CASL Rules for AI Outreach: What Burnaby Teams Can Send

The law didn't change this year. Your output volume did. An AI assistant can draft two hundred personalized holiday emails before lunch, and Canada's Anti-Spam Legislation applies to every one of them exactly as it would to a message you typed yourself.

CASL has been in force since July 1, 2014. The CRTC's plain summary of what it wants is short: if you're sending a commercial electronic message, you need to "(1) obtain consent, (2) provide identification information, and (3) provide an unsubscribe mechanism" (CRTC, Frequently Asked Questions about CASL). Nothing in there grants an exception for drafts a model wrote.

Adoption is real, so this is worth getting right. Statistics Canada reported that 19.2% of Canadian businesses used AI to produce goods or deliver services in the 12 months before the second quarter of 2026, up from 12.2% a year earlier and 6.1% in the second quarter of 2024 (Statistics Canada, June 11, 2026).

Consent is the whole game in December

There are two kinds. Express consent means the person proactively opted in, and the CRTC notes it "is not time-limited: once express consent is obtained you are able to send CEMs until the recipient notifies you that they no longer want to receive them" (CRTC, Guidance on Implied Consent).

Implied consent is the one that quietly expires over the holidays. Under an existing business relationship you generally have two years from a purchase, lease, accepted business opportunity, or written contract, and only six months from an inquiry or application. So a customer who bought from you in December 2024 is still inside the window this December. Somebody who asked for a quote in February 2026 and never bought is already outside it.

That matters more when a tool builds the send list. A model happily writes a warm December note to a lead from 2023. It has no idea the clock ran out.

"I found their email online" is not consent

The conspicuous publication rule is the most misread part of CASL, and it's where AI powered prospecting tools get teams into trouble. The CRTC is explicit that it "sets a higher standard than the simple public availability of electronic addresses," that the address must be directly available to the public and typically indexed by a search engine, and that the message must be relevant to the recipient's role, functions, or duties.

Their own example: a training company can email a marketing officer about a social media marketing course, but cannot email the chief operating officer about an administrative assistant course using the same published address. Same list, different outcome.

The CRTC also notes that if a third party scrapes and resells those addresses on its own initiative, that "would not create implied consent on its own." Buying an enriched list transfers nothing to you, and section 13 of the Act puts the onus of proving consent on the sender.

What AI actually puts at risk is the subject line

CASL isn't the only statute in play. Section 52.01 of the Competition Act makes it an offence to "knowingly or recklessly send or cause to be sent a false or misleading representation in the sender information or subject matter information of an electronic message," and a separate subsection covers representations in the body that are false or misleading in a material respect (Competition Act, s. 52.01). On summary conviction that's a fine of up to $200,000, imprisonment up to one year, or both.

This is the sharp edge for generated copy. Models invent urgency well. "Your account expires Friday" or "as discussed on our call" reads great and may be flatly untrue. A human writing one email knows whether there was a call. A pipeline generating four hundred doesn't.

The complaint data suggests regulators are hearing about exactly this. Between October 1, 2025 and March 31, 2026 the Spam Reporting Centre received 189,908 submissions. Among complaints filed through the online form, 93% cited lack of consent, 48% cited sender identification, and 46% cited deceptive marketing practices (CRTC, Enforcing CASL). In the same report the CRTC says that because CASL is now well established, there's "a heightened expectation of compliance" and it intends to take stronger measures, with penalties of up to $10,000,000 per violation for a business and $1,000,000 for individuals. The Commission has a memorandum of understanding with the Consumer Protection Authority of British Columbia, so this isn't a distant Ottawa concern for a shop in Burnaby or New Westminster.

The unsubscribe link is where most complaints start

Every commercial message needs identification for the sender and anyone the message is sent on behalf of, a mailing address valid for at least 60 days after sending, and an unsubscribe mechanism. The CRTC's guidance on the regulations says the mechanism must be "accessed without difficulty or delay" and "should be simple, quick, and easy for the consumer to use" (Information Bulletin CRTC 2012-548). Once someone unsubscribes you have 10 business days to stop.

If your AI sequencer keeps a lead in a five touch cadence after they opt out, that's the violation, not the copy.

A pre-send checklist for AI drafted outreach

• Tag every contact with the consent basis and the date, then filter by it before any send. Express, existing business relationship with its expiry date, or conspicuous publication with a saved screenshot of where you found it.
• Strip unverifiable claims from generated copy. No invented prior conversations, no deadlines that don't exist, no discounts nobody approved.
• Lock the footer. Legal name, the party you're sending on behalf of if different, a mailing address good for 60 days, and one working unsubscribe link.
• Test the unsubscribe link in the actual send, not the preview. Broken links are a named complaint driver in the CRTC's report.
• Suppress unsubscribes across every tool, including the new one someone added last month.
• Keep records. The CRTC lists consent logs, message scripts, campaign records, unsubscribe requests and staff training as what supports a due diligence position.

Feeding your list into a model is a separate question

CASL governs the sending. Privacy law governs the contact data itself. Canada's federal, provincial and territorial privacy authorities published joint principles for generative AI on December 7, 2023, and two lines apply directly here: collection and use of personal information for AI tools should be "limited to what is necessary for the purpose," and "accountability for decisions rests with the organization, and not with any kind of automated system" (OPC, Principles for responsible, trustworthy and privacy-protective generative AI technologies). Pasting your full CRM export into a chat window to "personalize" a campaign is a decision you own.

Where this doesn't apply

Plenty of messages fall outside the consent requirement. Section 6(6) of the Act exempts messages that only provide a quote or estimate the recipient asked for, confirm a transaction already entered into, deliver warranty, recall or safety information, or concern an existing subscription, membership or employment relationship (CASL, S.C. 2010, c. 23). Messages between individuals with a personal or family relationship are excluded too, as are inquiries directed at a business. Your shipping confirmations and renewal notices are fine.

There's also a case for not automating this at all yet. Statistics Canada researchers Jiang Li and Huju Liu found that AI adopting firms showed 16.8% higher productivity than non-adopters, but once they controlled for pre-existing conditions and complementary investments the gap fell to 5.1% and lost statistical significance. Their conclusion is worth sitting with: "there is no statistically significant direct association between AI adoption and productivity," and "AI adoption in isolation is likely insufficient to deliver transformative productivity gains" (Economic and Social Reports, April 22, 2026).

Generating volume you can't legally send is negative value. If your consent records are a mess, fix the records first and write the emails by hand this year. That's the honest answer for a lot of small teams in Metro Vancouver.

This post is general information, not legal advice. CASL enforcement turns on specific facts, and a lawyer is cheaper than a notice of violation.

Sources

• Canadian Radio-television and Telecommunications Commission. *Frequently Asked Questions about Canada's Anti-Spam Legislation*. https://crtc.gc.ca/eng/com500/faq500.htm
• Canadian Radio-television and Telecommunications Commission. *From Canada's Anti-Spam Legislation (CASL) Guidance on Implied Consent*, modified 2024. https://crtc.gc.ca/eng/com500/guide.htm
• Canadian Radio-television and Telecommunications Commission. *Compliance and Enforcement Information Bulletin CRTC 2012-548: Guidelines on the interpretation of the Electronic Commerce Protection Regulations (CRTC)*, 2012. https://crtc.gc.ca/eng/archive/2012/2012-548.htm
• Canadian Radio-television and Telecommunications Commission. *Enforcing Canada's Anti-Spam Legislation (CASL), October 1, 2025 to March 31, 2026*, 2026. https://crtc.gc.ca/eng/internet/pub/20260331.htm
• Government of Canada. *An Act to promote the efficiency and adaptability of the Canadian economy..., S.C. 2010, c. 23*. https://laws-lois.justice.gc.ca/eng/acts/E-1.6/page-1.html
• Government of Canada. *Competition Act, R.S.C. 1985, c. C-34, section 52.01*. https://laws-lois.justice.gc.ca/eng/acts/C-34/section-52.01.html
• Statistics Canada. *Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026*, June 11, 2026. https://www150.statcan.gc.ca/n1/pub/11-621-m/11-621-m2026010-eng.htm
• Li, Jiang and Huju Liu. *Artificial intelligence adoption and productivity in Canadian firms*, Economic and Social Reports, Statistics Canada, April 22, 2026. https://www150.statcan.gc.ca/n1/pub/36-28-0001/2026004/article/00002-eng.htm
• Office of the Privacy Commissioner of Canada and provincial and territorial privacy authorities. *Principles for responsible, trustworthy and privacy-protective generative AI technologies*, December 7, 2023. https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/

Autana Solutions builds AI employees for small and mid-sized businesses around Burnaby and Vancouver, and consent hygiene is part of what we wire up before a single message goes out. If you want a second set of eyes on your holiday sequence before it sends, book a free call and we'll walk through your list, your consent records, and what's safe to automate.