Why "They're On Our List" Isn't Consent Under CASL

A contact sitting in your CRM is not the same as a contact who agreed to hear from you. Under CASL, that distinction is the difference between a compliant campaign and a liability — and the regulator has been explicit about who has to prove it.

The CRTC, which enforces CASL, states plainly that the onus of proving consent always falls on the sender. A contact's presence in Shopify, HubSpot, Outlook, or a spreadsheet proves nothing on its own, as compliance analysts have pointed out. You need a documented basis for believing someone consented — a date, a method, and the exact wording they agreed to. The stakes are real: violations carry fines up to $1 million per violation, according to CASL enforcement breakdowns.

Many broad assumptions that feel reasonable in practice simply do not count. Silence, inaction, and website browsing are not consent. As one compliance guide puts it, the law assumes silence equals no consent.

The most common false assumptions include:

• Pre-checked boxes and default opt-ins — an affirmative, unchecked-box action is required for express consent (MailTester)
• Bundled opt-ins, like a newsletter signup tacked onto an ebook download (Email List Validation)
• Website browsing, page views, or public directory listings (Email List Validation)
• Purchased lists, unless clear, documented express consent exists for each contact (Email List Validation)

That last point matters most for calling campaigns. A bought list without permission records is not a gray area under CASL — and it is exactly why My AI Call Center flags, and in most cases declines, purchased lists during its pre-launch consent review rather than discovering the problem after the calls go out.

One further caution: nearly all CASL guidance is written for commercial electronic messages, not voice calls. No source directly addresses how CASL's framework maps to AI calling campaigns. The conservative approach is to apply the same consent standards by analogy — treat express consent as the only safe basis, honor opt-outs immediately (CASL's own floor is 10 business days, per CRTC guidance), and document everything. When in doubt, treat the contact as unconsented.

Express vs. Implied Consent: The Two-Tier Framework That Decides If You Can Call

Understanding the nuances of consent under Canada's Anti-Spam Legislation (CASL) is crucial for businesses like My AI Call Center, which specializes in managed outbound calling services. According to CRTC's official guidance, consent comes in two forms: express and implied. Express consent is an active, affirmative opt-in that does not expire unless withdrawn, requiring a clear action such as filling out a form, checking a box, or entering into a written agreement. This type of consent must be documented with the date, method, and exact wording of the agreement.

On the other hand, implied consent is inferred from a qualifying relationship and is strictly time-limited. It can last for 2 years from the date of a purchase or contract, or 6 months from an inquiry. For subscriptions, the implied consent period starts when the relationship ends. However, research indicates that messages sent under implied consent must be relevant to the original relationship, meaning that pitching unrelated products falls outside the scope of implied consent.

It's also important to note what does not constitute valid consent under CASL. Pre-ticked boxes, silence, bundled opt-ins, and website browsing do not meet the criteria for consent. Moreover, role accounts such as sales@ or info@ do not automatically imply consent; specific, documented agreement is required. As email validation experts point out, purchased lists are non-compliant unless clear, documented express consent exists, which aligns with My AI Call Center's policy of flagging or declining bought lists without clear permission records.

The burden of proving consent, whether express or implied, always falls on the sender. This means that businesses must have a reasonable basis for believing someone consents and must be able to provide proof of consent if required. CRTC guidance emphasizes the importance of documenting consent, including the date, method, and exact wording of the opt-in. This documentation is crucial for compliance, especially considering that violations of CASL can result in fines up to $1 million per violation.

For My AI Call Center's campaigns, understanding these consent rules is vital. Given that the company runs structured AI-powered calling campaigns against approved, permissioned, or reviewed contact lists, ensuring that each contact has either express or implied consent is key. This involves classifying each contact based on the type of consent they have provided and ensuring that messages, especially under implied consent, remain relevant to the original relationship. By adhering strictly to these guidelines and maintaining detailed records of consent, My AI Call Center can not only comply with CASL but also build trust with its clients by demonstrating a commitment to ethical and legal outreach practices.

In practice, this means that for every campaign list, My AI Call Center must verify the consent status of each contact, whether it's express or implied, and ensure that the messaging aligns with the original relationship for implied consent cases. The company's policy of only using approved, permissioned, or reviewed lists already reflects a commitment to consent verification, and by honoring opt-outs promptly and logging them, My AI Call Center exceeds the minimum requirements for compliance.

• Ensure express consent is documented with date, method, and exact wording.
• Verify implied consent based on the 2-year or 6-month windows and ensure message relevance.
• Maintain detailed records of consent for auditing purposes.

By following these steps and staying informed about CASL regulations, businesses can navigate the complex landscape of consent and ensure their outreach efforts are not only effective but also compliant with the law. As CASL compliance becomes increasingly important for businesses operating in Canada, understanding the difference between express and implied consent is foundational. Moreover, recognizing the time limits and restrictions on implied consent helps in planning targeted and legally sound marketing strategies. With fines for non-compliance reaching up to $1 million per violation, the stakes are high, making a deep understanding of CASL's consent provisions essential for any business engaging in electronic messaging or voice calls in Canada.

Why We Flag or Decline Bought Lists — And Why the Law Backs Us Up

When a client sends us a purchased list, our first question is simple: where did the permission come from? Under CASL, that question has a legal answer, and it usually decides whether the campaign can run at all.

Consent from a purchased list is not valid under CASL unless it was obtained with clear, documented express consent, according to compliance research. That single fact is why My AI Call Center flags bought lists and, in most cases, declines them before any campaign launches.

The CRTC puts the burden squarely on the sender: "The onus of proving consent, be it express or implied, is on the person who claims they have consent" (CRTC official guidance). A contact sitting in a CRM, a spreadsheet, or a vendor's database proves nothing. Presence is not permission.

It's also worth understanding what a validation tool can and cannot do. List-cleaning software checks whether an address is technically deliverable, but it cannot confirm whether that person ever opted in. As one industry source puts it, you can't "verify" consent with a tool. Consent is a paper trail, not a data point.

So what does an adequate consent record contain? At minimum, each entry should include:

• The contact's address or identifier
• The basis of consent — express or implied
• The date consent was captured
• The method used (form, checkbox, verbal agreement)
• The exact opt-in wording the contact saw

The CRTC recommends keeping records such as screenshots, confirmation emails, and transaction dates (CRTC). Verbal consent counts too, but only if it's documented: who agreed, when, and what was explained (Typewire). This is why "approved, permissioned, reviewed" is a legal requirement at My AI Call Center, not a marketing preference.

One practical warning deserves its own paragraph. Our Win-Back and Database Reactivation campaigns typically target contacts who went dormant 12 to 24 months ago. Implied consent from a purchase or contract lasts only two years from the transaction, and inquiries expire after six months (Typewire; CRTC). A dormant contact near or past that two-year window may have no valid consent left at all.

The stakes are real: CASL violations can carry fines up to $1 million per violation (Email List Validation). We would rather tell you plainly that a list will not support the campaign — before you spend anything — than have you learn the law's answer afterward.

The Consent Verification Checklist We Run Before Any Campaign Launches

To ensure compliance with Canada's Anti-Spam Legislation (CASL), My AI Call Center implements a rigorous consent verification process for all campaigns. This process is crucial because, under CASL, consent to receive commercial electronic messages (CEMs) comes in two forms: express consent and implied consent. The CRTC's official guidance confirms that the burden of proving consent, whether express or implied, always falls on the sender.

Before launching any campaign, we classify every contact as either express or implied consent. Express consent requires a clear, affirmative action, such as an unchecked checkbox or form submission, and must be documented with the date, method, and exact wording. Implied consent, on the other hand, is inferred from a qualifying relationship and is strictly time-limited, with windows of 2 years for purchases or contracts and 6 months for inquiries.

We treat every implied-consent contact as a dated record with a review date, checking them against their respective time windows. For instance, if a contact's implied consent is based on a purchase, we ensure that the consent is valid for 2 years from the transaction date. If the consent is based on an inquiry, we verify that it is within the 6-month window. We also request express consent before implied consent expires and stop messaging once it lapses, ensuring that we always have valid consent to send CEMs.

Our process includes honoring opt-outs within 10 business days, as required by CASL, and logging them immediately. In fact, My AI Call Center logs and honors opt-outs immediately, exceeding the required deadline. This not only ensures compliance but also respects the recipient's choice, which is a core principle of CASL.

In terms of statistics, up to $1 million per violation can be fined for non-compliance with CASL. Moreover, implied consent windows are strict, with 2 years for purchases/contracts and 6 months for inquiries. Understanding these nuances is crucial for businesses to avoid violations and ensure they are sending CEMs legally.

Some key steps in our consent verification checklist include:

• Classifying each contact as express or implied consent before campaign launch
• Checking implied-consent contacts against their 2-year or 6-month windows
• Requesting express consent before implied consent lapses
• Honoring opt-outs within 10 business days and logging them immediately

By following these steps and adhering to CASL guidelines, My AI Call Center ensures that all campaigns are compliant and respectful of recipients' consent. Express consent and implied consent are treated with the seriousness they deserve, and our processes are designed to protect both our clients and their recipients from potential violations. It's also important for clients to obtain appropriate legal guidance before launching campaigns, as requirements can vary significantly by location, industry, contact type, consent status, and technology.

CASL vs. TCPA: One Consent Standard Won't Cover Both Countries

A consent record that satisfies Canadian regulators may not survive contact with U.S. law — and for campaigns running on both sides of the border, that gap carries real financial risk. The two countries share a core principle, but they enforce it through different frameworks with different penalties.

Under U.S. law, the FCC's February 2024 Declaratory Ruling treats AI-generated voices as "artificial or prerecorded" voices under the Telephone Consumer Protection Act (TCPA), requiring prior express consent before any call can connect. That ruling, detailed in the FCC's 2024 AI-voice ruling, applies directly to AI-assisted calling campaigns. Enforcement is already active: the FCC proposed a $2 million forfeiture against Lingo Telecom for 3,978 spoofed AI-voice robocalls.

Marketing calls to residential lines go further, demanding prior express written consent that names the caller and the number. The federal calling window runs 8 a.m. to 9 p.m. in the recipient's local time — not the caller's — but state-level quiet hours routinely tighten that floor. Florida, Oklahoma, and Maryland impose an 8 p.m. cutoff and cap calls at three per 24 hours per number.

The penalties escalate quickly: TCPA statutory damages run $500 to $1,500 per call, Texas allows up to $5,000 per violation, and Georgia has no damage caps at all. With 2,588 TCPA suits filed in 2025, U.S. exposure is not hypothetical. The compliance picture for a cross-border campaign looks like this:

• CASL: express consent never expires unless withdrawn; implied consent lasts 2 years after a purchase or 6 months after an inquiry.
• TCPA: prior express consent for AI voices, with prior express written consent required for marketing calls.
• State overlays: stricter windows and frequency caps always win over the federal floor.

That is why My AI Call Center's Halifax and Austin operations treat consent records as the backbone of every campaign. In both countries, the sender bears the burden of proof — and regulators expect the operator to produce the consent record on demand. A list that clears CASL's implied-consent windows may still fail TCPA's express-consent requirement, and vice versa. One consent standard won't cover both countries; the records have to satisfy both regimes before a single call launches.