Canada's anti-spam law (CASL) says you need consent before you send commercial emails or texts, and every message must say who you are and offer a free, easy way to unsubscribe. For a loyalty program, the safest habit is to ask members clearly, with a checkbox they tick themselves, before you send promos by email.
What is CASL, in plain words?
CASL is Canada's law about spam and other electronic threats. The government's CASL overview page says it focuses on commercial electronic messages. Those are messages that encourage people to take part in a commercial activity.
For a small shop, that usually means promo emails and texts. "20% off this weekend" is a commercial message. So is "Come try our new menu".
What does CASL require for loyalty program messages?
There are three basics. The government's page on key email marketing rules covers them:
- ✅ Consent. You need permission before you send.
- 🏷️ Identify yourself. Say who sent the message and how to reach you.
- 🚪 An unsubscribe option. Every message needs one that works.
What is the difference between express and implied consent?
Express consent is a clear "yes". Implied consent is permission the law assumes in certain situations, for a limited time.
Express consent
The government guidance describes express consent as someone agreeing, out loud or in writing, to receive your messages. It has no time limit unless the person withdraws it.
For a loyalty card, express consent usually looks like a sign-up form with an unticked box the customer ticks on their own:
Implied consent
Implied consent only applies in certain cases. One is an existing business relationship, such as a recent purchase. The same government guidance says it may be valid for up to 2 years, or just 6 months for inquiries or applications. The Act sets out those time periods in section 10.
Implied consent runs out. Tracking who bought what, and when, is a lot of bookkeeping for a small shop. That is one reason many owners just ask for express consent at sign-up.
How should you identify yourself in a message?
Put your business name and real contact details in every commercial message. The Act (section 6) says a message must identify the sender and give a way to contact them. The government guidance says that means a current mailing address and either a phone number, email or website.
A simple footer does it:
How fast do you have to process unsubscribes?
Within 10 business days, at no cost to the person. That comes from section 11 of the Act. The unsubscribe link or address also has to keep working for at least 60 days after you send the message.
In practice, most email tools handle this for you the moment someone clicks. If you keep a list by hand, check it before every send.
What does a good loyalty sign-up look like under CASL?
Keep it short and honest. Here is a pattern many shops use:
- Ask only for what you need. A first name joins the card. Email is optional.
- Make the box unticked. The customer ticks it themselves if they want emails.
- Say who is asking and what for. "Maple Street Bakery can email me offers and news."
- Say they can leave anytime. "Unsubscribe anytime."
- Keep a record. Note when and how each person agreed.
Are messages inside a wallet card treated the same as email?
That's a fair question, and the honest answer is: ask a lawyer. A wallet card message is different from an email or text in how it works. It shows on a card the customer chose to add, and the customer can turn those notifications off on their phone at any time.
In the Regulars approach, those in-card messages are handled separately from email. Customers can switch lock screen messages off anytime. Messages outside the wallet are covered by a separate consent checkbox at sign-up. We don't make a legal call on how CASL applies to in-card messages for your shop. A lawyer who knows CASL can tell you what fits your situation.
What are common CASL mistakes for small shops?
- ❌ Adding everyone who ever bought something to a promo email list forever.
- ❌ No address or contact info in the footer.
- ❌ An unsubscribe link that leads nowhere.
- ❌ No record of who agreed and when.
None of these are hard to fix. A short sign-up form and a decent email tool cover most of it. Good vibes, clean list. 🍁
Where can you read the official rules?
- Canada's anti-spam legislation (Government of Canada)
- Key email marketing rules
- The Act itself (Justice Laws website)
How does Regulars handle consent?
Regulars is made in Ontario, Canada. Customers join with a first name. You can choose to also ask for email, phone or birthday. A consent checkbox covers messages outside the wallet. You own your customer list, and Regulars never sells data. For more on keeping sign-up short, read why a first name is all you need. For how in-card messages work, see lock screen messages.
Questions people ask
Does CASL apply to loyalty program emails?
CASL covers commercial electronic messages, which are messages that encourage someone to take part in a commercial activity. Promotional emails to loyalty members usually fit that description, so it is worth reading the rules or asking a lawyer.
What is the difference between express and implied consent under CASL?
Express consent means the person clearly agreed to get your messages, and it does not expire unless they withdraw it. Implied consent applies only in certain situations, like a recent purchase, and is generally time-limited.
How long does implied consent last after a purchase?
The government's guidance says implied consent from an existing business relationship may last up to 2 years after a purchase, or 6 months after an inquiry or application.
How fast do I have to honour an unsubscribe under CASL?
The Act says no later than 10 business days after the person asks, and unsubscribing must be free for them.
Is this article legal advice?
No. It is general information only. Check the official sources linked in the article and talk to a lawyer about your own situation.
