Blog · 4 min read
Four CASL checks every cold email passes before it leaves our system
By Simplee Editorial Team. Reviewed by Vlad Sherbatov · Published · Updated
Sources checked October 19, 2026
Canada's anti-spam law lets a business email someone who asked it a question for 6 months after that inquiry, and no longer without fresh consent (S.C. 2010, c. 23, s. 10(10)(e)).
Key figures
- Simplee runs 4 consent checks before any cold email, built on sections 6, 10 and 11 of Canada's Anti-Spam Legislation (S.C. 2010, c. 23, current to 2026-09-30).
- Under Canada's Anti-Spam Legislation, an inquiry supports implied consent for 6 months (S.C. 2010, c. 23, s. 10(10)(e), current to 2026-09-30).
- Under Canada's Anti-Spam Legislation, an unsubscribe link must stay valid for at least 60 days after the message (S.C. 2010, c. 23, s. 11(2), current to 2026-09-30).
- Under Canada's Anti-Spam Legislation, an unsubscribe must take effect within 10 business days of being sent (S.C. 2010, c. 23, s. 11(3), current to 2026-09-30).
That 6-month line decides more of a lender's email program than any subject line. We sell to lenders and our own sales agent emails businesses, so we turned the Act into rules a system follows before a message leaves.
This is not legal advice. It is how we read the Act and what our system does with it.
Consent and three pieces of content come before anything else
A commercial email needs the person's consent, express or implied, and it has to meet the content rules (s. 6(1)). Those rules are short: identify the sender, give a way to reach them, and carry an unsubscribe mechanism (s. 6(2)).
Implied consent has three common routes. One is an existing business relationship, which includes an inquiry made within the six months before the message (s. 10(10)(e)).
Another is an address the person "conspicuously published" with no statement refusing unsolicited messages, where the message is "relevant to the person's business, role, functions or duties" (s. 10(9)(b)). The third is an address the person handed over without saying no.
The unsubscribe rules leave little room. The link or address must stay valid "for a minimum of 60 days" after the message (s. 11(2)). An unsubscribe must take effect "no later than 10 business days" after it is sent (s. 11(3)).
Four checks stand between a lead and a sent message
| Check | What it refuses | Where it comes from in the Act |
|---|---|---|
| 1. Business address or inquiry | A personal email address, unless that person made an inquiry | s. 10(9) and s. 10(10)(e) |
| 2. Consent with a date | Any message after an inquiry's 6 months, unless the person gave express consent | s. 10(10)(e) |
| 3. Identity and a working unsubscribe | A message without the sender's name, contact details and a one-click unsubscribe | s. 6(2) and s. 11 |
| 4. Never re-approach | Anyone who unsubscribed, bounced, is a client, or is already in a conversation with us | s. 11(3), and our own rule |
Check 1. A personal address, such as a free webmail account, is emailed only after that person made an inquiry. A business address on a company domain can be emailed about the person's role in that business.
That matters most for merchant cash advance lenders. Many small business owners run their company from a personal address, and we reach them only after they ask us something.
Check 2. Every lead carries its consent basis and an expiry date. An inquiry, such as a free audit request or a website form, sets the expiry at 6 months from the latest inquiry.
Express consent has no expiry until the person withdraws it. When an inquiry's date passes, no further message based on it is written.
Check 3. Every message names the sender and how to reach us, with a one-click unsubscribe in the message header and a signed link in the footer. An unsubscribe stops everything as soon as our system reads it, well inside the law's 10 business days.
Check 4. A suppressed address never comes back, and neither does anyone we already have a conversation with. A reply, a booked or held call, or a proposal sends the person to a human instead, and clients and partners are never prospected.
A dated consent record decides what a lender can send
Lenders' email rarely underperforms because of the law itself. It underperforms when nobody can say why the lender may email a given person, and until when, so the program either over-sends or stops.
Each address needs a basis, a date and an expiry before any copy is written. With that record in place, the copy can stay plain.
We also changed one habit because of this. A person who asked us a question is the most valuable contact we have, and the clock starts that day, so we now answer inquiries first and treat the 6 months as a deadline rather than a cushion.
The published-address route is narrower than it looks
The "conspicuously published" route depends on facts a system cannot fully check, such as whether a page carried a "no solicitations" note. We are unsure any system can, so we treat that route narrowly and keep personal addresses behind an inquiry, and a lender with a different reading should take its own legal advice.
Two terms we use that the Act does not
- Inquiry window is our term for the 6 months after a person's latest inquiry, during which implied consent holds.
- Engaged is our term for a person with a reply, a booked or held call, or a proposal. They are never emailed by the agent again.
Source: Canada's Anti-Spam Legislation, S.C. 2010, c. 23, sections 6, 10 and 11, Justice Laws Website (consolidation current to 2026-09-30), opened 2026-10-19. The four checks describe Simplee's own system as of 2026-10-19.