CASL Spam Reporting Form: An Outbound Checklist For Consent And Unsubscribe
· 5 min read
A CASL safe outbound checklist for consent, unsubscribe, identification, and record keeping, plus how the CASL spam reporting form works.
Email and text messaging support lead generation, sales outreach, appointment reminders, and customer follow-up. But when a message has a commercial purpose, Canada’s Anti-Spam Legislation, commonly known as CASL, may apply.
CASL affects how marketing, sales, website forms, CRM systems, and automated workflows are designed. The main requirements are:
establish a valid consent basis;
identify the sender;
provide a working unsubscribe mechanism;
retain records that support the consent being used.
This article provides general operational information and is not legal advice. CASL requirements and exemptions depend on the specific circumstances.
Does CASL Apply?
Before sending an email, SMS, or automated message, consider three questions:
Is it being sent to an electronic address through email, SMS, instant messaging, or a similar platform?
Does it contain commercial or promotional information?
Is every part of the message accurate and not false or misleading?
If the first two answers are yes, the message may qualify as a commercial electronic message, or CEM.
Record the Consent Basis
The sender should be able to explain why each recipient can legally receive a commercial message.
Express Consent
Express consent exists when someone agrees, verbally or in writing, to receive commercial electronic messages. It generally remains valid until the recipient withdraws it.
For each contact, retain:
the date and method of consent;
the wording shown or communicated;
the source form, page, event, or conversation;
the types of messages covered;
any limits placed on the consent.
If consent was collected through a website form, keep the form wording that appeared at the time. If it was given verbally, document the conversation.
Implied Consent
CASL recognizes implied consent only in specific circumstances.
An existing business relationship may create implied consent for up to two years after a qualifying purchase, contract, or transaction. An inquiry or application may create implied consent for up to six months.
Your CRM should record:
the implied-consent category;
the event that created the relationship;
the event date;
the expiry date;
the evidence supporting that relationship.
These time periods do not create universal permission. The relationship must meet the relevant CASL definition.
Can You Email an Address Found Online?
An email address published online does not automatically give permission to send marketing messages.
Implied consent through conspicuous publication may exist only when:
the recipient published the address or caused it to be published;
no statement indicated that unsolicited commercial messages were unwanted;
the message is relevant to the recipient’s business, role, functions, or duties.
If relying on this basis, retain the original webpage, collection date, surrounding language, applicable website terms, and a note explaining why the message was relevant to the recipient’s role.
The sender carries the burden of proving consent, and every situation must be assessed individually.
Identify the Sender
A commercial electronic message should include:
the business name;
the name of anyone on whose behalf it is sent;
a current mailing address;
a phone number, email address, or website;
contact information valid for at least 60 days.
When agencies and vendors are involved, clarify who owns the campaign, who selected the recipients, and who materially influenced the content. A platform that only delivers a message has a different role from a provider that chooses recipients or adapts the message using customer data.
Provide a Working Unsubscribe Mechanism
Every CEM must provide a clear and easy way to unsubscribe at no cost.
For email, this normally means a visible unsubscribe link. For SMS, it may mean replying “STOP” or “Unsubscribe.”
The mechanism should not require the recipient to sign in, remember a password, delete an account, contact customer service, or complete unnecessary steps.
The unsubscribe link must remain valid for at least 60 days. Requests must be processed without delay and no later than 10 business days.
A central suppression process should also prevent another connected system from continuing to message the same person.
Keep Records That Can Be Retrieved
A practical consent record should include:
| Record | Information to retain |
|---|---|
| Consent basis | Express consent, business relationship, inquiry, or another applicable basis |
| Source | Form, purchase, contract, event, call, or published address |
| Evidence | Form submission, email, call note, screenshot, or transaction record |
| Dates | Consent date, triggering event date, and expiry date |
| Scope | Types of messages covered by the consent |
| Unsubscribe history | Request date, completion date, and systems updated |
| Record owner | Person or team responsible for the information |
Records should allow another authorized person to understand why a contact received a message without relying on an employee’s memory.
Connect Website Forms, CRM, Email, and SMS
CASL compliance becomes harder when contact information moves through disconnected tools.
A connected system should answer five questions for every contact:
Where did the contact come from?
What consent basis is being used?
What types of messages may be sent?
When does the consent expire?
Has the recipient unsubscribed?
Automation can record timestamps, calculate expiry dates, block expired contacts from campaigns, and synchronize unsubscribe requests. It does not determine whether a consent basis is legally valid, but it helps teams apply approved rules consistently.
Prepare for Complaints
Canada’s Spam Reporting Centre receives approximately 5,000 complaints per week.
If a complaint is investigated, an organization may need to show:
why the person was contacted;
where the address came from;
what consent basis was used;
what message was sent;
whether the sender was identified;
whether the unsubscribe request was handled correctly.
This makes CASL an operational and information-management responsibility, not simply a legal statement added to an email footer.
How IN-STORE Can Support the Workflow
IN-STORE can help organizations build the marketing infrastructure that supports consistent outreach practices, including:
website and lead-capture workflows;
CRM field structure;
email and SMS templates;
consent and source tracking;
unsubscribe and suppression workflows;
marketing platform integrations;
campaign documentation and reporting.
IN-STORE does not replace qualified legal counsel or determine whether a legal exemption applies. Our role is to help translate approved requirements into practical marketing systems.
Explore IN-STORE marketing and lead generation services