CASL is the strictest email consent law in the world — US e-commerce brands expanding to Canada are almost certainly violating it

CASL (Canada's Anti-Spam Legislation) is Canada's federal anti-spam law, in force since 2014. It requires businesses to obtain prior consent before sending commercial electronic messages to Canadian recipients. CAN-SPAM, the US equivalent, does not require prior consent — it allows sending to any address with reactive opt-out management. This is the fundamental difference: CASL is an opt-in regime, CAN-SPAM is an opt-out regime. A US brand that treats Canadian subscribers the same way it treats US subscribers — sending commercial email without CASL-specific prior consent — is violating CASL, regardless of whether it is compliant with CAN-SPAM. CASL fines reach $10 million CAD per violation for organisations and $1 million CAD for individuals, including company directors.

CASL-compliant email consent in Klaviyo requires three elements. First, the consent mechanism must meet the CASL standard: for express consent, an unchecked checkbox at checkout or a sign-up form with clear language describing what the subscriber will receive; for implied consent, a recorded transaction within the past 2 years. Second, three custom profile properties must be populated in Klaviyo for every Canadian contact at the time of collection: consent timestamp, consent source, and consent type. Klaviyo's built-in CASL consent fields support this when configured correctly. Third, the consent record must be stored in a retrievable format — meaning it can be produced if a CRTC investigation requires proof of consent for a specific subscriber.

Quebec's Charter of the French Language requires that commercial communications offered to Quebec consumers be available in French. Following the passage of Bill 96 (in force from June 2023), this requirement extends to e-commerce operations serving Quebec consumers. English-only commercial email to Quebec subscribers does not meet this obligation. In practice, this means building French-language variants of automated flows and campaign sends, and routing Quebec-based subscribers (identified by province from Shopify shipping address data) to the French variant as the default. Subscribers who have explicitly indicated an English language preference can be routed to the English variant, but French must be the default offer to Quebec residents.

Implied consent under CASL exists where there is an existing business relationship between the sender and the recipient without a prior express opt-in. The most common form for e-commerce is a purchase within the past 2 years — a customer who bought from your store within the last 24 months can be sent commercial email under implied consent. Implied consent lasts for 2 years from the date of the most recent triggering event (last purchase, last inquiry, etc.). It does not renew automatically. A customer who purchased 25 months ago and has not purchased since has had their implied consent expire, and the brand no longer has a legal basis to send them commercial email under CASL without a fresh express consent. This is why implied consent expiry management is a critical ongoing operational requirement, not a one-time setup task.

Handling implied consent expiry requires three operational processes. First, the Klaviyo profile must store the date of the last qualifying transaction for each Canadian subscriber so the expiry date can be calculated. Second, an automated flow should trigger at 22 months from the last transaction — 2 months before expiry — sending a re-consent email that invites the subscriber to give express consent before the implied consent window closes. This email must meet CASL requirements in its own right: it is a commercial message, it requires a valid consent basis to send, and it must include an unsubscribe mechanism. Third, subscribers who do not respond to the re-consent flow before the 2-year expiry must be moved to a suppressed segment and removed from all commercial sends. They cannot be emailed again without fresh express consent obtained through a non-commercial channel (for example, a transactional notification they have consented to receive, or a new purchase).