Canada’s anti-spam legislation carries a specific referral exemption, and it is narrower than most firms assume: one message, naming the person who referred you. Everything after that needs a different basis.
Key takeaways
Follow up on a referral by sending one message that names the person who referred you and says so plainly, carries your identification and an unsubscribe mechanism, and then stops unless the recipient replies or gives you consent. That is not a style preference — it is the shape of the exemption in section 4(1) of the Electronic Commerce Protection Regulations, which lifts the consent requirement in paragraph 6(1)(a) of the Act for the first commercial electronic message following a referral and nothing beyond it.
AI is genuinely useful either side of that message: keeping the referral register, preparing the partner for the conversation, drafting the note, and scheduling the thank-you back to the referrer. It is not useful for deciding whether the exemption applies, because that turns on facts only the people involved know.
Read the provision closely, because four conditions sit inside one sentence:
An existing business relationship is defined in subsection 10(10) by reference to specific triggers — among them a purchase or lease within the two-year period immediately before the message, and an inquiry or application within the six-month period immediately before it. Treadstone Law sets out the wider distinction between implied and express consent.
Section 4(1) disapplies paragraph 6(1)(a) only — the consent limb. Subsection 6(2) still applies, so the message must set out prescribed identifying information, information enabling the recipient to readily contact you, and an unsubscribe mechanism. The Electronic Commerce Protection Regulations (CRTC) prescribe that information — business name, mailing address, and a telephone number, email address or web address — and allow it to sit on a readily accessible web page reached by a clearly and prominently set out link. Section 11 requires the unsubscribe route to be free, valid for at least 60 days, and given effect within 10 business days. Treadstone Law covers the unsubscribe requirements in detail.
Configure all of that once in whatever tool sends the message. The mistake firms make is treating a referral note as a personal email that escapes the plumbing, then sending it from a marketing platform that strips the footer.
What a model must not do is populate the relationship field. It has no way of knowing whether your client actually knows the person they mentioned, and that fact is the whole exemption.
A six-person accounting practice in Manitoba is referred to a contractor by a long-standing client. The referral arrives as a sentence at the end of a phone call.
The partner dictates thirty seconds of notes. A model turns that into a register entry naming the referrer, the relationship on both sides, the date and the context, and drafts the first message from a locked template that already carries the referrer’s name, the referral statement, the firm’s address and the unsubscribe link. The partner reads it, changes two sentences and sends it.
No second email is queued. The workflow instead books a call for eight days later and creates a task to update the referring client. When the contractor replies asking for a quote, that reply is recorded as the basis for everything after it — and the file now contains a dated chain that answers the burden of proof question without anyone reconstructing it from memory.
This page is about winning work from people who already trust someone who trusts you. If the question is really about the front desk — intake, scheduling, recall and reminders — that lives on the professional practice owners page. If it is about your own month-end and payables rather than what you deliver to clients, that is accounting automation or bookkeeping automation. Whichever it is, name the province you are in: the anti-spam rules here are federal, but the professional conduct rules sitting on top of them are not.
Can we send a second email if the first one gets no reply?
Not on the strength of the referral. Section 4(1) covers the first message. A second commercial electronic message needs consent, express or implied, and silence is neither.
Does a message on a professional network count?
The Act applies to a commercial electronic message sent to an electronic address, and platform terms apply on top of it. Treat the analysis as the same and take advice before building a programme on the assumption that a messaging feature sits outside the rules.
What is the exposure if we get it wrong?
Subsection 20(4) sets the maximum administrative monetary penalty at $1,000,000 for an individual and $10,000,000 for any other person. The CRTC’s own material on spam is the regulator’s starting point, and Treadstone Law explains how penalties and complaints actually arise.
A 30-minute call is enough to tell you whether AI pays for itself here.
