Ease AIThe gap between the platform and the law
Most email automation platforms give you an unsubscribe link and a merge tag for your business name. They tell you that's CASL compliance. It isn't.
Canada's anti-spam legislation sets out four requirements that apply every time you send a commercial electronic message. Two of them—the unsubscribe mechanism and the identification requirement—are table stakes. The other two are where most automations break down.
This post covers the rules that matter when you're building an email automation system, not the ones your ESP already handles for you. I assume you're a business owner or a marketing lead, not a lawyer. If you need legal advice, hire a lawyer. If you need to know whether your planned automation will survive contact with the law, keep reading.
Express consent versus implied consent
CASL recognises two kinds of consent: express and implied.
Express consent is what you get when someone fills out a form, ticks a box that isn't pre-ticked, and submits it. That consent does not expire unless the person withdraws it or you go silent for two years. If you send at least one message every 24 months, express consent is good indefinitely.
Implied consent is what you get when someone buys from you, asks you a question, or hands you a business card in a context that suggests they want to hear from you. Implied consent from a purchase or enquiry lasts two years from the date of the transaction or enquiry. Implied consent from a business card or similar exchange lasts six months.
The difference matters because most email automations are built on the assumption that consent is consent. It is not. If you collected an address through a sale three years ago and you haven't sent a message in that time, you no longer have implied consent. If you never asked for express consent at checkout, you have no consent at all.
Here's the rule: if your automation includes addresses that came from transactions more than two years ago, or enquiries more than two years old, or business cards more than six months old, and you didn't get express consent at the time, you can't mail them under CASL.
The ten-business-day rule
CASL requires that you honour an unsubscribe request within ten business days. That's not ten calendar days. It's ten working days, which can stretch to two weeks if a weekend or holiday falls in the middle.
Most automation platforms let you build sequences that run for 30, 60 or 90 days. A prospect opts in, gets email one on day zero, email two on day three, email seven on day twenty-one, and so on. If that person unsubscribes on day one, every message after day eleven is a violation.
You have three options. You can shorten your sequences so they never exceed ten business days start to finish. You can configure your platform to suppress unsubscribes across all sequences immediately, which most platforms do by default if you set them up correctly. Or you can accept that a long sequence means you need watertight unsubscribe handling and test it.
The common failure mode is the multi-sequence automation: someone downloads a lead magnet, gets added to sequence A, then gets tagged and added to sequence B three weeks later. If they unsubscribe during sequence A, most platforms will suppress them from A but still enrol them in B unless you've explicitly configured a global suppression list. You must check this. The law does not care that your platform has separate lists.
The identification requirement
CASL requires that every message identify the sender by name and provide a mailing address, a telephone number, an email address or a web address. Most businesses put their name and address in the footer and assume that's sufficient.
It is, but only if the name in the footer is the name under which you do business and the address is current. If you're sending as "Sarah's Marketing Tips" but your legal name is 2845712 Ontario Inc. and you've never registered "Sarah's Marketing Tips" as a business name, you're not in compliance. If you moved six months ago and the footer still shows your old address, you're not in compliance.
The requirement is that a recipient must be able to contact you easily to ask questions or complain. A mailing address satisfies that requirement. A PO box satisfies it. A link to a contact page with a form satisfies it if the form is monitored and you respond. What doesn't satisfy it is a mailing address that returns mail or a contact form that goes to an inbox no one checks.
The silent failure
CASL violations carry penalties up to $10 million for businesses. Enforcement is complaint-driven. The Canadian Radio-television and Telecommunications Commission does not audit your Mailchimp account. What happens instead is that someone gets annoyed, files a complaint, and you receive a notice of violation.
The risk is not that you'll be fined for one email. The risk is that you've been sending thousands of emails in violation for two years, and the complaint triggers a review of your entire sending history. At that point the question is not whether you have an unsubscribe link. The question is whether you can prove you had valid consent for every address on every list at the time you sent each message.
Most businesses cannot prove that. They imported a spreadsheet from a trade show in 2019. They merged three lists during a CRM migration. They let a staff member add addresses manually. None of that is documented, none of it is tagged with a consent type or date, and none of it will survive scrutiny.
If you can't answer where an address came from, when you got consent, and which type of consent it was, don't send to it.
When not to automate
You don't need email automation if you send fewer than 50 messages a month and you can write them individually. You especially don't need it if your list is small, old, or uncertain in provenance.
Automating a compliance problem makes it a bigger compliance problem. If you're not confident you have valid consent for every address you plan to mail, the correct first step is to send a re-permission campaign to the ones you're unsure about, or to remove them. Only then do you automate.
That advice costs me work. I'd rather tell you not to buy something than build you a system that puts you at risk.
What this means for your automation project
If you're building an email automation system and you're doing business in Canada, you need three things beyond what your platform gives you by default.
First, a consent audit. Go through every address on every list and determine where it came from, when, and under what type of consent. If you can't determine that, remove the address or send a re-permission email asking for express consent.
Second, a suppression policy that applies globally across all sequences, lists and campaigns. One unsubscribe must suppress everywhere, immediately, with no manual steps.
Third, a retention schedule that removes or re-permissions addresses when consent expires. If you're relying on implied consent from a purchase, you must either get express consent or remove the address before the two-year mark.
We cover this as part of every email automation build where the client is mailing to Canadians. It's not optional and it's not something you bolt on later. If you're in Burlington, Oakville, Hamilton or anywhere else in Ontario and you're looking at automation, we can work through the consent audit with you before you commit to the build. Sometimes the right answer is to clean the list first and automate later.
Reach out at info@easeaiworks.com or take a look at the pricing page if you want to know what a compliant build looks like.