Rules
CASL Ecommerce Win-Back Email Rules in Canada
CASL ecommerce win-back email rules in Canada: learn consent deadlines, required sender and unsubscribe details, records, Quebec obligations and penalties.
What to take away
- A win-back email is a commercial electronic message under CASL, so it needs consent, sender identification and a working unsubscribe.
- Implied consent from a purchase lasts two years from that purchase. Past that line, a dormant customer needs express consent.
- Proof of consent rests with the sender, and the record must outlive the consent itself.
- The CRTC enforces the law and can penalise a business.
- US opt-out rules do not travel. A CAN-SPAM style list still breaks Canadian rules when the message is opened in Canada.
A win-back email to a customer whose last purchase was in March 2024 looks routine in mid-2026 and is a violation, because implied consent from that order expired in March 2026. The gap between when a list feels alive and when the law says it is dead is where retailers get caught.
Who has jurisdiction over a win-back send
Canada’s Anti-Spam Legislation (CASL; S.C. 2010, c. 23) has been in force since July 1, 2014. Section 6 addresses consent, sender identification and unsubscribe requirements for commercial electronic messages; section 10 addresses consent. CASL covers commercial electronic messages sent from Canada or accessed in Canada, so Canadian addresses matter even when the sender sits abroad.
Three bodies share enforcement. The CRTC handles consent, sender identification and unsubscribe functions, the ground covered by CASL consent requirements. The Competition Bureau handles misleading claims in the same message. The Office of the Privacy Commissioner handles address harvesting and the personal information behind the list.
The consent clocks that decide a dormant list
| Consent | How it arises | When it ends |
|---|---|---|
| Express | The customer opts in after seeing the required disclosure | Does not expire unless withdrawn |
| Implied, purchase | A purchase or a signed contract | Two years after the transaction |
| Implied, inquiry | A question about a product or service | Six months after the inquiry |
| Implied, publication | A published business address, with a message relevant to the role | No set date, ends when asked to stop |
| Implied, referral | A referral from someone with a relationship to the customer | Six months after the referral |
An express-consent request must clearly and simply identify the person seeking consent and, if different, the person on whose behalf it is sought; state each purpose; provide a mailing address and one of a phone number, email address or web address; and say that consent can be withdrawn.
The purchase clock decides win-back campaigns. Only a new purchase or a signed contract restarts it. An open or a click does not create consent, and retailers routinely assume otherwise. Decay shows in any honest repeat purchase rate by industry review.
Consent clocks for win-back lists
- Purchaseimplied consent ends 2 years later
- Inquiryimplied consent ends 6 months later
- Referralimplied consent ends 6 months later
- Expressno expiry unless withdrawn
- Withdrawnpermanent, no cooling-off period
Once a recipient withdraws consent, you cannot rely on that consent again. A later campaign needs a new, valid basis for sending, such as fresh express consent.
What a compliant win-back message must contain
Every message needs the sender's name and the name of the person or business on whose behalf it is sent. It needs a mailing address and one of: a phone number, email address or web address.
The unsubscribe must be clear, prominent and functional for 60 days after the send, and you must act on a withdrawal within 10 business days. Ecommerce email marketing teams that treat the footer as decoration fail the identification test.
Records that prove consent
The sender carries the burden of proof, so a clean list means a documented list. Personal information in that list also sits under PIPEDA, and the OPC interpretation of PIPEDA covers what consent for marketing requires. For each contact, keep four practical records that show the legal basis and what happened:
- The consent basis and date, including the purchase, contract or other event supporting implied consent.
- The source and supporting evidence, such as the signup form or transaction record.
- The exact consent request and disclosure shown to the contact.
- The current consent status, including any withdrawal date and suppression action.
Consent records to keep per contact
- Date and source of consent
- Exact wording the customer saw
- System record tying signup to person
- Purchase supporting implied consent
- Hold 3 years past consent end
Hold these for three years past the point where consent ends, not three years past the signup. A purchase that supports implied consent in 2026 has to be provable in 2029 if a complaint arrives. Consent records and post-purchase email sequence design are usually owned by different teams, which is how gaps open.
Example: a dormant customer file in Ontario
Take a Toronto retailer pulling a win-back segment in June 2026. The filter reads "no purchase in 18 months". The list includes customers whose last order was in April 2024.
For that group, implied consent ended in April 2026. The filter measured dormancy. It did not measure the consent clock. The two lines cross at different points.
If a recipient complains, the retailer must produce consent records for the whole campaign, not only for the complainant. The CRTC does not need volume to open a file.
What happens if you do not comply
The CRTC can issue an administrative monetary penalty, require changes to a compliance program, and publish the outcome. It has used that power. Compu-Finder was penalised in 2015 for commercial electronic messages sent without consent. Directors and officers who authorised the conduct can be held personally liable.
Where the rules differ by place
Canada is opt-in. The United States is opt-out, as the FTC's CAN-SPAM guide explains for senders. One template across both countries follows neither rule properly.
Quebec adds obligations for personal information under Law 25, and PIPEDA applies federally. Law 25 amended Quebec’s Act respecting the protection of personal information in the private sector. When a retailer relies on consent to use personal information for email marketing, that consent must be clear, free, informed and specific; it must be requested separately for each purpose in clear, simple language, and it may be withdrawn.
What governs a send is where the message is opened, not where the office sits. That is why ecommerce retention marketing treats consent as an input.
