Governance, risk & compliance

Canada's Anti-Spam Legislation (CASL) S.C. 2010, c. 23, current to 2026-09-30

Canada's Anti-Spam Legislation (CASL), S.

C. 2010, c.

23, with the Electronic Commerce Protection Regulations (SOR/2012-36 from the CRTC and SOR/2013-221 from the Governor in Council). Section 6 prohibits sending a commercial electronic message (CEM) to an electronic address unless the recipient has consented, expressly or by implication, and the message identifies the sender, gives contact information and carries a working unsubscribe mechanism.

A message is a CEM if one of its purposes, judged from its content, hyperlinks and contact information, is to encourage participation in a commercial activity (s. 1(2)), and a message asking for consent is itself a CEM (s.

1(3)). Section 7 covers altering transmission data, s.

8 covers installing a computer program on someone else's computer system, and s. 9 covers aiding or inducing a contravention.

Unsubscribe requests must be honoured without delay and within 10 business days (s. 11(3)), the contact details must work for 60 days after sending (ss.

6(3) and 11(2)), and the person who says they have consent must prove it (s. 13).

Penalties are administrative, up to $1,000,000 for an individual and $10,000,000 for any other person per violation (s. 20(1)), with a due diligence defence (s.

33) and director and officer liability (s. 31); the CRTC enforces ss.

6 to 8. The Competition Act (ss.

52. 01 and 74.

011, false or misleading electronic messages) and PIPEDA (s. 7.

1, address collection) are cross-references only. Private right of action: the Justice Laws text current to 2026-09-30 shows ss.

47 to 51 and 55 as repealed before coming into force, and an earlier version showed them as not in force; the instrument that repealed them was not identified, so confirm the status with counsel. Tiers: SENDER for anyone who sends or has messages sent for them, SOFTWARE for anyone who installs programs on other people's systems, and PROVIDER for platforms, networks and agencies that carry or send messages for others.

Telemarketing calls are not covered here: they are in CA_DNCL. Not read: the CRTC advisory on keeping consent records.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Canada's Anti-Spam Legislation (CASL) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Canada's Anti-Spam Legislation (CASL) compliance

Most of Canada's Anti-Spam Legislation (CASL) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Canada's Anti-Spam Legislation (CASL), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Canada's Anti-Spam Legislation (CASL) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Canada's Anti-Spam Legislation (CASL) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.