CASL and Compliant Link-Building Outreach in Canada

If you run link-building outreach to Canadian websites, Canada’s Anti-Spam Legislation (CASL) applies to almost every email you send. CASL is the federal law that governs commercial electronic messages, and it sets strict rules on consent, sender identification and unsubscribe handling. Getting outreach right is not only about reply rates — non-compliance carries administrative penalties of up to CAD $10 million for a business. This guide explains, in plain language, how CASL shapes compliant outreach so you can earn links without breaking the law.

What is CASL, and why does it matter for link building?

CASL is Canada’s federal anti-spam law, in force since 1 July 2014. It regulates “commercial electronic messages” (CEMs) — messages sent by email, text or similar electronic means whose purpose is to encourage participation in a commercial activity. A link-building pitch that asks a webmaster to publish, edit or promote your content is commercial in nature, so it is a CEM.

The law is enforced primarily by the Canadian Radio-television and Telecommunications Commission (CRTC), working alongside the Office of the Privacy Commissioner of Canada and the Competition Bureau. The Government of Canada’s official guidance lives at fightspam.gc.ca. For link builders, the practical takeaway is simple: cold outreach is legal in Canada, but only if you can rely on a valid form of consent and your emails meet CASL’s content rules.

Does CASL apply to your outreach emails?

CASL applies whenever a commercial electronic message is accessed by a computer in Canada. In practice that means it covers your outreach if the recipient is in Canada — regardless of where you or your agency are based. A link builder in London or Toronto emailing a Canadian editor is equally bound by the rules.

Three conditions must all be satisfied before you send an outreach email to a Canadian recipient:

• Consent — you must have express or implied consent, or qualify for a listed exception.
• Identification — the message must clearly say who is sending it and how to reach you.
• Unsubscribe — the message must include a working mechanism to opt out of future messages.

Miss any one of the three and the message can breach CASL, even if the other two are perfect.

Express vs implied consent: which one covers cold outreach?

Consent is the foundation of CASL, and it comes in two forms. Understanding the difference is what separates compliant outreach from a spam complaint.

Express consent

Express consent is a clear, positive opt-in: the recipient actively agreed to receive your messages, for example by ticking an unchecked box or signing up to a list. It cannot be pre-checked, bundled into terms and conditions, or assumed. Express consent does not expire, but the recipient can withdraw it at any time. Because a genuine cold prospect has never opted in, express consent rarely covers first-touch link-building outreach — it is what you build over time once a relationship exists.

Implied consent and the existing business relationship

Implied consent exists when it is reasonable to conclude the recipient permits your message based on an existing relationship. The two windows most relevant to outreach are:

• Existing business relationship — valid for two years after the recipient’s most recent purchase, contract or transaction with you.
• Recent inquiry — valid for six months after the recipient made an inquiry about your goods or services.

If a Canadian publisher previously bought a service from you, or asked you about guest-post rates last month, you likely have implied consent to follow up. Implied consent is time-limited, so lists must be pruned as these windows expire.

The conspicuous-publication exception most link builders rely on

For true cold outreach, the exception that matters most is conspicuous publication. You may email a business address the recipient has published openly — for example an editor’s contact address on a website’s masthead or contact page — provided that all of the following are true:

• the address was published without a statement that the person does not want unsolicited commercial messages;
• your message is directly relevant to the recipient’s business role or function.

This is narrower than many outreach tools imply. Emailing a site’s generic “info@” inbox with an irrelevant pitch, or blasting a published address with an off-topic template, does not qualify. A targeted, role-relevant message to an editor whose job is to commission or place content is far more defensible. Because the exception is fact-specific, many Canadian privacy lawyers treat it as a supporting argument rather than a blanket licence to send.

What every compliant outreach email must contain

Even with valid consent, the content rules under section 6 of CASL still apply to every CEM. There are two non-negotiable parts.

Sender identification and contact information

Each message must clearly identify who is sending it — and, if you are sending on behalf of a client or agency, that party too. You must provide contact details that let the recipient reach you: a mailing address, plus at least one of a working phone number, an email address, or a web address. This identification and contact information must stay valid for at least 60 days after the message is sent, so a burner address that dies next week does not comply.

A working unsubscribe that you honour within 10 business days

Every outreach email must include an unsubscribe mechanism that is clearly and prominently set out and simple to use — typically a reply instruction or a one-click link. The mechanism must remain functional for at least 60 days after you send the message. When someone opts out, you must stop sending to them without delay and no later than 10 business days after the request, with no extra confirmation step required of them. A broken or ignored unsubscribe link is one of the most commonly penalised CASL failures.

Why you must never buy or scrape outreach lists

Purchased and scraped email lists are incompatible with CASL. Consent under CASL is specific to the sender and cannot be bought, sold or transferred, so a list vendor’s “consent” does not carry over to you. Scraping addresses at scale also collapses the conspicuous-publication exception, because that exception depends on relevance to each individual recipient’s role — something a bulk scrape cannot establish. Beyond CASL, buying lists damages deliverability and sender reputation and undermines the quality signals that make outreach effective in the first place. Build your own targeted lists from publicly listed, role-relevant contacts instead.

What are the penalties for getting CASL wrong?

CASL is backed by significant administrative monetary penalties (AMPs). A violation can cost up to CAD $1 million per violation for an individual and up to CAD $10 million per violation for a business or other organization. The CRTC has issued real penalties — including cases centred on missing or non-functional unsubscribe mechanisms and consent failures — so these figures are not theoretical ceilings.

One point of context: CASL’s “private right of action”, which would have let individuals sue senders directly, was suspended indefinitely in June 2017 and has not come into force. That does not lower the bar — regulatory enforcement by the CRTC, and the AMPs above, remain fully in effect.

A CASL-compliant outreach workflow, step by step

Compliance is easier when it is built into your process rather than checked at the end. A practical, repeatable workflow looks like this:

1. Source contacts manually from publicly published, role-relevant addresses — never from a purchased or scraped list.
2. Record your legal basis for each contact (implied consent window, or conspicuous publication with a note on where the address was found).
3. Personalise for relevance so the message clearly fits the recipient’s editorial or business role.
4. Add full identification — your name, your company or client, a mailing address and at least one other contact method.
5. Include a working unsubscribe and keep it live for at least 60 days.
6. Log consent and opt-outs and process any unsubscribe within 10 business days.
7. Re-check expiry windows before re-contacting, and remove anyone whose implied consent has lapsed.

Use the checklist below before any outreach campaign goes out the door.

Common CASL mistakes in link-building outreach

Most CASL problems in outreach come from a handful of avoidable errors:

• Treating “B2B” as exempt. CASL has no blanket business-to-business exemption; the conspicuous-publication exception is narrow and relevance-dependent.
• Relying on bought or scraped lists and assuming the vendor’s “consent” transfers to you — it does not.
• Omitting a mailing address. Many senders include a name and email but forget the physical mailing address CASL requires.
• A weak or missing unsubscribe. “Reply to opt out” is fine only if you actually process it within 10 business days and keep the channel open for 60 days.
• Irrelevant mass templates. A generic pitch to a published address undercuts the very relevance the exception depends on.
• Not keeping records. If you can’t show your basis for consent, you can’t defend the send. Keep consent and opt-out logs.

Who does this apply to?

CASL applies to anyone sending commercial outreach that is accessed in Canada: in-house SEO teams, agencies, freelancers and outreach specialists alike, whether based in Canada or abroad. If your prospect list includes Canadian publishers, bloggers or business owners, plan your campaigns around CASL from the start. Aligning with CASL also raises the quality of outreach generally — targeted, relevant, consent-aware emails are exactly the messages that earn genuine editorial links rather than complaints.

Disclaimer

This article is general information about Canada’s Anti-Spam Legislation for educational purposes only and is not legal advice. CASL is complex and fact-specific; rules and enforcement practice can change. Before running outreach campaigns that reach Canadian recipients, confirm current requirements with the official Government of Canada guidance at fightspam.gc.ca and the CRTC, and seek qualified legal advice for your situation. All link-building outreach described here should be conducted lawfully, transparently and in line with our site’s editorial policy — never using purchased or scraped lists, deception or manipulative tactics.

Frequently Asked Questions (FAQ)

Is cold email outreach legal in Canada under CASL?

Yes, cold outreach is legal if you meet CASL’s requirements. You need a valid basis to send — usually implied consent or the conspicuous-publication exception — and every message must identify you, give valid contact details and include a working unsubscribe. Sending without any of these, or to bought lists, is where senders run into trouble.

What is the difference between express and implied consent under CASL?

Express consent is an active opt-in that does not expire until withdrawn. Implied consent arises from an existing relationship — valid for two years after a purchase or contract, or six months after an inquiry — and lapses when that window closes. Cold outreach usually relies on implied consent or the conspicuous-publication exception rather than express consent.

How quickly must I honour an unsubscribe request under CASL?

You must stop sending commercial messages to that recipient without delay, and in no case later than 10 business days after they opt out. The unsubscribe mechanism itself must also stay functional for at least 60 days after you send the message, and the recipient should not have to take extra steps to confirm.

Can I use a purchased or scraped email list for outreach in Canada?

No. Consent under CASL is specific to the sender and cannot be bought, sold or transferred, so a vendor’s list gives you no valid consent. Scraping also defeats the conspicuous-publication exception, which depends on the message being relevant to each individual recipient’s role. Build targeted lists from publicly listed, relevant contacts instead.

What are the penalties for breaking CASL?

Administrative monetary penalties can reach CAD $1 million per violation for an individual and CAD $10 million per violation for a business or organization. The CRTC enforces these, and has issued real penalties for issues such as broken unsubscribe mechanisms and consent failures.