No CASL consent timestamp or source stored per contact
Canada's Anti-Spam Legislation requires that businesses sending commercial electronic messages can demonstrate how and when they obtained consent from each recipient. This means storing the consent type (express or implied), the consent date, and the consent source for every contact in the CRM. Express consent requires an affirmative action — a checked opt-in box at the point of form submission. Implied consent applies in specific circumstances defined by CASL and has a time limit. HubSpot and Zoho do not create CASL consent fields by default. Contacts created from web forms, trade show badge scans, referrals, or manual entry arrive in the CRM with no consent record. If a recipient complains to the CRTC and the business cannot produce consent documentation, the liability exposure is significant. This is a configuration gap, not a legal complexity.