The Legal Tightrope of Canadian SMS Marketing

Texting a customer in Canada without documented permission isn't a minor slip — it's a federal compliance risk that can cost your business millions. SMS marketing is legal under Canada's Anti-Spam Legislation (CASL), but the law leaves almost no room for sloppy consent practices.

The stakes are unusually high. Under CASL, penalties can reach $10 million per violation for corporations and $1 million for individuals, according to compliance guidance for Canadian businesses. This isn't theoretical: the CRTC fined Hudson's Bay Company $120,000 in 2024 for sending promotional texts without proper consent documentation, as reported in the same industry analysis.

Consent is where most businesses stumble. CASL recognizes two types: express consent, obtained through an explicit opt-in action, and implied consent, which expires after 2 years for existing customers and just 6 months for prospects. A contact list that was clean eighteen months ago may now be a liability — which is why services like My AI Call Center review list sources and consent records before any campaign launches, and decline bought lists lacking clear permission trails.

The risks extend beyond regulators. Even a CASL-compliant campaign can fail at the carrier level:

• Messages sent outside the industry-standard 9am–9pm local time window face higher complaint rates and carrier filtering, per carrier compliance guidance.
• SHAFT categories — tobacco/vaping, alcohol, firearms, and cannabis — face heightened scrutiny, filtering, and outright blocking.
• Alcohol promotions require age verification (18+ or 19+ depending on province), while tobacco/vaping ads risk violating federal law even with valid CASL consent.

Regulators also expect documentation, not just good intentions. The CRTC's official guidance expects businesses to retain consent records, and practical compliance resources recommend keeping records for three years and honoring STOP (and French ARRET) opt-outs immediately.

The framework rewards businesses that treat consent as a process rather than a checkbox. As one compliance expert puts it, CASL is rigorous but navigable — provided your consent records, opt-out handling, and sending practices can withstand scrutiny. Businesses that verify consent before launch, like My AI Call Center does with every reviewed list, spend far less time worrying about that scrutiny than those that don't.

Building a Consent-First SMS Strategy

Building a consent-first SMS strategy is crucial for businesses operating in Canada, as the Canadian Anti-Spam Legislation (CASL) governs all commercial electronic messages, including SMS. According to industry research, express consent is required for most SMS campaigns, with implied consent limited to 2 years for customers or 6 months for prospects.

To implement express consent protocols, businesses must obtain explicit opt-in actions from recipients, such as keyword texting. This ensures that recipients have given their explicit consent to receive SMS messages. CASL guidelines emphasize the importance of consent, and businesses that fail to comply can face penalties of up to $10 million for corporations and $1 million for individuals.

Managing implied consent timelines is also critical, as implied consent expires after a specified period. Businesses must ensure that they have obtained express consent from recipients before the implied consent period ends. Compliance experts recommend implementing robust opt-out mechanisms, such as honoring "STOP" commands, to avoid carrier filtering and complaints.

To maintain campaign effectiveness while avoiding fines, businesses can leverage compliant platforms that offer features such as SHAFT category checks and audit trails. These platforms help businesses navigate the complexities of CASL and ensure that their SMS campaigns are compliant. Some key features of compliant platforms include:

• Built-in consent management systems
• SHAFT category checks to identify restricted content
• Audit trails to track consent and message history

By using compliant platforms and implementing express consent protocols, businesses can minimize the risk of non-compliance and ensure that their SMS campaigns are effective. My AI Call Center, a managed outbound calling service, understands the importance of compliance and list discipline, and can help businesses navigate the complexities of CASL. With express consent and compliant platforms, businesses can build trust with their recipients and avoid costly penalties. According to recent studies, businesses that prioritize consent and compliance can see significant improvements in their SMS campaign effectiveness, with some studies showing an increase in engagement rates of up to 25%. By prioritizing compliance and consent, businesses can build strong relationships with their recipients and achieve their marketing goals.

Putting Compliance into Practice

Compliance with CASL is not a one-time checkbox — it is an operating discipline that touches every campaign you send. The good news: the framework is clear, and businesses that build verification into their workflow scale confidently while those that guess risk penalties reaching $10 million per violation for corporations.

Start with your list. Before any campaign, verify the source of every contact and confirm you can document consent. Express consent — an explicit opt-in like a keyword text — is the strongest foundation, while implied consent from an existing business relationship expires after 2 years for customers and just 6 months for prospects. If you cannot show when and how permission was obtained, treat that contact as unsendable.

Next, check your consent records against the clock. A list that was compliant last year may not be today. Build a review cadence that flags expiring implied-consent contacts before they enter a campaign queue. This is standard practice for us at My AI Call Center: list source and consent records are reviewed before any campaign launches, and bought lists without clear permission records are flagged — and in most cases declined.

Then confirm carrier rules for your message category. Categories like tobacco/vaping, alcohol, cannabis, and firearms face heightened carrier scrutiny, filtering, and in some cases outright blocking, per industry compliance guidance. Alcohol campaigns also require age verification (18+ or 19+ depending on province). If you operate in one of these categories, work with platforms that offer built-in checks and age-gating.

Timing matters too. CASL does not mandate specific sending hours, but the industry standard is 9am–9pm local time — messages sent outside that window face higher complaint rates and greater risk of carrier blocking. Schedule sends accordingly, and honor STOP (and French ARRET) opt-outs immediately, maintaining functional unsubscribe systems for at least 60 days post-send.

Finally, integrate audit trails into daily operations:

• Log the date, source, and method of consent for every contact.
• Retain consent records for 3 years after a business relationship ends, in line with CRTC guidance.
• Document opt-outs and carry DNC requests across all campaigns and channels.
• Keep campaign records — scripts, disclosures, and send windows — aligned with CRTC requirements.

The cost of getting this wrong is real: the CRTC fined Hudson's Bay Company $120,000 in 2024 for sending promotional texts without proper consent documentation. But the cost of getting it right is mostly process. Whether you run SMS in-house or work with a managed partner, verify the list, respect the windows, log everything — and scale with confidence.