How CASL and PIPEDA consent rules affect Canadian ecommerce win-back emails

What to take away

Express consent versus implied consent in a Canadian win-back flow

A win-back flow usually starts with a lapse: no purchase, no click, no reply for months. Under Canada's Anti-Spam Legislation, the message you send to that lapsed customer needs a lawful basis. Express consent is the stronger one. Implied consent is the common one in ecommerce.

Express consent ecommerce Canada means the customer actively opted in: a checkbox at checkout, a contest entry, a preference centre toggle. It does not expire on a fixed date. It lasts until the person withdraws it, and withdrawal must be as easy as giving it. Keep the record of when and how it was given.

CASL implied consent is narrower. It arises from an existing business relationship, a conspicuously published business address, or a direct inquiry. For most retailers, the existing business relationship is the workhorse: a purchase, a contract, or an inquiry within the past two years.

A win-back flow built only on implied consent has a shelf life. Once the window closes, the contact is not mailable under CASL unless another basis exists. That is why the smarter pattern is to convert implied consent into express consent before the clock runs out.

Practically, that means your win-back series should do two jobs at once: recover the sale and upgrade the consent. A message that says "still want to hear from us?" with a clear yes button does both. It also gives you a dated express consent record for the next cycle.

How does CASL affect ecommerce win-back emails? It changes the timing, the copy and the suppression logic. You cannot treat a three-year-old buyer as a subscriber. You can treat them as a prospect only if some other basis, such as a new inquiry, applies.

The consent basis should be visible to the marketer who builds the segment. If your platform stores only an email address and a last order date, you are guessing. Store the basis, the source and the expiry date alongside the contact.

That is what the common ecommerce marketing strategy questions come down to when deciding whether a win-back send is lawful, not just effective.

Where each basis fits in the lifecycle

The two-year implied consent window and what resets it

The two-year implied consent window is the period during which an existing business relationship supports commercial electronic messages without express consent. In ecommerce it most often runs from the last purchase. It can also run from the last inquiry or the last written contract.

What resets it? A new purchase. A new inquiry. A new contract. In each case the clock restarts from that event. A click on an email does not reset it. Opening a message does not reset it. A loyalty point redemption alone does not reset it unless it is tied to a purchase or contract.

The window is not a grace period you can stretch. If the last purchase was in March 2024 and you send in April 2026, the basis is gone unless something else applies. A win-back flow that runs on a fixed 24-month cadence will eventually mail people it should not.

Build the expiry into the segment. Most email platforms let you store a custom date field. Set it to the last purchase date plus two years, and refresh it on every new order. Then exclude anyone whose date has passed from marketing sends.

For a lapsed buyer near the edge, the win-back message itself can be the conversion tool. Ask for express consent in the same email that offers the incentive. If they click yes, you have a durable basis. If they ignore it, let the implied basis expire and move them to a suppression list.

Quebec and the other provinces do not change the federal two-year rule, but provincial consumer protection acts can add rules about representations and cancellations. Ontario's Consumer Protection Act, for example, governs how you describe an offer. Keep the win-back copy accurate about what the discount does and when it ends.

A worked example

A Montreal outdoor gear retailer last sold to a customer on 14 June 2024. On 1 May 2026 the marketer wants a win-back send.

What the CRTC expects from commercial electronic messages under CASL

The CRTC enforces CASL's form and content rules. Every commercial electronic message must identify the sender, give a physical mailing address, and include a working unsubscribe mechanism. These are not optional footer items.

The sender identification must be accurate. If a brand sends on behalf of a subsidiary, the message should make that clear. A generic "marketing team" line is weak. Use the legal name or the name the recipient would recognize, plus a mailing address that reaches the business.

The unsubscribe mechanism must be functional for at least 60 days after the message is sent. It must be able to handle a reply to the message if the message says so. One-click links are fine, but the link must work without a login and without a survey.

The Electronic Commerce Protection Regulations set out the form and content requirements, including what the unsubscribe mechanism must do and how sender information must appear. Read them before you template a win-back footer.

The CRTC also cares about consent records. If a complaint arrives, the burden is on the sender to show consent. That means the record should show the basis, the date, the source and the scope of consent. A screenshot of a checkout checkbox is better than a memory.

Penalties are not trivial. The CRTC can issue notices of violation with monetary penalties, and the Office of Consumer Affairs tracks spam and fraud complaints that can follow. The Identity theft, spam and fraud page explains the consumer harm that drives enforcement.

One more CRTC expectation: do not make the unsubscribe harder than the subscribe. If a customer opted in with one click, a three-step preference centre with a login is a problem. Keep withdrawal simple and immediate.

What the Office of the Privacy Commissioner expects under PIPEDA

PIPEDA governs how private-sector organizations handle personal information in the course of commercial activity. For ecommerce, that covers email addresses, order histories, browsing data and loyalty profiles. It is supervised by the Office of the Privacy Commissioner of Canada.

The PIPEDA overview explains the law and its scope. The core idea for marketers: consent must be meaningful. A pre-checked box is not meaningful. A buried term in a long policy is not meaningful either.

The PIPEDA fair information principles include consent, limiting collection, limiting use and retention. In a win-back flow, limiting collection means you should not pull in data you do not need for the send. Limiting retention means you should not keep lapsed contacts forever.

The OPC's Privacy Guide for Businesses covers consent, collection and retention in practical terms. It is the document to hand to whoever writes your privacy policy and your preference centre copy.

PIPEDA and CASL are different laws with different triggers. CASL asks whether you may send the message. PIPEDA asks whether you may hold and use the data behind it. A win-back flow has to satisfy both. That is why canadian ecommerce sms retention tools now shape how analytics teams stitch customer records together.

Withdrawal of consent under PIPEDA should stop the processing, not just the email. If a customer says stop using my data, the retention team should suppress the contact and flag the record for deletion under the retention schedule. Keep a minimal suppression record so you do not mail them again by mistake.

Building the unsubscribe mechanism and sender identification into retention emails

The unsubscribe mechanism belongs in every commercial electronic message, including win-back emails and post-purchase mail that carries a promotional element. Transactional messages, such as an order confirmation, are treated differently, but the line is easy to blur. If the message promotes a product, treat it as commercial.

Build the footer once and reuse it. It should carry the sender's legal name, a physical mailing address, and a working unsubscribe link. Add a preference centre link for people who want fewer emails rather than none. That reduces full unsubscribes and keeps the relationship alive.

Make the unsubscribe immediate. A common failure is a link that opens a form, then queues the change for a nightly job. Under CASL the withdrawal should take effect without delay and certainly within the 10-day period the law allows for processing. Process it on click.

Separate unsubscribe from consent withdrawal. An unsubscribe stops commercial electronic messages. A consent withdrawal under PIPEDA stops the processing of personal information. Your preference centre should let people do either, and your CRM should record which one they chose.

Sender identification should match the brand the customer knows. If your win-back email comes from a sub-brand, say so in the from-name and the footer. If it comes from a third-party platform, the footer must still name the brand on whose behalf the message is sent.

A post-purchase email sequence is a good place to test the footer and the preference centre before you scale win-back. Post-purchase mail gets higher engagement, so problems surface faster. Fix the footer there, then reuse it.

A short build order

Consent records, retention periods and breach duties for ecommerce lists

A consent record is the evidence you would show the CRTC or the OPC. It should include the contact identifier, the basis, the date, the source, the scope and any withdrawal. Store it where the retention team can query it, not in a marketer's spreadsheet.

Retention periods should be defined and enforced. PIPEDA does not set a fixed number of years, but it requires that personal information be destroyed, erased or made anonymous once it is no longer needed for the purpose.

For lapsed contacts, a defensible schedule might keep the record for the consent window plus a short audit period, then delete or anonymize.

Breach duties matter for ecommerce lists. PIPEDA requires organizations to report breaches of security safeguards that pose a real risk of significant harm to the OPC and to notify affected individuals. A leaked email list with order histories can meet that threshold. Have a breach response plan that names who reports and who notifies.

Access requests are part of the same discipline. A customer can ask what you hold about them and ask for correction. Your retention tooling should be able to produce that record without a manual hunt through platforms. If it cannot, the retention schedule is not real.

Quebec adds its own privacy regime for provincial organizations, and the Charter of the French Language requires commercial messaging in French. For a win-back flow aimed at Quebec, plan for French copy, French preference centre text and French unsubscribe confirmations. A single English template will not do.

Provincial consumer protection acts can also apply to the offer itself. A win-back discount with a countdown should state the deadline accurately. Competition Bureau Canada rules on deceptive marketing practices apply to urgency claims, so keep the timer honest.

A CASL consent ecommerce Canada checklist for win-back campaigns

Use this before every win-back send. It covers the consent basis, the message form and the data behind it. It is not legal advice, but it is the operational floor for a Canadian retention team.

A quick reference for the two consent types

If you answer no to any checklist item, fix it before the send. The cost of a suppressed contact is lower than the cost of a complaint. And the win-back flow works better when the consent is clean, because the list you mail is the list that actually wants to hear from you.

For a walkthrough of the recurring issues, see the customer lifetime value canadian ecommerce page. It covers the consent, deliverability and measurement questions that come up most often in Canadian retention work.

Common questions