Canada’s anti-spam legislation is one of the stricter email laws anywhere, and it applies to the newsletter your nonprofit sends just as it applies to a company’s promotions. The rules are workable once stated plainly, but they are usually stated in legalese, so here is the working version for the person who actually hits send.
One framing first: CASL governs commercial electronic messages, which is any email or text that encourages participation in a commercial activity. A newsletter that promotes your paid conference, your merch or your courses qualifies. A message with no commercial element generally does not, but most real newsletters mix content, so the safe posture is to treat the newsletter as covered.
The two kinds of consent
Express consent is someone telling you, affirmatively, that you may email them: a signup form, a checked box they checked themselves. It does not expire. It is the gold standard, and the request itself has rules: say who you are, what they are consenting to, and that they can withdraw it. A pre-checked box is not express consent.
Implied consent comes from a relationship and carries a clock. If someone made a purchase from you, their implied consent runs about two years from that transaction. If they only made an inquiry, about six months. For registered charities there is a parallel: a donation or volunteering creates implied consent with its own two-year clock. The catch is obvious once you see it: implied consent expires quietly, one person at a time, which is unmanageable by hand.
The charity carve-out, honestly stated
Registered charities get a real exemption: a message whose primary purpose is raising funds does not require consent under CASL. That covers the appeal letter. It does not cover the general newsletter, the event promotion or the course announcement, and “we put a donate button at the bottom” does not make a message’s primary purpose fundraising. Lean on the exemption for what it is, not as a licence for the whole sending program.
Every message, regardless of consent
Two requirements attach to the message itself. You must identify yourself: name and mailing address, plus a way to reach you. And you must carry an unsubscribe that works at no cost to the recipient and takes effect within ten business days. In practice, honour it immediately; nothing is gained by using the grace period.
Why this is a database problem
Read the rules again and notice what they assume: that you know, for every address on your list, why you are allowed to email it and when that reason expires. That is not an email-tool feature. It is a property of your records.
This is where the usual stack fails. The email tool knows subscribers, the ticketing vendor knows buyers, the donation platform knows donors, and the consent story for any one person is scattered across all three. On Mercleo, consent is a fact on the contact record: captured with the form that earned it, carried beside the donations and purchases that create the implied clocks, and honoured by every send because there is no second system for an unsubscribe to fail to reach.
CASL’s penalties are serious (administrative penalties run to the millions for organizations), but compliance is not really about fear. An email program built on real consent is also the one people open. The law and the craft point the same way.
Posts on this blog are general information, current as of their publish date. They are not updated as laws, regulations, or products change. Nothing here is legal, tax, accounting, financial, or other professional advice, and reading a post does not create an advisor relationship of any kind. Check requirements against official sources, and talk to a professional advisor about your organization's situation.
Descriptions of Mercleo products, features, or pricing reflect the product at the time of writing and are not a commitment. The current product pages are the reference. Links to third-party sites are provided for convenience, not endorsement; we don’t control what’s on them.