Contacts with expired CASL implied consent migrated without a re-consent workflow
CASL distinguishes between express consent (where a contact has explicitly opted in to receiving commercial electronic messages) and implied consent (which arises from an existing business relationship, an inquiry, or a published contact address used in a business context). Express consent does not expire. Implied consent has a defined maximum duration: two years from the date of the most recent business transaction, six months from an inquiry, and until rescinded for contacts whose email address was published in a business directory context. A CRM migration that moves all contacts regardless of consent type and consent date is moving a subset of contacts whose implied consent has already expired. The size of that subset grows with the age of the database. A five-year-old CRM with active imports but no consent date tracking may have 20 to 40 percent of contacts in an expired implied consent state. We assess consent status and consent date across the database before migration, categorise contacts by consent type and expiry status, and build a pre-migration re-consent workflow for contacts whose implied consent is within 90 days of expiry or has already expired. Contacts who do not re-consent are archived rather than migrated.