CASL-Compliant Membership Renewal Emails: A Canadian Checklist

A recipient in Canada sets the scope

Canada's Anti-Spam Legislation (CASL) applies when a message reaches a recipient in Canada, even if the organization or its server is elsewhere.

A paid membership renewal email is a commercial electronic message because it encourages continued paid participation, whether it asks for payment or simply says the membership term is ending.

Enforcement is shared by the CRTC, Competition Bureau and Office of the Privacy Commissioner. The official Act text sets out the statute, while CRTC consent guidance summarizes the consent categories. CAN-SPAM is a separate regime with different consent expectations, and it does not displace CASL for a Canadian recipient.

The pieces to cite are these. The Act is S.C. 2010, c. 23. Section 6 prohibits commercial electronic messages without consent and sets the content requirements. Section 10 covers consent, and section 11 covers unsubscribe. The CRTC's Electronic Commerce Protection Regulations (SOR/2012-36) fill in the detail, and Compliance and Enforcement Information Bulletin CRTC 2012-548 explains how the CRTC reads them. Under section 13, the sender must prove it had consent.

An active term supports implied consent

For a current paid member, implied consent can support a renewal message during the membership, as long as the email address came to the organization through that relationship. This is the active-membership row in the table; it does not create permission to mail addresses collected from unrelated sources.

Which kind of implied consent applies depends on the organization. A club, association or voluntary organization that is a non-profit can rely on an "existing non-business relationship" through membership (sections 10(9)(b) and 10(13)(c) of the Act, with "membership" defined in the Regulations). A for-profit community, such as a paid online forum run as a business, relies on an "existing business relationship" (sections 10(9)(a) and 10(10)): a purchase or a written contract in the previous two years. In both cases the clock runs two years from the end of the membership or contract.

A recent lapse has a fixed endpoint

The implied-consent period continues for two years after the membership relationship ends, provided the address was obtained through that relationship. Its endpoint follows the end of membership, not the last time someone opened an email. Check each lapsed record against its relationship end date before a campaign.

An expired window is not a win-back list

A former member whose relationship ended more than two years ago cannot rely on implied consent for another renewal email. If that person never gave express consent, leave the address out of a win-back campaign. The renewal email sequence must also stay within the period when contact is permitted.

Express consent follows a different clock

Express consent offers a separate basis: it does not expire on its own, although the member can withdraw it at any time. At signup, keep the date, collection source and wording the member accepted, whether consent came through a checkbox or an email confirmation. The setup checklist on writing checkout and renewal notices shows where signup consent is captured.

The distinction matters when a membership ends. An express-consent record can remain relevant after the implied period expires, but the organization still needs evidence of what the member agreed to and must respect any withdrawal. Do not treat a bare database flag as a substitute for that record.

Put the required details in the email

Whatever the consent basis for a send, the message must carry three things: sender identification, contact information and a working unsubscribe mechanism. The address may be Canadian or foreign, but it must be current and valid. The Regulations accept a mailing address that can receive mail for at least 60 days after sending.

Sender identification means the name of the person sending and, if the message is sent on someone else's behalf, the name of that person plus a statement saying who is who. Contact information means the mailing address and one of a telephone number with voice messaging, an email address or a web address.

A recipient must be able to unsubscribe at no cost, using the same electronic means the message arrived by. The mechanism should be simple, so avoid forcing a login, a password or a second confirmation. A one-click link or a reply to the email works. Keep the mechanism functional for at least 60 days after the email is sent, and give effect to the request without delay and no later than 10 business days (section 11 of the Act).

The send or no-send checklist

Run these steps in order for every renewal batch. A "no" at any step means do not send until it is fixed.

Keep the evidence behind each address

For every address you mail, retain when consent was given, how it was obtained, and the wording shown to the member. A dated screenshot of the signup form gives more context than a database flag alone. These details help demonstrate the basis when a regulator asks.

Keep unsubscribe requests, the date each was received, and the date it was processed. Also retain the message sent, including how its unsubscribe mechanism appeared. A three-year retention period is a reasonable working rule; document it in a written retention policy your team can follow.

List imports can erase the history behind a consent flag if membership software overwrites that field. Test how the system behaves when lists are merged, and make sure the organization can produce the original signup source, date and wording when asked. A flag without supporting history is weak evidence.

Enforcement can reach beyond one message

The CRTC can issue a notice of violation with an administrative monetary penalty. Under section 20 of the Act, the maximum is CAD 10 million per violation for a business and CAD 1 million for an individual. Penalties can be lower in practice, but the statutory ceiling remains a material exposure for a renewal program.

A single member complaint may prompt scrutiny of the wider mailing list. The Act's private right of action was suspended in 2017, so enforcement currently comes from the regulators. A broken unsubscribe path can prompt spam reports and harm deliverability for later renewal campaigns, making list hygiene relevant beyond the first message.

Separate the Canadian rules from local overlays

The core CASL consent and unsubscribe rules apply across Canada, while provincial consumer protection laws can add duties for automatic-renewal terms. Quebec also has language requirements under the Charter of the French Language for commercial communications directed at Quebec members, and its Consumer Protection Act governs automatic-renewal contracts with consumers. Renewal copy for that audience needs a separate review. See Quebec renewal requirements.

Tax treatment is separate from consent. The Canada Revenue Agency publishes place-of-supply rules used to determine which GST/HST rate applies when members are in different provinces. Review the GST/HST renewal tax rules as a separate issue from permission to send.

For US members on the same mailing list, CAN-SPAM and state auto-renewal statutes, such as California's auto-renewal disclosure rules, apply instead. A single template across both countries can miss the different requirements. If billing US members, review the FTC negative-option changes alongside the email copy before sending.