CASL compliance for Victoria small businesses: what you actually need to know
Canada's Anti-Spam Legislation (CASL) has been in force since 2014 but still confuses — and intimidates — a lot of small business owners. The maximum penalties are eye-watering ($10 million for organizations), so the fear is understandable. But for a small Victoria business sending legitimate marketing emails to customers, compliance is actually straightforward. Here's what you need to know.
What CASL actually covers
CASL applies to 'commercial electronic messages' (CEMs) — emails, texts, and social media messages that promote a product, service, or business. It does not apply to messages that are purely transactional (booking confirmations, receipts, password resets), messages between people with a personal relationship, or messages sent to individuals in their business capacity (B2B, with some nuance).
The two types of consent
Express consent: The person explicitly agreed to receive your marketing messages — by ticking a checkbox at checkout, filling in a form, or verbally agreeing and being documented. Express consent never expires. Implied consent: A commercial relationship exists — the person bought from you or made an inquiry in the last 2 years, or they published their contact information publicly and it's relevant to their business. Implied consent expires after 2 years from the last transaction.
What every CEM must include
Every commercial electronic message must include: (1) clear identification of who is sending it — your business name; (2) contact information — your mailing address and either a phone number, email address, or web address; (3) a functioning unsubscribe mechanism that works for at least 60 days after sending. An unsubscribe must be honoured within 10 business days.
Practical compliance for a small service business
If you collect email addresses at your business (sign-up forms, booking forms), add an explicit opt-in checkbox: 'I agree to receive occasional marketing emails from [Business Name]. You can unsubscribe anytime.' Keep a record of when and how consent was given. For existing customers, you have 2 years of implied consent from their last transaction — use that time to get express consent by giving them a reason to stay subscribed.
The consent record you need to keep
The burden of proof is on you — if the CRTC investigates a complaint, you need to prove consent existed. Your record should include: the person's name and email, the date and method of consent, and what they were told at the time. A simple spreadsheet or your email platform's subscriber list with a consent date column is sufficient for most small businesses.
What actually triggers complaints
CASL complaints almost never come from customers who bought from you and agreed to your email list. They come from purchased lists, scraping contact info from websites, and sending marketing to people who only ever had a transactional relationship and never opted in. Run a legitimate, consent-based list and the practical risk is very low.
Put this into practice automatically
VictoriaBiz AI handles review requests, responses, and local content — built for Victoria businesses.
Start free 14-day trial