CASL consent has not been documented: Canadian businesses are running AI lead qualification sequences without knowing whether express or implied consent covers the automated outreach the sequence sends
CASL Section 6 requires express or implied consent before sending a commercial electronic message, and the type of consent determines both the scope of permitted outreach and the duration of that permission. Express consent has no expiry unless withdrawn. Implied consent from a business relationship lasts two years from the date of last purchase, contract, or inquiry. Most Canadian B2B businesses operating with HubSpot or Salesforce contact databases have a mixture of both consent types, with no property in the CRM tracking consent type, source, or expiry date. When an AI lead qualification sequence deploys automated emails against this database, the business cannot determine which contacts have valid CASL consent for each message in the sequence. The CRTC enforcement record shows that the documentation obligation is taken seriously, and Canadian businesses with contact databases of several thousand or more contacts face non-trivial enforcement risk if a CASL audit were to find absent documentation. The fix is a consent audit, CRM property configuration, and form update: it is a one-time exercise with ongoing compliance benefit.