If you send emails to Canadian contacts on behalf of your organization, implied consent is likely already part of your workflow, even if you have not named it that. It is the permission that applies when someone makes a purchase, submits an inquiry, or signs up for a service, without explicitly opting in to your list. Under Canada’s Anti-Spam Legislation (CASL), implied consent is a legitimate basis for sending commercial emails, but it comes with a catch: it expires.
This post is for Canadian communications and marketing teams who need to understand what implied consent actually means under CASL, when it runs out, and how automated tools can help you track it without building a spreadsheet nightmare.
1. What is implied consent under CASL?
Implied consent under CASL is permission to send commercial electronic messages (CEMs) based on an existing relationship between your organization and the recipient, without them having explicitly opted in. It is recognized in specific circumstances and is always time-limited, unlike express consent, which has no expiry date unless the recipient withdraws it.
CASL, which came into force on July 1, 2014, requires all senders of CEMs to Canadian recipients to have either express or implied consent before sending. The CRTC’s guidance on implied consent outlines the exact circumstances in which it applies and the documentation required to rely on it.
The core principle is straightforward. If someone has an existing business or non-business relationship with your organization, you may be permitted to email them, but only for a defined period and only if you can prove that relationship existed.
2. How long does implied consent last?
Implied consent is time-limited under CASL, and the duration depends on the type of relationship that created it. Most organizations deal with two categories.
Inquiry-based consent applies when someone submits a contact form, requests a quote, or downloads gated content. In these cases, implied consent lasts for 6 months from the date of the inquiry.
Transaction-based consent applies when someone makes a purchase, completes a subscription, or enters into a contract with your organization. Here, implied consent lasts for 24 months from the date of the transaction.
Once either window closes, you are no longer permitted to send promotional emails unless the contact has given express consent. If you have no record of the original consent date, you cannot rely on implied consent at all. According to CASL compliance guidance, the burden of proof always rests with the sender.
3. What triggers implied consent?
Implied consent is created by specific actions that indicate an existing relationship. Your email platform should be capturing these events and recording the date they occurred.
Common triggers include:
- A product inquiry or contact form submission (6-month window)
- A purchase, subscription, or signed contract (24-month window)
- A donation to a charitable organization (24-month window)
- Membership in a club, organization, or association (24-month window)
It is worth noting that implied consent can also apply when a person’s email address is conspicuously published (for example, on a company website) and the message is relevant to their professional role. The CRTC’s FAQ provides scenario-by-scenario guidance on when this applies.
What does not trigger implied consent: a pre-checked opt-in box, silence after receiving a message, or a purchased contact list. None of these constitute valid consent under CASL.
4. What happens when implied consent expires?
When implied consent expires, you must stop sending promotional emails to that contact immediately. There is no grace period. If you continue emailing them, you are in violation of CASL, regardless of whether the contact has complained.
CASL penalties for non-compliance can reach up to $10 million CAD per violation for organizations. The legislation also provides individuals with a private right of action, meaning recipients can sue senders directly.
In practice, this is where many teams run into trouble. Without a system that tracks consent acquisition dates and automatically calculates expiry, it is easy for expired contacts to remain on active campaign lists, especially as your list grows.
Automated consent management tools like Envoke handle this by marking contacts as “consent expired” and removing them from future sends as soon as the expiry date is reached. This happens in the background, without manual intervention.
Need help managing consent expiry automatically?
Envoke is built for Canadian organizations that need CASL compliance built into their email platform, not bolted on.
5. How to convert implied consent to express consent
Converting contacts from implied to express consent is the most reliable way to protect your list long-term. Express consent never expires on its own, so once a contact opts in explicitly, you no longer need to track a countdown clock for them.
There are two practical methods for doing this before implied consent runs out.
I) Consent expiry reminder campaigns
Send an email to contacts approaching their expiry window, asking them to confirm they want to keep hearing from you. This is a standard re-permission campaign. For best results, send it 60 to 90 days before expiry, while the contact is still within your permitted sending window.
II) Inline consent prompts
Embed a consent upgrade prompt directly in your regular email sends. A short banner or call-to-action at the bottom of a newsletter asking the reader to formally opt in can generate express consent without requiring a dedicated campaign.
Both approaches work best when they are automated and triggered by consent status rather than by a manual review process. The goal is to move as many contacts as possible to express consent before their implied window closes.
6. Managing implied consent at scale
Tracking consent manually is manageable when your list is small. It becomes a liability when you have thousands of contacts at different stages of their consent lifecycle. At that point, the risk of error is too high to rely on spreadsheets or ad-hoc processes.
Effective consent management at scale requires a few things working together.
- Automatic logging of consent type and acquisition date at the point of interaction
- Real-time expiry calculation for every contact on your list
- Automated exclusion of expired contacts from campaign sends
- Bulk import support with backdated consent dates for historical contacts
- API or integration support to sync consent data from your CRM or website
Platforms built for Canadian compliance, like Envoke, include these capabilities as core features rather than add-ons. For teams in the public sector, post-secondary institutions, or any organization managing large, segmented contact lists, this kind of built-in compliance infrastructure makes a meaningful difference.
It is also worth noting that CASL protects existing consent statuses during imports. Express consent cannot be downgraded, and unsubscribed contacts stay unsubscribed, even if a new data import would otherwise overwrite those records.
Frequently asked questions
Express consent is a positive opt-in action, such as checking an unmarked box to receive emails. It has no expiry date. Implied consent is inferred from an existing relationship, like a purchase or inquiry, and it expires after 6 or 24 months depending on the type of interaction.
Yes, for up to 6 months from the date of the inquiry. That form submission creates inquiry-based implied consent under CASL. After 6 months, you need express consent to continue emailing them.
If you have no record of the consent acquisition date, you cannot legally rely on implied consent. CASL places the burden of proof on the sender. If the date is unknown, treat the contact as requiring express consent before emailing them.
Yes. CASL applies to any commercial electronic message sent to a recipient in Canada, regardless of where the sender is located. If your recipient is in Canada, CASL governs the interaction.
Only if you currently have valid consent to send them an email in the first place. Requesting express consent is itself a CEM under CASL. This is exactly why converting contacts during their implied consent window matters: once that window closes, you can no longer reach out to ask.