CASL, Canada’s Anti-Spam Legislation, has governed commercial electronic messages since July 2014. It applies whenever a commercial message is sent to or accessed from a computer in Canada, so an Indian business with Canadian customers or subscribers needs to follow it for those contacts. It is generally considered one of the stricter anti-spam laws.
CASL is a consent-based law. Before sending a commercial message you need either express consent (the person actively agreed, for example by ticking an unticked box) or implied consent in specific situations defined by the law. The best-known implied consent is an existing business relationship, such as a purchase within the previous two years or an enquiry within the previous six months. Implied consent expires, so you need to track when it started.
Every message must identify the sender, include contact information that stays valid for at least 60 days, and contain an unsubscribe mechanism that is easy to use. Unsubscribe requests must be processed within 10 business days. Requests for consent must also explain clearly who is asking and for what purpose.
The penalties can be severe, with administrative monetary penalties for businesses of up to CAD 10 million per violation. For an Indian sender, the safest approach is to treat Canadian contacts the same way you treat people under the DPDP Act and GDPR: collect clear, recorded opt-in consent, explain what you will send, and make unsubscribing simple.
An online yoga academy in Rishikesh has students in Toronto. Its sign-up form uses an unticked checkbox reading “Send me class schedules and offers by email”, stores the date and form used, and each newsletter footer names the academy, gives its address and contact email, and includes an unsubscribe link.
MailNesto records each sign-up’s form, date and IP address as consent history, and its forms can show your own consent wording beside the sign-up button.