An agent who automated past the rules

The situation

A team automated a quarterly “we miss you” email campaign against its full CRM database, segmenting on "no closed deal or open file in the last two years." The tool pulled 412 contacts and sent on a schedule, no human review of the list before each send — it had run the same way for three quarters without incident.

The problem

CASL s.6(1) prohibits sending a commercial electronic message unless the recipient has consented, express or implied. Section 10(10) defines implied consent for an existing business relationship as running from “the purchase or lease of a product… within the two-year period” before the message, or “an inquiry or application… within the six-month period” before it. Two different clocks, two different lengths — and the segmentation logic that built this list checked neither directly; it filtered on "no recent closed deal," which is close to the purchase clock but silent on the inquiry clock entirely.

The numbers

A post-send compliance spot-check, prompted by an unrelated unsubscribe complaint, pulled the actual consent dates against the send date of September 8, 2026:

• • 38 contacts' last closed transaction was more than 24 months before the send — the oldest, a June 12, 2024 closing, was 27 months out, 3 months past the s.10(10)(a) window.
• • 23 contacts had only ever submitted a website inquiry, with the most recent dated January 3, 2026 — 8 months before the send, 2 months past the s.10(10)(b) inquiry window.
• • 61 of 412 contacts total, 14.8% of the list, had no live consent basis on send day.

The rule that decided it

The rule that actually decided which 61 contacts were the problem is the expiry itself, not the existence of the relationship. Express consent, by contrast, doesn't expire on its own — the the CRTC FAQ confirms the recipient must affirmatively withdraw it. Implied consent is different: it has a built-in shelf life, and the automation's segment logic had been built around when a relationship started, not when the implied-consent clock on it ran out. Those are not the same date, and only one of them is what s.6(1) actually tests against.

Worth flagging separately: the National DNCL's own existing-business-relationship exemption, for phone and ADAD-style calling, runs 18 months from a purchase and 6 months from an inquiry — different numbers again from CASL's 24 and 6. A 27-month-old purchase is outside both clocks by any channel; a contact between 18 and 24 months out is a live CASL email and a dead DNCL phone call at the same time. The two regimes do not share one number, and this team's tool wasn't built to check either.

The outcome

No formal CRTC complaint was filed — the unsubscribe that triggered the review was just that, an unsubscribe. The team pulled all 61 stale contacts from the automated segment immediately, re-tagged them as requiring express consent before any further commercial message, and added a consent-expiry field to the CRM so the two clocks are tracked going forward rather than inferred from a relationship-start date.

What it would have cost otherwise

CASL s.20(4) sets the ceiling on an administrative monetary penalty at $1,000,000 for an individual and $10,000,000 for "any other person" — a brokerage. That is a maximum a court or the CRTC could order, not a figure that was assessed here; nothing about this file suggests the full ceiling was ever in play for a first, self-corrected miss on 61 stale contacts. But the ceiling is the reason a quiet fix beats an ignored complaint — the same automation, left running unaudited for another few quarters, keeps adding more contacts past their consent window every quarter the CRM's relationship-start segmentation goes unreviewed.

The tell

The tell was the segment filter's own wording: "no closed deal in the last two years" is a description of a relationship's start, phrased as though it answers a question about the relationship's consent status. Any automated list-building rule that reads like a description of the client relationship, rather than a countdown from a specific dated event, is answering the wrong question — and CASL's s.10 windows are entirely about the dated event, not the relationship. The fix ended up looking a lot like moving stale contacts onto an express-consent basis rather than continuing to rely on an implied window that had already run out, and the team's marketing lead also flagged the segment against the National DNCL's own registration list before the next quarter's phone-based follow-up went out.

Takeaways

• • CASL's implied-consent windows are 24 months from a purchase and 6 months from an inquiry — both expire, unlike express consent, which lasts until withdrawn.
• • The National DNCL's phone/ADAD exemption windows are 18 months and 6 months — different from CASL's, not interchangeable with it.
• • An automation segment built on "when did the relationship start" is not the same test as "has implied consent expired" — build the CRM field around the second question.
• • CASL's maximum AMP is $1,000,000 for an individual and $10,000,000 for a brokerage under s.20(4) — a ceiling on what could be ordered, not evidence of what any given file will draw.