Is SMS marketing legal in Canada?

The CASL Reality: Why Most Businesses Get SMS Consent Wrong

Many businesses assume SMS marketing in Canada is straightforward, but the reality under CASL is far more complex—and getting consent wrong carries serious risk. Under the Canadian Anti-Spam Legislation (CASL), sending commercial electronic messages (CEMs), which include SMS and MMS, requires either express or narrowly defined implied consent, and failing to obtain proper authorization can result in substantial fines. The stakes are high: individuals face penalties of up to $1 million per violation, while businesses can be fined as much as $10 million per violation—a structure designed to deter non-compliance through significant financial consequences.

Enforcement is not theoretical. Between October 1, 2021, and March 31, 2022, Canadians submitted over 167,939 spam complaints to the Spam Reporting Centre—averaging more than 6,400 per week—demonstrating active regulatory scrutiny and public intolerance for unsolicited texts. This volume reflects a broader trend: since CASL took effect in July 2014, Canadian-based spam has dropped by 37%, yet ongoing complaints show that violations persist, especially in channels like SMS where consent misunderstandings are common. For companies like GrowthPros, which specializes in delivering consent-recorded leads with AI-powered follow-up, this underscores the importance of building compliance into every touchpoint—from lead sourcing to reactivation campaigns—rather than treating it as an afterthought.

A critical misstep many businesses make is assuming consent for one channel, such as email, automatically extends to SMS. CASL explicitly rejects this notion: consent for one type of CEM does not transfer to another. As Klaviyo emphasizes, agreeing to receive emails does not imply permission to send texts, social media messages, or instant messages—each channel requires its own specific, documented consent. Similarly, implied consent based on an existing business relationship expires after two years, while inquiry-based implied consent lapses after just six months, meaning outdated assumptions about "grandfathered" permissions often lead to violations. To stay compliant, organizations must implement express opt-in mechanisms tailored to SMS, maintain detailed records including timestamps and disclosure text, and ensure every message includes clear identification and functional unsubscribe links in both English ("STOP") and French ("ARRET"). Without these safeguards, even well-intentioned outreach risks crossing into non-compliant territory—triggering not just fines, but reputational damage and blocked carrier delivery.

• Obtain express consent specifically for SMS/MMS—email consent does not suffice.
• Document consent with timestamp, method, disclosure text, and IP address for audit readiness.
• Include bilingual opt-out mechanisms (STOP/ARRET) and act on requests immediately and permanently.
• Restrict promotional SMS to 9am–9pm local time and avoid SHAFT content without proper gating.
• Regularly purge expired or revoked consent, especially for implied consent with fixed expiration periods.

Express vs. Implied Consent: The Channel-Specific Trap

Businesses often assume that consent collected for email or phone inquiries automatically covers SMS marketing—a dangerous misconception under Canada’s anti-spam laws. CASL treats consent as strictly channel- and purpose-specific, meaning approval for one communication method does not extend to another, even if the recipient has an existing relationship with your brand. This distinction is especially critical for SMS, where implied consent frequently fails to meet legal thresholds.

Express consent is mandatory for SMS marketing under CASL because implied consent—whether derived from a purchase, service agreement, or general inquiry—is generally insufficient for text messaging due to its intrusive nature and higher spam complaint rates. As noted by Klaviyo, the complexity and risks associated with implicit consent lead them to explicitly require express consent for all SMS/MMS sends, aligning with guidance that consent must be specific, unambiguous, and not assumed from prior interactions. This is reinforced by Insider One, which emphasizes that CASL demands express or narrowly defined implied consent, with the latter being particularly inadequate for SMS campaigns.

Implied consent based on an existing business relationship—such as a completed purchase or contract—expires 24 months after the transaction date, while inquiry-based implied consent (e.g., from a form submission or phone inquiry) lapses after just six months. These short windows mean that even if a customer recently engaged with your business via email or phone, their implied consent for SMS may already be invalid, especially if more than half a year has passed since an inquiry or two years since a purchase. Maintaining accurate records of when and how consent was obtained is therefore essential to avoid sending messages to individuals whose implied consent has lapsed.

To remain compliant, businesses must implement separate, documented consent processes for each channel and purpose combination. For example, consent to receive promotional emails does not authorize SMS marketing, and approval for order updates via text does not extend to promotional offers. As Klaviyo states, consent for one type of commercial electronic message does not permit messaging via another channel—each purpose/channel pairing requires its own clear, timestamped record. GrowthPros ensures every lead includes a detailed consent trail capturing disclosure text, timestamp, IP address, and the named contacting party, helping clients avoid the channel-specific trap that leads to costly CASL violations. By treating SMS consent as distinct and time-bound, organizations can build audit-ready practices that respect both the law and consumer preferences.

Operational Compliance: Bilingual Opt-Outs, Quiet Hours, and Identification

Operational compliance turns SMS marketing from a legal gray area into a predictable, enforceable process under Canada’s Anti-Spam Legislation (CASL). Every message must meet specific mechanical requirements to avoid penalties that can reach $10 million per violation for businesses. These rules aren’t suggestions—they’re the baseline for lawful outreach, especially when sending time-sensitive follow-ups through channels like AI-driven SMS sequences.

At the core of compliance is bilingual opt-out support: every commercial electronic message must recognize both English “STOP” and French “ARRET” commands, along with corresponding help requests like “HELP” and “AIDE”. This isn’t optional—it’s a carrier-level expectation reinforced by telecommunications providers and regulatory bodies. Opt-out requests must be processed immediately and permanently across all channels, meaning a recipient who texts “ARRET” should never receive another promotional SMS from your business, regardless of how the consent was originally obtained.

Timing restrictions further shape how and when messages can be sent. Promotional texts are limited to 9 a.m. to 9 p.m. local time in the recipient’s zone—a stricter window than the U.S. standard of 8 a.m. to 9 p.m. Sending outside this range, even by a minute, risks non-compliance. Every message must also include clear sender identification and a valid physical mailing address that remains accessible for at least 60 days after transmission. This address allows regulators or recipients to verify your business’s legitimacy, a detail often overlooked in automated follow-up systems.

Content boundaries are equally critical. CASL enforces SHAFT restrictions—prohibiting unsolicited messages involving sex, hate, alcohol, firearms, or tobacco without prior approvals or age-gating mechanisms. While transactional messages (e.g., appointment confirmations) are exempt from consent rules, they still require identification and unsubscribe details. For businesses using AI to accelerate lead engagement, this means embedding compliance logic directly into follow-up workflows: consent records must accompany each lead, opt-outs must trigger instant suppression, and message templates must auto-validate language, timing, and content before delivery.

• Support both “STOP” (English) and “ARRET” (French) opt-out keywords in all SMS campaigns
• Process unsubscribe requests immediately and permanently across SMS, voice, and email channels
• Restrict promotional sending to 9 a.m.–9 p.m. local time in the recipient’s time zone
• Include clear sender identification and a physical mailing address valid for 60+ days
• Avoid SHAFT-content unless approved or gated; transactional messages still need ID/unsubscribe info

For companies like GrowthPros, which delivers leads with AI-powered voice, SMS, and email follow-up within five minutes, these operational rules aren’t hurdles—they’re built into the system. Consent records travel with each lead, ensuring that every automated touchpoint respects bilingual opt-outs, quiet hours, and sender transparency. Compliance isn’t separate from speed; it’s the foundation that makes rapid, lawful engagement possible. When a lead is re-engaged from a dormant list or sourced fresh, the same mechanical safeguards apply: messages send only within legal windows, opt-outs are honored instantly, and every SMS carries the identification and language support required by CASL. This alignment between process and regulation turns regulatory adherence into a competitive advantage—especially in niches where timing and trust determine conversion.

Transactional vs. Promotional: Where Consent Exemptions Apply

Not every text message your business sends is "marketing" in the eyes of Canadian law — and that distinction can save you from needing consent, but only if you get it exactly right.

Under CASL, purely transactional messages — order confirmations, delivery updates, appointment reminders that confirm a purchase, subscription, or delivery — are exempt from the consent requirement. But according to Klaviyo's compliance guidance, that exemption applies only when the message contains zero advertising or promotional content. The moment you tack on a discount code, a cross-sell, or a "check out our new arrivals" line, the message becomes a commercial electronic message and the full consent framework applies.

Even a purely transactional text isn't a compliance-free zone. The same platform guidance confirms these messages still require clear sender identification and an unsubscribe mechanism in every message. And StarTelecom's regulatory breakdown notes that opt-out commands must be acted on immediately — with bilingual support for both English ("STOP") and French ("ARRET") keywords.

The stakes of getting this wrong are substantial. CASL penalties reach $10 million per violation for businesses (and $1 million for individuals), and Canadians filed more than 167,939 complaints to the Spam Reporting Centre in a single six-month reporting period — over 6,400 per week.

To keep your transactional texts safely inside the exemption:

• Strip out all promotional content — no offers, upsells, or brand plugs, even "helpful" ones.
• Include sender identification and a working unsubscribe mechanism in every message.
• Remember that consent is channel-specific: consent for SMS marketing is not consent for order updates, and vice versa — each purpose needs its own record.
• Keep audit-ready documentation of consent, since documenting consent with dates, sources, and expiration details is a legal requirement under CASL.

The most common mistake businesses make is blending the two categories — a delivery confirmation that ends with "P.S. 20% off your next order" is a promotional message in a transactional costume. When that happens, the consent exemption evaporates entirely, and if you don't have express consent on file, you're exposed to the same penalties as any unsolicited marketing text.

This is why disciplined operations separate the streams entirely. At GrowthPros, every lead we deliver carries its own consent record — disclosure text, timestamp, and the named contacting party — so transactional follow-up and promotional outreach never blur together on shaky consent. If you're mixing message types on a dormant list, re-verify your consent trail before the first send, not after a complaint lands.

Building an Audit-Ready Consent Infrastructure

Most businesses treat consent as a checkbox. CASL treats it as an evidence trail. The legislation places the burden of proof squarely on the sender, meaning every commercial electronic message must be backed by records that would hold up under regulatory scrutiny. Between October 2021 and March 2022, Canadians submitted over 167,939 spam complaints — averaging more than 6,400 per week — signaling that enforcement attention on text messaging is only increasing.

An audit-ready consent infrastructure captures four non-negotiable elements at the moment of opt-in: the exact disclosure text presented to the consumer, a timestamp with timezone, the source IP address, and the named contacting party. Critically, consent is channel- and purpose-specific. Klaviyo notes that agreeing to receive email does not constitute consent for SMS, social media, or instant messages. Each purpose-channel combination requires its own record.

Implied consent carries hard expiration deadlines that many teams overlook. Inquiry-based implied consent expires after six months, while transaction-based implied consent expires after two years from purchase, service acceptance, or contract. Express consent remains valid until the recipient withdraws it. A compliant system automatically suppresses contacts the moment consent expires or is revoked — permanently and across SMS, voice, and email channels.

• Disclosure text, timestamp, IP address, and named contacting party captured at opt-in
• Channel-specific purpose tags (SMS marketing ≠ order updates ≠ email newsletters)
• Automated expiration tracking for implied consent (6-month and 24-month windows)
• Permanent cross-channel suppression the instant opt-out is received
• Records retained in a format regulators can audit without reconstruction

Documenting consent with dates, sources, and expiration details is a legal requirement under CASL, not a best practice. GrowthPros structures every lead — whether freshly sourced or reactivated from a dormant opted-in list — with its complete consent trail attached before delivery. That means when a lead lands in your CRM, the evidence needed to meet CASL's burden of proof arrives with it.