You prove it with records built at the moment consent was given. Section 13 of CASL puts the onus on you and offers no presumption, so a ledger reconstructed afterwards is not evidence.
Key takeaways
With records, and the burden is entirely yours. Section 13 of CASL is one sentence long: “A person who alleges that they have consent to do an act that would otherwise be prohibited under any of sections 6 to 8 has the onus of proving it.” There is no presumption in your favour and no benefit of the doubt.
That single sentence is the whole design brief for a consent ledger. You are not building a marketing convenience; you are building the evidence you would hand to the regulator, assembled at the moment consent was given rather than reconstructed afterwards.
It depends which kind of consent you are relying on, and the two are recorded differently.
Express consent. Section 10(1) requires that when you sought it, you set out clearly and simply the purpose or purposes for which consent was being sought, and prescribed information identifying you (and anyone on whose behalf you sought it). The Electronic Commerce Protection Regulations specify what that identifying information is. Proving express consent therefore means proving what the request said — not merely that a box exists in your database.
Implied consent. Section 10(9) allows implication in defined circumstances only: an existing business or non-business relationship; an address the recipient conspicuously published without a statement declining unsolicited messages, where your message is relevant to their business role; or an address the recipient disclosed to you without declining, again where the message is relevant to their role. Section 10(10) then defines an existing business relationship by reference to fixed windows — a purchase, lease, barter or accepted opportunity within the two-year period before the message, a written contract currently in existence or expired within that period, or an inquiry or application within the six-month period before it.
The practical consequence is the one most firms miss: express consent does not expire on its own, implied consent does. If you cannot say which limb you are relying on and when the clock started, you cannot prove implied consent at all.
That last point does most of the work. A ledger that overwrites status has destroyed the history you would need. Append, and keep the record for as long as you are relying on it — noting that under section 23(1) no proceeding in respect of a violation may be commenced later than three years after the day the subject matter became known to a designated person.
It can do the reconciliation, which is the part firms actually fail at. Given a CRM export, a webform log and three spreadsheets, a model is genuinely good at matching addresses across inconsistent formats, finding contacts that appear in the sending list but in no consent source, computing which implied-consent windows have run, and drafting the exception report a partner then works through.
It cannot manufacture a record that was never kept. If the consent wording was never captured, no tool can reconstruct what a person saw in 2023, and generating a plausible reconstruction would be worse than admitting the gap. The correct remedy for an unprovable segment is to stop mailing it and re-permission it.
It also should not be the thing that decides. Have it classify and flag; have a person confirm the classification for anything you intend to keep mailing. The onus in section 13 falls on your firm, not on your vendor.
An agency inherits a 9,000-row list when it takes on a new client. Three columns claim a source; most rows have none. The agency runs a reconciliation pass and splits the list four ways.
Rows with a form submission log and captured wording go to an express segment. Rows tied to a dated invoice go to an implied segment with a computed expiry two years from the transaction. Rows tied only to a dated inquiry go to a second implied segment expiring six months from that date. Everything else — conference badge scans, scraped addresses, a tab called “prospects” — goes to a quarantine segment that is never mailed.
The quarantine segment is then re-permissioned through the client’s own channels, with the request wording captured this time. Nothing about that process needed a model except the matching, which would have taken a person a fortnight. The judgement about which bucket a doubtful row belongs in stayed with the account director.
This is your firm’s own list hygiene, and the sending rules that go with it are covered in whether CASL applies to AI-written marketing email. For the law on the two kinds of consent, see implied versus express consent from Treadstone’s sister firm, and CASL penalties and CRTC complaints for what enforcement looks like.
Is a pre-checked box consent?
Section 10(1) requires the request to set out the purposes clearly and simply, and the onus of proof is yours. A default-on box makes that case considerably harder to run. Capture an affirmative action and keep the artifact.
Does an email opt-in cover text messages?
Consent is to receiving commercial electronic messages, and the definition of electronic address spans email, instant messaging and telephone accounts — but what you can prove is what the request said. If the wording described email, do not assume it stretches.
How long should I keep a consent record?
For as long as you rely on it, and then long enough to answer a challenge. The three-year limitation in section 23(1) runs from when the subject matter became known to a designated person, not from the send, so a short retention policy can leave you unable to defend a message you were entitled to send.
Can I rely on a client’s assurance that their list is clean?
Only commercially. Section 13 puts the onus on the person alleging consent. If your firm is sending, your firm proves it — which is why the quarantine bucket in the example above exists.
A 30-minute call is enough to tell you whether AI pays for itself here.
