qualifying transaction and six months after a qualifying inquiry or application. A qualifying written contract supports implied consent while it exists and for two years after it ends. Keep a separate playbook for consent duration.
Use an affirmative opt-in for express consent; a pre-checked box or silence is insufficient. An email asking for permission to send marketing is itself a CEM, so use a compliant signup form unless an existing consent basis or exception permits that email request. The CRTC's consent guidance explains this restriction.
|
|
|
|---|---|---|
Consent | Express or valid implied consent, unless an exception applies | Time-stamped form or relationship record |
Identity | Sender and any person on whose behalf named | Final message copy |
Contact | Mailing address plus a phone number, email address or web address, valid for at least 60 days after sending | Footer and contact-page record |
Unsubscribe | No-cost mechanism valid for at least 60 days after sending; honour requests without delay and within 10 business days | Link test and suppression log |
Segmentation | Likely Canadian access tagged | Audience export and selection rules |
CASL send checklist
Example footer for a documented product-updates signuptext
Sender: Acme Inc. Mailing address: 123 Example Street, Sydney NSW 2000, Australia Contact: privacy@example.com You are receiving this because you requested product updates. Unsubscribe: https://example.com/preferences
Consent is not the same as deliverability
A compliant footer does not fix bad authentication, poor list quality, or reputation problems. Keep CASL records and delivery checks in the same launch review, but do not treat one as a substitute for the other.
How DMARC and deliverability fit in
CASL is a legal compliance question. Authentication is a delivery and domain protection question. Check both before Canadian campaigns because a legally compliant email can fail authentication, land in junk, or hit a blocklist (blacklist). Before launch, an email tester helps inspect the message that mailbox providers actually receive.
For the authentication side, pair DMARC monitoring with domain health checks and blocklist monitoring. This catches technical issues that legal review will not catch, such as a new sender failing DKIM or a sending IP appearing on a blacklist.
Suped's product brings DMARC aggregate reporting, SPF and DKIM investigation, domain issues, and blocklist (blacklist) status into one workflow. It does not decide whether CASL applies. It helps the team responsible for sending verify that authorized services authenticate and investigate changes before a campaign expands.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
CASL exceptions and common edge cases
The risky cases are rarely obvious newsletter sends. Sales sequences, partner emails, acquired lists, event uploads, and mixed-purpose operational notices need a decision based on evidence rather than the sender's preferred label.
|
|
|
|---|---|---|
Cold B2B outreach | B2B exemption or implied consent | Organization relationship or publication proof |
Customer upsell | Existing business relationship | Consent basis and expiry |
Event upload | Consent obtained at registration | Form language and source record |
Acquired list | Original consent scope and transfer basis | Verifiable consent scope and transfer basis; seller assurances are not enough |
Receipt email | Transactional consent exception | Factual content and any promotion |
CASL edge-case handling
A work address alone is not a B2B exemption. A narrow organization-to-organization exemption can apply to a CEM between employees, representatives, consultants, or franchisees of organizations that have a relationship when the message concerns the recipient organization's activities. When relying on a conspicuously published address instead, document that the recipient published it or caused it to be published, confirm that no statement barred CEMs, and match the message to the person's role. A list reseller's publication alone does not establish implied consent.
Do not relabel marketing as operational
For a CEM that qualifies under the consent exception in section 6(6), identification and unsubscribe duties remain unless a separate, broader exemption applies. The message must stay within the listed transactional or factual purposes. Adding unrelated promotional content can remove that consent exception. A response to a solicited request has a separate regulatory exemption, so distinguish that basis from the consent-only exception.
Views from the trenches
Best practices
Treat likely Canadian access as in scope, even when the sending system sits abroad today.
Store the consent source with signup timestamp and full form text for later audits.
Separate legal consent checks from inbox placement checks; both affect the final send plan.
Common pitfalls
Relying on sender location alone misses the Canada access test in section 12 entirely.
Adding an unsubscribe link without consent still leaves most promotional sends exposed.
Assuming B2B outreach is exempt creates risk when relevance and consent proof are weak.
Expert tips
Keep Canadian segments tagged so preference rules stay consistent across campaigns and teams.
Review templates after each acquisition because inherited consent needs proof before sending.
Monitor authentication separately so CASL fixes are not confused with delivery issues.
Marketer view
Marketer from Email Geeks says CASL should be treated as applying when a commercial email is sent to someone who reads it in Canada.
2017-05-31 - Email Geeks
Marketer view
Marketer from Email Geeks says the key distinction is application versus enforcement, since overseas sending does not remove the Canadian recipient issue.
2017-05-31 - Email Geeks
The practical answer
If the email is commercial and campaign data indicates that it will be accessed using a computer system in Canada, treat CASL as applying even when the send originates elsewhere. Prove consent or a valid exception, identify the sender, keep contact information valid, include a working unsubscribe path, and retain records.
