The Problem: Two Rulebooks, and US Compliance Doesn't Cover Canada

The Problem: Two Rulebooks, and US Compliance Doesn't Cover Canada

Operating outbound calling campaigns in Canada requires navigating a dual-regulatory system that many US-based businesses overlook. While the TCPA governs telemarketing in the United States, Canada separates its rules: CASL applies to electronic messages like email and SMS, while the CRTC's Unsolicited Telecommunications Rules (UTR) govern voice calls, including those using AI-generated voices. This split means a compliance program built solely around US TCPA standards leaves critical gaps, as CASL’s consent requirements are stricter and UTR calling-hour and DNCL rules differ significantly from US frameworks.

For voice campaigns under UTR, businesses must adhere to strict time windows—weekdays 9:00 a.m.–9:30 p.m. and weekends 10:00 a.m.–6:00 p.m. in the recipient’s local time—and maintain current National Do Not Call List subscriptions updated no more than every 31 days. Internal opt-out requests must be honored within 14 days, with numbers retained for three years and 14 days. These requirements contrast with TCPA provisions, creating exposure for companies relying on US-only compliance. As industry experts note, assuming US TCPA coverage suffices in Canada ignores these distinct obligations.

Penalty structures further amplify the risk. CASL violations can trigger fines up to $10 million for a first offense and $15 million for subsequent offenses, alongside a private right of action allowing individuals to sue for damages. Under UTR, corporations face penalties of up to $15,000 per call, while individuals may be fined up to $1,500 per violation. Enforcement actions routinely target both individuals and service providers for failures like missing identification or expired DNCL use, with settlements often including mandatory compliance programs and compounded interest on unpaid penalties. For businesses like My AI Call Center managing outbound campaigns across borders, recognizing this split regulatory landscape isn’t just advisable—it’s essential to avoid severe financial and operational exposure.

The Rules That Actually Apply: Consent, Calling Hours, and the National DNCL

Canadian telemarketing rules are refreshingly specific — once you know them, compliance becomes a checklist, not a guessing game. The catch is that the checklist has hard deadlines attached, and missing them carries penalties of up to $15,000 per call for corporations under the Unsolicited Telecommunications Rules.

Consent comes in two forms, and the details matter. Express consent requires positive action — the recipient must actually check an unchecked box. Pre-checked boxes and silence don't count, and the burden of proving consent sits with the sender. Implied consent, meanwhile, runs on a clock: it lasts 2 years after a purchase or lease and just 6 months after an inquiry or application, according to compliance guidance on Canadian calling rules.

Calling hours are equally firm. Calls are permitted weekdays from 9:00 a.m. to 9:30 p.m. and weekends from 10:00 a.m. to 6:00 p.m. — always in the recipient's local time, not the caller's. A campaign dialed from Austin, Texas into Halifax needs to respect Nova Scotia hours, which is why managed calling services like My AI Call Center build approved calling windows into every campaign before launch rather than leaving timing to individual agents.

The National Do Not Call List adds its own layer of obligations:

• Telemarketers must register with the National DNCL before making unsolicited calls — even exempt ones — and subscribe for every area code they dial.
• The DNCL version used must be no more than 31 days old, meaning lists need regular refreshing, not one-time scrubbing.
• Internal do-not-call requests must be honored within 14 days and retained for 3 years and 14 days.
• Contact details given during a call — mailing address, callback number — must stay valid for at least 60 days afterward.

That 14-day window is itself a compliance milestone: the CRTC tightened the deadline from 31 days in 2014, a move legal analysts read as the regulator choosing consumer protection over industry convenience. The same decision rejected most other proposed relaxations, including a long-standing request to broaden robocall use even where a business relationship exists.

Enforcement is not theoretical. The CRTC has pursued penalties against both individuals and service providers for violations as basic as failing to identify the call originator or provide a callback number. For any organization running structured outbound campaigns, consent records, current DNCL subscriptions, and honored opt-out logs aren't paperwork — they're the difference between a compliant campaign and a five-figure penalty.

The AI Voice Question: Where the Rules Are Heading

The CRTC has long signaled that consumer protection outweighs industry convenience. In 2014, the regulator rejected most proposed revisions to the Unsolicited Telecommunications Rules, notably declining to expand robocall permissions even for businesses with existing customer relationships according to Stikeman Elliott LLP. That restrictive posture persists today as the CRTC modernizes its framework for AI-generated voices and outcome-based regulation.

Current reviews focus on three interconnected shifts. First, expanding the definition of automated calling systems to cover AI-generated voices so they face the same disclosure and consent rules as traditional ADADs. Second, requiring upfront machine disclosure on every call — recipients should know immediately when they are speaking to an artificial voice. Third, moving from mechanism-based rules to outcome-based rules that ask whether a call was unwanted, lacked meaningful consent, or had no accountable party as M3AAWG has recommended to the CRTC.

This direction matters because caller ID authentication alone does not solve the trust problem. STIR/SHAKEN verifies where a call originated, not whether the call is honest or wanted M3AAWG emphasizes. Regulators are also weighing whether consent should attach to individuals rather than phone numbers, addressing reassignment risks through a database model similar to the U.S. FCC approach.

• AI voices treated as automated calls requiring prior express consent
• Mandatory upfront disclosure when a machine is calling
• Outcome-based rules focused on unwanted calls, not hardware definitions
• Consent tied to people, not phone numbers, to handle reassignment

For organizations running outbound campaigns, the compliance baseline is rising. My AI Call Center builds every campaign around approved, permissioned, or reviewed lists with consent records checked before launch, and we embed AI disclosure and opt-out handling into every script. The regulatory trajectory is clear: transparency, accountability, and individual consent will define what is permissible.

What This Means in Practice: Building a Canada-Ready Campaign

Knowing the rules is one thing. Running a campaign that survives them is another — and the difference usually comes down to list discipline before the first call ever goes out.

The cheapest compliance tool you own is the list itself. A bought list with no permission records is not a bargain; it is a liability with a per-call price tag attached. Under Canada's Unsolicited Telecommunications Rules, corporations face penalties of up to $15,000 per call for violations, and the CRTC has pursued settlements that include mandatory compliance programs, compliance officers, and interest on unpaid penalties at the average bank rate plus 3% compounded monthly (per this compliance analysis; CRTC enforcement release). That is why My AI Call Center checks list source and consent records before any campaign launches — and declines bought lists without clear permission records in most cases.

A Canada-ready campaign should follow a short, non-negotiable checklist:

• Verify list source and consent records before launch — express consent must come from positive action, and implied consent runs only 2 years after a purchase or 6 months after an inquiry.
• Call only in approved windows: weekdays 9:00 a.m.–9:30 p.m. and weekends 10:00 a.m.–6:00 p.m. in the recipient's local time.
• Log and honor opt-outs immediately, and route DNC requests into permanent records — the CRTC requires internal DNC additions within 14 days, with numbers retained for 3 years and 14 days.
• Disclose AI on every call, and maintain valid callback details (mailing address, callback number) for at least 60 days after the call, as Stikeman Elliott's analysis of CRTC rules confirms.

Two habits matter more than everything else. First, treat AI-generated voices as artificial voices and disclose them upfront — current CRTC reviews specifically address expanding automated-calling definitions to cover AI voices and requiring disclosure when calls come from machines (M3AAWG's submission to the CRTC). Second, keep your records: consent proof, opt-out logs, and DNCL versions no more than 31 days old.

One caution applies regardless of process: campaign requirements vary by location, industry, contact type, and consent status, and no service provider can substitute for legal advice. Obtain appropriate legal guidance before launch — a review that costs a few hours is far cheaper than a penalty measured in millions.