CASL Implied Consent: EBR Exemption, Time Limits, and Records

Canada’s Anti-Spam Legislation lets you send commercial electronic messages without express opt-in when you have an existing business relationship with the recipient, but the permission expires on a fixed timer. Under CASL’s existing business relationship exemption, a completed purchase, lease, accepted opportunity, or written contract gives you two years of implied consent, while a simple inquiry gives you six months. Miss the window, and the next message you send is treated as if the recipient had never heard of you.

What Counts as an Existing Business Relationship

Section 10(10) of CASL sets out the specific interactions that create an EBR. Casual contact does not qualify. The statute recognizes a defined list, and if your interaction with the recipient does not fit one of these, you do not have implied consent on this basis.

A purchase or lease of a product, goods, service, or land from your organization. This covers physical goods, digital subscriptions, and service contracts alike.
The recipient’s acceptance of a business, investment, or gaming opportunity you offered.¹
A written contract currently in force between you and the recipient, or one that expired within the applicable time window.
An inquiry or application from the recipient in respect of any of the categories above.²

The inquiry category is narrower than it looks. The statute limits it to requests “in respect of” the purchase, lease, opportunity, or contract categories. A job application is not an inquiry about buying your product, and treating employment applicants as EBR contacts is a common mistake. If you want to send marketing content to applicants, get express consent instead.

What the EBR Exemption Does Not Cover

CASL includes a parallel category, the existing non-business relationship, for registered charities, political parties and candidates, and non-profit clubs and associations.³ If your organization operates in that space, the rules resemble the EBR but sit in their own provision. And implied consent that arises from a conspicuously published address, a business card, or a verbal disclosure is a different exemption entirely, not an EBR, with its own conditions around relevance and prior objections.

How the Two-Year and Six-Month Clocks Run

The time limits are measured backward from the date you send a message, not forward from the date of the interaction. Every time you hit send, the qualifying event has to still fall inside the permitted window.

Two years applies to purchases, leases, accepted opportunities, and written contracts. For purchases and opportunities, the clock starts on the date of the transaction. For contracts, implied consent lasts while the contract is in force and for two years after it expires.²
Six months applies to inquiries and applications. The clock starts on the date the recipient submitted the request.³

A new qualifying transaction resets the clock. If a customer buys again 18 months after their first purchase, the two-year period restarts from the date of that second transaction. A new inquiry resets the six-month window the same way.

Once implied consent expires, you cannot send another commercial message unless you obtained express consent in the meantime. There is no grace period. No “one last reminder” exception. This is where most compliance failures happen: a marketing team assumes a customer who bought two and a half years ago is still fair game. They are not.

An unsubscribe request cuts the window short regardless of the calendar. Once a recipient opts out, the EBR gives you nothing. You must stop sending within 10 business days of the request.⁴

Records You Need to Prove the EBR

Under CASL, the sender carries the burden of proving consent for every message. If the CRTC investigates, believing you had consent is not a defense. You need records that show it.⁵

For each recipient you are messaging under an EBR, your records should capture:

The qualifying event, whether a purchase, lease, contract, or inquiry.
The date the event occurred, since that date starts the clock.
The specific electronic address tied to the consent.
The calculated expiration date, two years or six months out.

Records should be created within a reasonable period after consent arises. Reconstructing a consent history after regulators start asking questions is both difficult and unconvincing. Unsubscribe requests need their own log: what was asked, when, and when you removed the recipient from your list.

What Every Message Still Needs

The EBR exemption addresses consent. It does not exempt you from CASL’s content requirements. Every commercial electronic message you send under implied consent must include:

Sender identification. Your name, and if you are sending on behalf of another organization, that organization’s name as well.
A valid mailing address where you can actually be reached. A street address, PO Box, rural route, or general delivery address is acceptable, and it must remain valid for at least 60 days after the message is sent.⁴
A functional unsubscribe mechanism that stays active for at least 60 days after the message is sent.

If including all of the identification information in the message body is not practical, a clearly visible link to a webpage containing it is acceptable. The unsubscribe mechanism has to work, and it has to keep working. These rules apply whether the reach is one recipient or thousands, and whether the channel is email, SMS, or a direct message on a social platform. The CRTC has confirmed that “electronic address” under CASL covers email, telephone, instant messaging, and similar accounts, so an SMS marketing blast sent under an EBR faces the same identification and unsubscribe requirements as an email campaign.⁴

Convert to Express Consent Before the Clock Runs Out

The most valuable thing you can do with an EBR is replace it with express consent before it expires. Send the recipient a clear request asking permission to keep sending commercial messages. The request itself is a commercial electronic message, so it needs the sender identification, mailing address, and unsubscribe mechanism described above.

When the recipient confirms, update your database to reflect express consent and stop tracking an expiration date for that contact. Express consent lasts until the recipient withdraws it. Implied consent has a countdown. Trading one for the other while the window is still open turns a wasting asset into a stable one.

Penalties and the Due Diligence Defense

Administrative monetary penalties under CASL reach up to $1 million per violation for individuals and $10 million per violation for businesses.⁴ Those are maximums per violation, and a single campaign sent to a large list can produce many.

Section 33(1) of the Act provides a due diligence defense: a person cannot be found liable if they establish they took reasonable steps to prevent the violation.¹ The defense is not automatic. You have to show your compliance program existed before the violation, not that you assembled one afterward. The CRTC has said it looks for written policies and procedures, consent logs tracking express and implied consent for each recipient, records of unsubscribe requests and the actions taken, message templates and campaign records, and staff training documentation.³

A documented program does not guarantee immunity, but organizations that can produce one consistently fare better with regulators than those that cannot. The EBR exemption is a genuinely useful tool. It works only if you track the qualifying event, the date, and the expiration for every recipient with the same discipline you apply to any other legal obligation.

1
Justice Laws Website. Electronic Commerce Protection Act
2
Justice Laws Website. S.C. 2010, c. 23 – Section 10(10)
3
Canadian Radio-television and Telecommunications Commission (CRTC). Guidance on Implied Consent under Canada’s Anti-Spam Legislation
4
Canadian Radio-television and Telecommunications Commission (CRTC). Frequently Asked Questions about Canada’s Anti-Spam Legislation
5
Government of Canada. Enforcement Advisory – Notice for Businesses and Individuals on How to Keep Records of Consent