Express vs Implied Consent Under CASL: How Long Each Lasts
The difference between express and implied consent under Canada’s anti-spam law, how long implied consent lasts, how to calculate it, and how to prove consent.
- Express consent lasts until the person withdraws it. Implied consent expires.
- A purchase gives 2 years of implied consent. An inquiry gives 6 months.
- Each new purchase or inquiry restarts the clock.
- Pre-checked boxes don’t count as express consent.
- You must be able to prove consent, so record how and when you got it.
Under Canada’s anti-spam law, you need consent before sending a commercial text. That consent comes in two kinds, express and implied, and the difference decides how long you can keep texting someone. This article explains both, how to calculate when implied consent runs out, and how to keep records that would stand up if you were ever asked.
Express consent
Express consent means the person clearly agreed to receive your messages. It can be given out loud or in writing, and it doesn’t expire. It lasts until the person withdraws it, for example by replying STOP.
What your request must say
Section 10(1) of the Act and section 4 of the regulations set out what a request for express consent must include:
- The purpose, stated clearly and simply. For example: “Text me appointment reminders and seasonal offers from Harbourline Heating.”
- Who is asking, and anyone they’re asking on behalf of.
- Contact information: a mailing address plus a phone number, email address or website.
- A statement that the person can withdraw consent at any time.
How you can’t get it
- No pre-checked boxes. The CRTC says each consent box must be actively checked by the person. A box you tick for them doesn’t count.
- Not buried in terms and conditions. Consent to messages must be asked for separately, not bundled into agreeing to your terms of service or sale.
- Not by texting them to ask, unless you already have implied consent. A message asking for consent is itself a commercial message.
Implied consent
Implied consent comes from an existing relationship. It lets you text people who haven’t explicitly agreed, but only for a limited time. The main sources for a business are:
| What happened | Implied consent lasts |
|---|---|
| They bought or leased a product, service or land from you | 2 years from the purchase or lease |
| They accepted a business, investment or gaming opportunity from you | 2 years |
| You have a written contract with them | While it’s in force, and 2 years after it ends |
| They made an inquiry or application about your products or services | 6 months from the inquiry or application |
There are other forms too. One is an existing non-business relationship, such as a donation to a registered charity or membership in a club. Another is an address that was published or handed to you, such as on a business card, but that only covers messages relevant to the person’s business role.
How to calculate the clock
The law counts back from the day you send the message. A purchase must fall within the two years immediately before that day, and an inquiry within the six months before it.
Each new purchase or inquiry starts its own clock, and you can rely on whichever runs out last. The CRTC describes the periods as running from the last transaction date:
| Date | What happened | Implied consent until |
|---|---|---|
| March 3, 2025 | Customer asks for a quote by text | September 3, 2025 |
| April 10, 2025 | Customer books and pays for a furnace service | April 10, 2027 |
| January 20, 2027 | Customer asks about a heat pump | July 20, 2027, since the new inquiry runs later than the purchase |
| July 21, 2027 | No new purchase or inquiry | Expired: stop commercial texts |
When an implied consent nears its end, you can ask for express consent while the implied consent still covers that request. The request itself is a commercial message, so the timing matters.
Withdrawal applies to both
Either kind of consent ends when the person withdraws it. A STOP reply, an unsubscribe link or a phone call saying “don’t text me” all count. You must give effect to the withdrawal without delay, and within 10 business days at most. Keep the opt-out on record so the person isn’t texted again by mistake, for example from another of your numbers or after a list import.
Proving consent
If the CRTC asks, you must prove you had consent. The burden is yours, not the recipient’s. The CRTC gives examples of good evidence:
- Written or online consent: a record showing the date, time, purpose and how it was given. For example, a database entry when someone checks the box on your form, or a screenshot of the form.
- Oral consent: a complete, unedited audio recording, or confirmation that an independent third party can verify.
- Implied consent: your sales or inquiry records, with dates, so you can show when each clock started.
The law doesn’t set a retention period. The CRTC suggests keeping consent records for as long as you keep contacting the person. Written policies and consistent records can also support a due diligence defence if something goes wrong.
Express vs implied at a glance
| Express | Implied | |
|---|---|---|
| How you get it | The person clearly agrees, orally or in writing | From a purchase, inquiry, contract or similar relationship |
| How long it lasts | Until withdrawn | 2 years (purchase) or 6 months (inquiry), restarting with each new one |
| What you must record | Date, purpose, method and proof of agreement | Date and type of the relationship |
| Ends when | The person opts out | The period passes, or the person opts out |
For most businesses, the practical goal is to turn implied consent into express consent while you still can. Ask at checkout, on your booking form, or in a text sent while implied consent still applies.
Let Tidewire track CASL consent for you
Tidewire records each contact’s consent and when it expires, skips anyone without valid consent on bulk sends, adds your business name and opt-out wording, and honours STOP and ARRÊT instantly. French texts cost the same as English.
Get early accessSources
- Canada’s Anti-Spam Legislation, S.C. 2010, c. 23
- Electronic Commerce Protection Regulations (CRTC), SOR/2012-36
- CRTC guidance on implied consent
- CRTC Compliance and Enforcement Information Bulletin 2012-548
- CRTC frequently asked questions about CASL
This article is general information, not legal advice. Laws and guidance change, so check the sources below or ask a lawyer about your situation.