Anonymised, illustrative composite. The acquired marketing list was written off as worthless, then reinstated at full value once someone read the statute properly — and both readings were half right.
At a glance
A multi-brand e-commerce holding company signed an asset purchase agreement for a direct-to-consumer outdoor-gear retailer that had built a 210,000-address marketing list over six years of purchases, wishlist sign-ups and in-store inquiries. The disclosure schedule listed “all customer data and marketing lists” among the assumed assets, and the buyer's growth team had already built a day-one launch email — a site-wide relaunch discount announcing the new ownership — into its ninety-day post-closing plan.
Buyer's outside counsel, reviewing the plan two weeks before closing, told the deal team to strip the list's value from the model. The advice, given honestly, was that consent under Canada's anti-spam law is personal to the sender: the buyer had never asked any of the 210,000 people on the list for anything, acquired list or not, so it had no basis to email them. That reading is exactly backwards.
Facts of this composite: 210,000 addresses on the acquired list. A one-time export of transaction dates let counsel split it three ways, measured against the campaign's actual planned send date rather than the closing date. About 41,000 records carried a standing express opt-in from checkout or newsletter sign-up, unaffected by the sale and by s.10(10)'s clocks entirely. Of the remaining 169,000 implied-consent-only records, roughly 74,000 still fell inside the two-year purchase window or the six-month inquiry window on the planned send date; the other 95,000 had aged out, some of them years before the deal was ever discussed. The launch campaign that had been modelled against all 210,000 recipients went out to 115,000.
Start with the baseline. CASL s.6(1) provides: “It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless (a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied; and (b) the message complies with subsection (2).” Two separate bases satisfy paragraph (a): express consent, and implied consent.
For a message, implied consent under s.10(9)(a) arises where the sender “has an existing business relationship…with the person to whom it is sent.” s.10(10) defines that relationship as arising from “the purchase or lease of a product, goods, a service, land or an interest or right in land, within the two-year period immediately before the day on which the message was sent” (paragraph (a)), or “an inquiry or application, within the six-month period immediately before the day on which the message was sent…in respect of anything mentioned in any of paragraphs (a) to (c)” (paragraph (e)).
Counsel's first read — that a change of ownership wipes the relationship out — is contradicted by the subsection written to correct exactly that intuition. s.10(12), headed “Clarification,” provides: “If a person has an existing business relationship with another person in accordance with subsection (10), and the business is sold, the person who purchases the business is considered to have, in respect of that business, an existing business relationship with that other person.” The relationship, and the implied consent riding on it, transfers by operation of this subsection. No fresh opt-in is required, and the list was not worthless.
Correcting that error only got the deal team to the other one. Nothing in s.10(12) resets a clock, because it attaches to a relationship defined in s.10(10) — and both (a) and (e) are decaying windows, measured “immediately before the day on which the message was sent.” Not the sale date. Not closing. Not when the relationship first formed. A customer whose last order fell eighteen months before signing, who then hears nothing for another eight months post-closing, has aged out of paragraph (a) by the time anyone emails them — sale or no sale. The purchase transfers the relationship; it does not pause the clock measuring how much of it is left.
Whichever basis applies, the message still has independent requirements. s.6(2) provides: “The message must be in a form that conforms to the prescribed requirements and must (a) set out prescribed information that identifies the person who sent the message and the person — if different — on whose behalf it is sent; (b) set out information enabling the person to whom the message is sent to readily contact one of the persons referred to in paragraph (a); and (c) set out an unsubscribe mechanism in accordance with subsection 11(1).” An inherited list now identifies a different sender under paragraph (a), and s.6(3) requires the contact information stay “valid for a minimum of 60 days after the message has been sent.”
Getting the clock wrong runs through a different regulator than the one governing whether the seller could hold the data at all. s.20(1): “Every person who contravenes any of sections 6 to 9 commits a violation for which they are liable to an administrative monetary penalty.” s.20(2) states the purpose — “to promote compliance with this Act and not to punish” — but s.20(4) sets real numbers: “The maximum penalty for a violation is $1,000,000 in the case of an individual, and $10,000,000 in the case of any other person.” That penalty is assessed by “the Canadian Radio-television and Telecommunications Commission,” CASL's own definition of “Commission” — not the Privacy Commissioner who administers the breach-reporting duty in a companion file on this hub, a breach in the data room that had to be reported. That file asks whether you were entitled to hold the data at all; this one asks whether you were entitled to send to it.
The buyer built three lists instead of one. Tier one (express, 41,000) and tier two (implied consent still open on the planned send date, 74,000) went into the launch campaign, each message identifying the new corporate sender and carrying a working unsubscribe link. Tier three (95,000, lapsed or never established) was excluded from every email campaign and routed into a non-email re-permission push instead — a mailed postcard and an in-package insert, both inviting an opt-in rather than assuming one. The disclosure schedule was amended post-signing to add the seller's underlying transaction-date export, not just the address list, since without the dates none of this tiering could be calculated.
Sending the original day-one campaign to the full 210,000 would have put a message in front of 95,000 people with no consent basis at all on the send date — 95,000 separate contraventions of s.6(1), each “a violation” under s.20(1). The Commission does not multiply the s.20(4) ceiling by the recipient count, but s.20(3) makes “the nature and scope of the violation” one of the factors setting the actual penalty, and a campaign mailed at that scale, on a list counsel had already flagged as partly compromised, is exactly the fact pattern that drives scope upward.
The tell was in the question nobody asked twice. The first memo asked whether consent transfers on a sale — a question the statute answers with a single “yes” subsection. The right question was never whether but when: for each name, how long since the underlying purchase or inquiry, counted to the day the campaign would actually go out. A marketing list acquired in a sale is not a fixed asset with a purchase-date value. It is a decaying one, and the sale does not reset the clock.
A 30-minute call is enough to tell you whether AI pays for itself here.
Canadian small-business transaction data is not published anywhere, so most valuations in this country quote an American benchmark. The Deavo–Treadstone Acquisition Index is a daily record of Canadian listings built to replace that: asking-price distributions by province and city are published now, and days on market, departure rates and asking-to-sale spreads follow as the series lengthens. Leave an email and we will tell you as each measure lands.
No pitch, no listings. One email when the first report lands.
