CASL for charities: how to grow your email list without getting into trouble
Canada’s Anti-Spam Legislation in plain language: the registered-charity exemption, implied vs. express consent, and how to set up your website sign-up form properly.
Email is still the most reliable way for a small organization to reach supporters. It is also covered by one of the strictest anti-spam laws in the world: Canada’s Anti-Spam Legislation, usually called CASL. The good news is that following it mostly means doing what good fundraisers already do.
General information, not legal advice. The CRTC’s CASL guidance is the authoritative source.
What CASL covers
CASL applies to commercial electronic messages (CEMs): emails, texts and direct messages that encourage someone to buy, sell, or take part in a commercial activity. To send one you need three things:
- Consent, either express or implied.
- Identification: who you are and how to reach you (a mailing address plus a phone number, email or web address).
- A working unsubscribe that is processed within 10 business days.
Penalties for organizations can reach $10 million per violation, so it is worth getting right.
The registered charity exemption
CASL exempts messages sent by or on behalf of a registered charity whose primary purpose is raising funds for that charity. A fundraising appeal from a registered charity generally does not need CASL consent.
That exemption is narrower than many people think:
- It applies to registered charities, not to every non-profit.
- It covers messages whose primary purpose is fundraising. Promoting your paid workshop, selling event tickets or selling merchandise may still count as commercial.
- It does not stop people from reporting you for spam. Unwanted email damages your reputation and your email deliverability whether or not it is legal.
The simplest approach is to treat everyone on your list as if CASL applies: get consent, identify yourself and honour unsubscribes quickly.
Implied vs. express consent
Implied consent exists in specific situations. For registered charities, it includes people who donated, volunteered or attended a meeting in the past two years. For membership organizations, it includes members. Implied consent expires, usually after two years, so you need to track dates.
Express consent is when someone actively says yes, and it does not expire until they unsubscribe. It is worth converting implied-consent contacts to express consent whenever you can.
Setting up your website sign-up form properly
- No pre-ticked boxes. Consent must be an active opt-in. (Our own contact form leaves the newsletter box unticked for exactly this reason.)
- Say who is asking and why, for example: “Send me [Organization]’s monthly newsletter and event invitations. You can unsubscribe at any time.”
- Keep records. Save when and how each person consented, including the wording of the form at the time. Most email platforms (Mailchimp, Brevo, Constant Contact and others) can store this automatically when they are set up correctly.
- Separate consents. Agreeing to receive a tax receipt is not agreeing to receive a newsletter.
- Authenticate your email domain with SPF, DKIM and DMARC. That is not a CASL requirement, but it keeps your messages out of spam folders and makes your domain harder to impersonate.
Quick checklist
- Sign-up forms use unticked checkboxes with clear wording
- Consent date and source stored for every contact
- Implied-consent contacts tagged with an expiry date
- Every email shows your organization’s name, mailing address and an unsubscribe link
- Unsubscribes processed automatically
- SPF, DKIM and DMARC configured for your domain
If any of these made you wince, talk to a human. Setting up a compliant sign-up flow and authenticated email is usually an afternoon’s work for us.