Express consent under Canada’s Anti-Spam Legislation (CASL) is a recipient’s explicit, opted-in agreement to receive a specific kind of commercial electronic message from you, given only after you clearly state the purpose for which consent is being sought and identify yourself as the person asking — the opposite of consent CASL merely implies from an existing relationship.
Sending a commercial electronic message is prohibited under CASL section 6 unless the recipient has consented, expressly or impliedly, and the message itself identifies you, gives a way to contact you, and carries a working unsubscribe mechanism. Express consent is the stronger of the two forms: you must clearly state the purpose the consent is being sought for and provide identifying information about who is seeking it before the recipient opts in. Once you have it, that unsubscribe link has teeth — you must give effect to an opt-out request without delay, and in any event no later than 10 business days. Get the consent step wrong and the exposure is real: CASL’s administrative monetary penalties run up to $1,000,000 for an individual and $10,000,000 for an organization.
Do not confuse this with PIPEDA’s separate use of the same words. CASL’s express consent governs whether you may send a message at all; PIPEDA’s (see meaningful consent, defined) governs how you may handle information once you have it. A client can give you express consent to email them market updates under CASL while never being asked for PIPEDA-style express consent about how their file is stored — they are two different tests under two different statutes, both enforced federally but by different mechanisms.
You want to send a “just sold in your neighbourhood” update to 40 people who filled out a form on your listing page in the last month. Their inquiry gives you implied consent under CASL’s six-month window (see implied consent and its two-year clock), so this specific email is fine without an opt-in. If you want to keep emailing that list after the window closes, you need to convert them to express consent first — a single, clearly worded checkbox naming you as the sender and describing what they are signing up for, logged with a timestamp so you can show it if the CRTC ever asks.
See also: implied consent and its two-year clock and meaningful consent under PIPEDA.
A 30-minute call is enough to tell you whether AI pays for itself here.
