Is cold email legal in Canada and the US? CASL and CAN-SPAM for B2B sellers

The two laws side by side

What implied consent means for cold email in Canada

CASL is an opt-in law, but section 10(9) lists the cases where consent is implied. The one that matters for prospecting is conspicuous publication. All three conditions must hold:

• The person published the address, or had it published, for example on their company’s own contact page.
• Nothing next to the address says they do not want unsolicited commercial messages.
• Your message is relevant to their business, role, functions or duties. A packaging offer to a restaurant supplier’s buyer fits; the same offer to their bookkeeper may not.

A close cousin is section 10(9)(c): someone gives you their address directly, for example on a business card, without saying they do not want offers. The same relevance test applies.

Regulators read these rules narrowly. In its first contested decision, in 2016, the CRTC said publication has to be more than an address being findable online, and that a general claim of “publicly available” proves nothing. In 2017 it added that an address a third party posted on its own initiative does not count, and neither does a directory whose terms forbid unsolicited email. The Federal Court of Appeal later confirmed that knowing someone’s job title is not enough to show your message is relevant to them.

The sender carries the burden of proof under CASL. Keep a record of where and when you found each address.

What every cold email should contain in both countries

• Your real name and company in the From line, and a subject line that matches the message.
• Your company’s mailing address, plus a phone number, email or web address so it also meets CASL.
• A free, one-step unsubscribe that still works two months after you send.
• Unsubscribes removed within 10 business days. Doing it at once is better.
• A message relevant to the reader’s job, sent to an address their company published.
• For the US, wording that makes it plain the email is a sales message.

Common mistakes

• Buying a list. Under CASL you need to show how each address was published by its owner and why your message is relevant to them. A purchased list rarely gives you that.
• Mailing addresses from directories whose terms forbid it. The CRTC has said those publications do not count.
• Treating B2B as an exemption. CAN-SPAM has none, and CASL’s only covers organizations that already have a relationship.
• Unsubscribe links that expire, need a login, or only stop one campaign.
• Sending from your main domain. It is not illegal, but complaints and bounces land on the domain your customers already rely on.

How we apply these rules for our clients

• We only use addresses a business publishes itself, mostly on its own website, and we keep the page each one came from.
• Pages and sites that say they do not want solicitations are skipped.
• Targets are set with you on the first call, so each message is relevant to the role it reaches.
• Every email carries your company name, your postal address and a one-click unsubscribe. Anyone who unsubscribes is never emailed by you again.
• Emails go out from a separate sending domain with your brand on it, never from your main domain.

The lead system page shows how the whole process works.