CASL Compliance
Last updated: 10 October 2026
Who the law binds
Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23) governs commercial electronic messages sent to or from Canada, including email and text messages, wherever the sender is. Like CAN-SPAM it binds the sender. SplashSend does the mechanical parts by default, and this page says which parts those are and which are yours.
Consent under CASL
CASL recognises two kinds of consent, and both need to be recorded:
- Express consent: the person actively agreed, for example by submitting a sign-up form, and was told who was asking and that they could withdraw at any time. It does not expire until withdrawn.
- Implied consent: an existing business relationship, such as a purchase or a written enquiry, or a conspicuously published address with no note refusing marketing. Implied consent from a purchase lasts two years from the purchase, and from an enquiry six months, after which you need express consent to carry on.
Pre-checked boxes and silence are never consent. The person asking must identify themselves at the time.
What the product records
When someone joins through a SplashSend form we record when, how, and the address the sign-up came from. Through the API we record the same, with the address of the system that sent them, and through a Shopify sync we record the time Shopify gives for their consent and that it came from the store. Every later change of status is written to a log that is kept even after they unsubscribe. That is the record CASL asks you to keep. A person you add by hand or import from a file has a record that says exactly that and nothing more, so the evidence of their consent, and the date an implied consent started, is yours to hold. Confirm by email first (double opt-in) is a switch on every form, off by default; on, nobody is subscribed until they click the link we email them.
Identification and the unsubscribe mechanism
CASL requires your mailing address in every commercial message. Every marketing email carries your sender name and address, and your postal address in the footer once you add it in Setup. Without one, we warn you before a campaign sends and on the Cruise page, and the email can still go out, so add one if you email people in Canada. Every email carries an unsubscribe link and the one-click headers email apps use. CASL requires the mechanism to work for at least 60 days after the email and to be honoured within ten business days; ours works for as long as your account exists and takes effect the moment it is used. The preference centre lets a reader narrow what they receive rather than leave, and every email still carries the unsubscribe link.
What stays yours
- obtaining consent, and noting when an implied consent will expire;
- adding your mailing address in Setup, so it is in every message you send to people in Canada;
- keeping the evidence for anyone you added by hand or imported;
- honouring a request to stop that arrives by other routes within ten business days;
- never using a purchased, rented or harvested list, which CASL forbids and our Terms forbid.
SplashSend does not send text messages today. If you collect phone numbers and texting consent through a connected store we hold them, and CASL will apply to any texting feature we add in the same way it applies to email.
Penalties
The CRTC can impose penalties of up to $1,000,000 per violation on an individual and $10,000,000 on a business, and it enforces the law actively, so keep good records of consent.