Canada’s anti-spam law does not have a separate rule for an AI-drafted email. It regulates the message itself — who consented to receive it, what it discloses, whether it can be unsubscribed from — and none of that turns on whether a person or a language model wrote the words.
Key takeaways
It is tempting to treat “the email was AI-generated” as its own compliance question. CASL does not ask that question. It asks whether the recipient consented, whether the message discloses who sent it, and whether they can opt out — the same three things it has always asked, regardless of how the copy was produced or how the recipient list was compiled.
The core prohibition is broad and specific at once: “It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless (a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied; and (b) the message complies with subsection (2).” Subsection (2) requires the message to identify the sender, provide a way to contact them, and include an unsubscribe mechanism; subsection (3) requires that contact information to stay valid for a minimum of sixty days. (CASL, s.6)
Whether a human compiled a mailing list by hand or an AI enrichment tool assembled it from scraped or inferred data, CASL asks the same question of every address on it: was there consent, express or implied, to send this specific kind of message. As a sister firm’s guidance on the point puts it, PIPEDA’s consent-for-a-new-purpose rule and CASL’s consent-to-send rule “overlap but aren’t the same thing, and satisfying one doesn’t automatically satisfy the other.” (Treadstone Law, using customer emails for marketing) A tool that is good at finding addresses is not, on its own, a source of consent to email them.
CASL does not treat “this contact looks interested” as consent. Implied consent under section 6 exists only where the recipient has an existing business or non-business relationship with the sender — defined as a purchase, lease, or accepted business opportunity within the two years before the message was sent, or an inquiry or application within the six months before — or where the recipient has conspicuously published or voluntarily disclosed the address without indicating they do not want unsolicited messages, and the message is relevant to their business role. (CASL, s.10(9)–(10)) An AI tool that scores a lead as likely-interested based on browsing behaviour has not placed that lead into any of these baskets.
CASL anticipates exactly the kind of send-list uncertainty an AI enrichment tool can introduce. Subsection 6(4) states that a message “is considered to have been sent once its transmission has been initiated,” and that “it is immaterial whether the electronic address to which an electronic message is sent exists or whether an electronic message reaches its intended destination.” (CASL, s.6(4)) An AI-guessed address that happens to be wrong does not make the underlying compliance question go away — the message was still sent, in the Act’s terms, the moment it left.
Beyond consent, CASL is specific about content. The message must “set out prescribed information that identifies the person who sent the message and the person — if different — on whose behalf it is sent,” along with a way to reach them, and that contact information has to remain valid for a minimum of sixty days after the message goes out. (CASL, s.6(2)–(3)) An AI copywriting tool asked only to make a subject line more compelling will not, on its own, know to preserve this identification block — that has to be checked as part of the template, not left to the tool’s judgement.
The implied-consent baskets are also time-limited in a way that is easy to miss when a send list is generated automatically. A relationship arising from a purchase, lease or accepted business opportunity only supports implied consent for the two years after that transaction; a relationship arising from an inquiry only supports it for six months. (CASL, s.10(9)–(10)) An AI-driven list-refresh process that keeps re-including a customer from three years ago on the strength of a relationship that expired under the Act is generating exactly the kind of stale implied-consent claim these time limits exist to prevent.
CASL is administered jointly, not by one office working alone. The CRTC’s own anti-spam landing page describes the CRTC’s ongoing co-operation with ISED, the Competition Bureau and the OPC on enforcement. (CRTC, anti-spam legislation) That matters for an AI-assisted email programme specifically, because the same message can raise a CASL consent problem, a Competition Act misrepresentation problem, and a PIPEDA purpose problem all at once — three different regulators, each capable of acting on the same underlying campaign.
A business uses an AI enrichment tool to guess likely email addresses at target companies from common naming patterns, then sends a promotional message to the list. None of section 10(9)’s implied-consent baskets apply — there is no purchase, no inquiry, no conspicuously published address — so the message needs express consent it does not have. Whether the guessed addresses turn out to be accurate or not is beside the point under subsection 6(4): the compliance question is about consent to send, not about whether the guess landed.
Related: AI voice calls and Canadian rules, and personalisation and privacy in AI marketing.
How a business builds AI-assisted email campaigns that stay inside CASL is covered on the AI growth and marketing hub.
No. CASL does not distinguish messages by how automated or personalised their content is — the same consent rule and the same content requirements in subsection 6(2) apply regardless of how the message was assembled.
No. Implied consent under CASL comes only from the specific relationships defined in section 10(9)–(10) — a real transaction, a real inquiry, or a conspicuously published or disclosed address — not from an inferred interest score, however accurate that score might be.
Two years from a purchase, lease or accepted business opportunity, or six months from an inquiry or application — after that window closes, an automated list-building process that keeps including the contact is relying on a relationship the Act no longer recognises for this purpose.
A short call is enough to map a specific send list against the consent baskets above.
