Express consent is a clear opt-in that doesn't expire, while CASL implied consent comes from an existing relationship and runs out, typically after 2 years for purchases and 6 months for inquiries. The difference determines whether you can keep sending commercial email or need to stop and ask for express permission.
A common situation looks simple. You sell services, a customer bought from you in March 2025, and you want to email them about a seasonal promotion. You may have implied consent, but you need to know exactly when the qualifying relationship began and whether the relevant window remains open.
That consent clock is where many small businesses get caught. A contact can remain in your email platform long after the legal basis for marketing messages has expired. We'll explain the difference between express and implied consent, how to calculate expiry, and what records you need to support your decision.
Why CASL Consent Rules Matter for Your Email List
Canada's Anti-Spam Legislation, or CASL, regulates commercial electronic messages. A message generally falls into this category when it encourages participation in commercial activity, such as buying a product, booking a service, or responding to a promotion. The rules matter whether you're a large company, a local shop, or a solo consultant emailing business contacts.
The practical distinction is straightforward. Express consent means the recipient actively says yes, usually through a form, checkbox, or written agreement. Implied consent comes from a qualifying relationship or circumstance, and it lasts only for a defined period. The CRTC's CASL guidance explains these consent categories and their time limits.
A past purchase can create a lawful basis for relevant commercial email, but it doesn't give you an evergreen marketing pass. An inquiry creates a shorter window, and a publicly posted business email has narrow conditions attached. If you can't identify the relationship, its start date, and the consent basis, your mailing list needs attention before your next campaign.
Practical rule: Treat every implied-consent contact as a dated record, not as a permanent subscriber.
CASL also places the responsibility on the sender. The person sending, causing, or permitting the message must be able to prove consent, as stated in the CRTC's enforcement advisory on consent records. That makes record keeping part of your email process, not an administrative task you can postpone.
For a broader explanation of the law, see our guide to Canada's Anti-Spam Legislation. The key takeaway here is simple: use express consent whenever possible, and track implied consent from the exact event that created it.
What Express Consent Means Under CASL
Express consent is an affirmative, informed opt-in. The recipient takes a clear action to agree to receive commercial electronic messages from you. A newsletter form, an unchecked marketing checkbox during checkout, or a written service agreement can all provide a practical way to request that permission.
The wording matters because the recipient should understand what they're agreeing to. A vague statement such as “You'll receive updates” leaves too much uncertainty. A clearer version identifies your business and describes the type of messages you plan to send.
For example, a signup form might say that the person agrees to receive product news, promotions, and business updates from your company. The form should make the choice voluntary and separate from actions such as creating an account or completing a purchase.
What a valid opt-in should show
Use a dedicated, unchecked checkbox where possible. The person should click or select it themselves, rather than being enrolled automatically through another action.
Avoid wording that hides marketing permission inside unrelated terms. “By placing your order, you agree to receive promotional email” combines a purchase with a separate marketing decision. A clear form gives the recipient a real choice.
The consent request should also identify the sender and explain how the recipient can withdraw permission. Every commercial message still needs a working unsubscribe mechanism, so your signup process and sending templates should support the same expectation.
A written agreement can work when it contains a specific email permission clause. Keep the signed agreement, the version of the clause, and the date it was accepted. If someone gives verbal permission, document who agreed, when they agreed, what you explained, and how you recorded the decision.
Why express consent reduces administration
Express consent doesn't expire under CASL, although the recipient can withdraw it. That makes it the durable basis for a newsletter or long-term marketing list.
It also removes one particular burden. You don't need to calculate a two-year purchase window or a six-month inquiry window for that consent basis. You still need proof, accurate sender information, and a functional unsubscribe process.
Capture express consent whenever you can. It gives your recipient a clearer choice and helps you avoid managing a separate expiry date for every contact.
What Is CASL Implied Consent
CASL implied consent is permission inferred from a qualifying situation rather than a direct opt-in. The CRTC identifies several routes, including an existing business relationship, an existing non-business relationship, and a publicly published email address that meets specific conditions.
An existing business relationship can arise from a purchase, lease, or written contract. For example, if a customer buys equipment from your shop, you may have a basis to send relevant commercial messages during the applicable period. Keep the purchase record because the transaction date starts the consent clock.
An existing non-business relationship can involve activities such as membership, donations, or volunteer work. The relationship still needs to fit the applicable CASL conditions, and you shouldn't assume that every person who has ever interacted with your organisation belongs on a marketing list.
Publicly posted addresses need careful handling
Finding an email address on a company website doesn't automatically create broad permission. The CRTC's guidance says the address must have been published without a statement refusing unsolicited commercial messages, and your message must relate to the person's business or official role.
Suppose a law firm publishes a general address for client enquiries. That doesn't give you a free pass to send unrelated promotions. Even when a published address qualifies for implied consent, your message should connect directly to the recipient's role or the purpose for which the address appears.
A public email address is a narrow signal of relevance, not an evergreen subscription.
The same caution applies to business cards and contacts gathered at events. You need to understand the context and the relationship before adding the address to a recurring campaign. A contact who asks for a product catalogue is different from someone who only exchanges a greeting at a conference.
Implied consent also doesn't mean every message is appropriate. Keep communications connected to the relationship that created the consent. If the relationship is weak, unclear, or difficult to document, ask for express consent instead.
Your list should record the basis for each contact. Label a person as a purchaser, an inquirer, a member, or a qualifying published contact, rather than placing everyone into one undifferentiated marketing segment.
How Long Each Consent Type Lasts
The consent clock begins with the event that creates the relationship. Record that date, rather than relying on the date someone entered your email platform or received a staff tag. The exact start date determines whether a later message is still covered.
For a purchase, lease, or written contract, implied consent generally lasts 2 years. The CRTC's consent infographic explains that the period starts with the event that began the relationship, such as purchasing a good or service.
For example, a customer who made a qualifying purchase in March 2025 has a purchase-based consent period measured from that transaction. Your records should identify the transaction date and relationship type, so your team can check whether a proposed campaign falls within the permitted window.
An inquiry or application that does not lead to a transaction generally creates implied consent for 6 months. Someone who emails in March 2025 to ask about your service, then never buys, should not be treated like a customer with a purchase-based relationship. Store the inquiry date separately and apply the shorter period.
Ongoing accounts change the starting point
For subscriptions and memberships, the CRTC states that the clock starts when the relationship ends, as described in its guidance on implied consent periods. An active account therefore does not have a simple expiry date based on its signup date. Keep a reliable record of when the relationship ended before calculating the review or expiry date.
A spreadsheet can serve a small list, provided it contains more than a name and email address. Record the qualifying event, event date, relationship category, and the date your team must review the contact. These fields turn a vague sense of familiarity into an auditable consent history.
CASL's transition history also affects older databases. Guidance in Canada stated that implied consent for certain pre-existing relationships was valid only until July 1, 2017. The standard periods then became the main rule for new and continuing relationships. Do not reactivate an old list based only on its age or past familiarity.
As the window approaches its end, request express consent while you still have a lawful basis to send that request. Once implied consent expires, stop sending commercial messages unless another valid basis applies.
Express vs Implied Consent at a Glance
| Dimension | Express Consent | Implied Consent |
|---|---|---|
| How it's obtained | The recipient actively opts in through a form, checkbox, or documented agreement | A qualifying business relationship, non-business relationship, or properly published business email |
| Does it expire | It doesn't expire, unless the recipient withdraws it | Yes, the applicable relationship window ends |
| Expiry window | No CASL expiry period applies | Generally 2 years for a purchase, lease, or written contract, and 6 months for an inquiry, according to CRTC consent guidance |
| Evidence needed | Consent date, method, wording, and supporting record | Relationship type, triggering event, exact date, and supporting record |
| Risk when records are thin | You may not be able to prove the opt-in | You may lose both the relationship evidence and the lawful time window |
Express consent suits newsletter signups and marketing lists you expect to maintain. A visitor who checks an unchecked box after reading a clear description has made a direct choice. You still need to keep the record, but you don't need to manage a relationship expiry date for that consent.
Implied consent can make sense for relevant follow-ups after a purchase or inquiry. It can also support a carefully timed campaign to an existing customer, provided the relationship remains documented and the window is open.
The common mistake is treating implied permission like express permission. A public email address isn't a standing invitation to send unrelated offers, and an old purchase doesn't stay fresh because the contact remains in your customer database.
Use the table as a decision aid before you send. If your team can't name the consent basis and identify the event date, pause the campaign and investigate the record.
How to Capture and Prove Consent
The sender carries the burden of proof under CASL. A contact's presence in Shopify, HubSpot, Outlook, or a spreadsheet doesn't prove that the person consented to receive your commercial messages.
A defensible record connects the person to a clear event. At minimum, capture the email address, consent basis, date, method, and the wording shown when the person opted in. For implied consent, add the transaction, contract, membership, donation, or inquiry that created the relationship.
Build a record at the point of collection
A small business can create a workable process without a complex compliance system:
Timestamp each event. Store the date of every purchase, lease, contract, inquiry, subscription end, or membership end in the system that holds the original record.
Preserve signup evidence. Export form submissions with the date and retain the exact consent language. If your form changes, keep the older version linked to earlier submissions.
Tag the consent basis. Separate express consent from purchase-based, inquiry-based, and other implied-consent categories in your email platform.
Review approaching expiry. Create a regular review queue for records nearing the end of their applicable window.
Log withdrawals. Keep a suppression record so an unsubscribed address doesn't return through a later import.
The exact language matters because a current form may not match the wording a person saw when they subscribed. A contract or order record can support implied consent, but it doesn't replace the need to show when the relationship began.
Act before implied consent expires
If a purchase-based relationship is nearing its expiry, invite the person to opt in expressly. If an inquiry-based relationship is nearing its shorter limit, make the same decision sooner. Your options are simple: obtain express consent while you can, or stop sending commercial messages when the implied basis ends.
Don't rely on memory or an employee's explanation of what happened. The CRTC's record-keeping guidance makes proof the sender's responsibility.
Privacy governance also includes how you store and manage personal information. Review the practical connection with PIPEDA compliance for Canadian businesses, especially if several tools hold copies of your customer and subscriber data.
Common Questions About CASL Consent
What's the difference between express consent and implied consent under CASL?
Express consent is an active opt-in where the recipient clearly agrees to receive commercial messages. Implied consent comes from a qualifying relationship such as a purchase or inquiry, and it's time-limited. Express consent doesn't expire unless withdrawn; implied consent typically lasts 2 years for purchases or 6 months for inquiries.
How long does implied consent last for a purchase?
Implied consent from a purchase, lease, or written contract generally lasts 2 years from the transaction date, according to CRTC guidance. Once this period ends, you need express consent to continue sending commercial messages.
When do I need to ask for express consent instead of relying on implied consent?
You should request express consent once an implied-consent window is approaching its end, or when a contact doesn't fit a clear qualifying relationship. Implied consent requires that you identify and date the original event (purchase, inquiry, etc.). If you can't document that event, ask for express consent instead.
What records do I need to prove CASL consent?
Keep the email address, consent basis (express or implied), the date of the event that triggered it, and the method by which you obtained it. For express consent, preserve the exact wording the recipient saw. For implied consent, keep the purchase record, contract, inquiry email, or other evidence of the qualifying relationship.
Can I keep sending emails to someone after their implied-consent window expires?
No. Once implied consent expires, you must stop sending commercial messages unless you have another valid basis, such as express consent. The CRTC guidance makes the sender responsible for tracking expiry dates and respecting them.
Best Practices and a Simple CASL Checklist
A clean list starts with a clear record for every address. Before your next campaign, identify why each person is eligible to receive it and find the event that supports that reason.
Use this checklist as a working review:
Record the consent basis: Mark each contact as express consent or a specific implied-consent category.
Date-stamp the relationship: Save the exact purchase, lease, contract, inquiry, application, subscription-end, or membership-end date.
Set review reminders: Track the 2-year purchase, lease, or contract window and the 6-month inquiry window using the applicable CRTC rules.
Ask during checkout: Offer a separate, unchecked marketing opt-in instead of assuming a purchase means newsletter permission.
Preserve the wording: Keep the form, checkbox text, agreement clause, or other language the recipient saw.
Remove expired contacts: Stop commercial messages when the applicable implied-consent window ends unless you've captured express consent.
Protect unsubscribes: Keep a suppression record so an address doesn't return through a list import.
Legal permission isn't the same as reader interest. Sending frequent or poorly targeted messages inside an implied-consent window can still annoy people and increase complaints. Relevance, clear identification, and an easy way to leave help protect the relationship as well as your compliance process.
Your email provider also affects your broader privacy habits. A service that keeps Canadian business data under Canadian jurisdiction can make it easier to organise access, retention, and vendor reviews. That doesn't make your email campaigns CASL-compliant by itself, but Canadian data sovereignty guidance can help you assess where business information is stored and who can access it.
Keep your process small enough for your team to follow. One well-maintained consent register is more useful than a complex workflow nobody updates.
The habit that matters most: date-stamp everything. Without the event date, you can't reliably manage CASL implied consent or know when it has expired.
Typewire provides ad-free, encrypted email hosted in Canada, with privacy-focused tools for individuals and small businesses. If you want a Canadian email provider with custom domains, no data mining, and infrastructure you control more closely, visit Typewire and start with the 7-day free trial.