Casl consent rules for social lead generation in Canada, explained

What to take away

• CASL social lead generation starts with consent: express consent never expires, while implied consent runs on a 24 month or 6 month clock depending on how you got it.
• The CRTC enforces CASL, and it counts DMs, comment-to-DM replies and follow-up email as commercial electronic messages.
• Social contests need clear rules and consent language, and the Competition Bureau reviews the claims you make about prizes and odds.
• Every message needs sender identification and a working unsubscribe mechanism that stays live for at least 60 days.
• Keep consent records that show who opted in, when, how, and what they were told, because the CRTC and the Office of the Privacy Commissioner can ask.

Why CASL consent is the first gate for Canadian social lead generation

CASL social lead generation fails or succeeds on one question: can you show consent for each commercial electronic message you send? Canada's anti-spam law applies to messages sent from social platforms, not just email.

A comment-to-DM reply that pitches a product is a commercial electronic message. So is a follow-up email after a contest entry. The law does not care which app you used.

Start by deciding what counts as a qualified lead before picking a channel. That step keeps your consent request tied to a real offer, not a vague newsletter signup. It also makes the consent language easier to write, because you know what the person is agreeing to receive. See qualified lead before picking a channel.

Consent has to be tied to a purpose. A person who enters a contest to win a kayak has not agreed to a year of sales emails. If you want to send those, ask at entry and record the answer separately.

ISED's guidance on protecting your business and complying sets out the consent and identification basics for commercial electronic messages. Read Protect your business and comply before you write your next DM script.

CASL also reaches messages sent to a single recipient, so a one-to-one DM is not exempt. The law has limited exceptions, such as messages to people with whom you have a personal or family relationship, and messages that respond to a direct inquiry. Those exceptions are narrow. Do not build a funnel on them.

Your platform choice matters less than your record. A DM, an email and a text are all commercial electronic messages under the same rules. If your funnel moves a lead from Instagram to email, the consent you collected on Instagram has to cover the email. Write the consent request so it names the channels you will use.

Express consent versus implied consent: the two windows that matter

CASL express consent is a clear, positive agreement to receive commercial electronic messages. It does not expire because of time. It lasts until the person withdraws it. You can collect it through a checkbox on a landing page, a reply to a DM where the person agrees, or a form that states what they will receive and from whom.

CASL implied consent is weaker and time limited. It arises from an existing business relationship or a conspicuous publication of your business address, among other routes. The two windows that matter for social funnels are 24 months and 6 months.

The 24 month window applies to an existing business relationship. If someone bought something from you, or entered a contract with you, you generally have 24 months from the last transaction to send commercial electronic messages. The clock resets with a new purchase or contract, not with a new email.

The 6 month window applies to an inquiry. If someone asked about your product or service, you generally have 6 months from the date of that inquiry. A contest entry is not automatically an inquiry. A question about pricing can be. Record the date and the question.

A third route is conspicuous publication. If you publish your business address and state that you welcome inquiries, you may have implied consent for messages relevant to your role or business. The message must be relevant to the person's role. A generic blast does not qualify.

Express consent is the safer base. Ask for it at the point of capture, state the purpose, and keep the proof. Implied consent is a bridge, not a foundation. If your list is mostly implied, plan a re-permission campaign before the window closes.

Consent type	How it arises	How long it lasts	What to record
Express	Clear positive agreement, such as a checked box or a written reply	Until withdrawn	Date, source, exact wording shown
Implied, business relationship	Purchase, contract or other existing business relationship	24 months from the last transaction	Transaction date and type
Implied, inquiry	A question about your product or service	6 months from the inquiry	Date, channel and question
Implied, conspicuous publication	Published business address plus a relevant role	No fixed period, relevance required	Where published and why relevant

How the CRTC treats DMs, comment-to-DM funnels and follow-up email

The CRTC is the enforcement body for CASL. It investigates complaints, can issue warnings, and can impose administrative monetary penalties. It has taken action against businesses that sent commercial electronic messages without consent or without a working unsubscribe mechanism.

The CRTC treats a DM as a commercial electronic message when it encourages participation in a commercial activity. A comment-to-DM funnel that replies to a comment with a sales pitch falls in that category. So does an automated DM that sends a discount code.

Three requirements apply to every such message. First, sender identification: the message must identify the person or business sending it, and give a mailing address. Second, unsubscribe: the message must include a clear and working unsubscribe mechanism. Third, consent: you need express or implied consent, and you must be able to prove it.

The unsubscribe mechanism has to be set out clearly and must work for at least 60 days after the message is sent. The request must be honoured within 10 business days, without a fee and without requiring the person to log in.

A link to a page that asks for an email address and a password is not good enough.

Follow-up email after a contest is where many funnels slip. If the entrant did not agree to marketing messages, the follow-up is a commercial electronic message without consent. Add a separate, unchecked consent box at entry, and keep the follow-up separate from the contest confirmation.

DM consent in Canada also raises platform limits. Some platforms restrict automated DMs. Even where automation is allowed, CASL still applies. Keep the message short, identify yourself, and include a way to opt out.

If the platform will not let you include a mailing address in the DM, send the first message as a reply that points to a page with the full identification and unsubscribe details.

The CRTC's jurisdiction over certain online and broadcast advertising sits alongside the Broadcasting Act, which frames that side of the regulator's work. CASL and PIPEDA are federal statutes, so read the current consolidated text before you set a consent policy and cite it in your records.

Social contests under CASL: entry mechanics, contest rules and consent language

A social contest is a lead generation channel, and it brings two rulebooks into play. CASL governs the messages you send. The Competition Bureau governs the claims you make. Get the entry mechanics right and both become easier.

Entry mechanics decide what consent you have. If entry requires a comment, you have a public record of the entry but not consent to market. If entry requires a form with a consent checkbox, you can collect express consent. If entry is automatic for anyone who follows you, you have no consent at all.

Use a two-part form. The first part collects the entry. The second part asks, with an unchecked box, whether the person agrees to receive marketing messages. State the sender name and the channels. Do not bundle the two.

Contest rules should state the sponsor, the eligibility rules and the start and end dates. They should also state the prize description and value, the odds statement, and how winners are selected. If the contest is a game of chance, a skill-testing question is generally required. The rules should also state how you will use entrant data.

Consent language should be plain. A sentence such as "Yes, I agree to receive marketing emails and DMs from [business name] about [product category]" is clearer than a link to a privacy policy. The person must be able to understand what they are agreeing to without opening another page.

CRTC social media contest rules are not a separate rulebook. The CRTC applies CASL to the messages you send around the contest. That includes the winner announcement if it promotes your business, and any follow-up offer. The contest itself is not a commercial electronic message, but the messages around it are.

If you run contests often, build a reusable consent block and a reusable rules template. Test both with a colleague who is not in marketing. If they cannot say what they are agreeing to after one read, rewrite it. For a fuller walkthrough, see how to run a social media giveaway legally.

What the Competition Bureau expects from contest and lead-generation claims

The Competition Bureau Canada enforces the Competition Act, including the deceptive marketing provisions. It looks at what you claim, not what you intended. A prize claim that overstates the value, or a lead-generation ad that hides a cost, can draw attention.

For contests, the Bureau expects clear disclosure of the prize, its value, the odds and any conditions. If you say "win a trip," state where to and what is included. If the number of prizes is limited, say so. If a purchase improves your odds, say that too.

The Bureau also reviews performance claims. If your social ad says a product produces a result, you need adequate and proper testing to support it. That applies to lead magnets as much as to products. A guide that promises a specific outcome needs evidence for that outcome.

Lead-generation claims about price need care. A "free" offer that requires a paid subscription is a problem. So is a discount that applies only to a narrow set of products. State the conditions close to the claim, not in a footnote.

The Office of Consumer Affairs publishes guidance on consumer protection and online advertising, including contest claims. See the Office of Consumer Affairs for the consumer-facing view of what advertisers must disclose.

Quebec adds a layer. Bill 96 and the Charter of the French Language require French-language versions of certain commercial documents and advertisements in Quebec. If your contest reaches Quebec entrants, plan for French rules, forms and consent language. The Office québécois de la langue française publishes the requirements.

Advertising Standards Canada handles complaints under the Canadian Code of Advertising Standards, which covers truth in advertising. It is not a regulator, but a complaint can damage trust and invite regulatory attention. Keep your claims accurate and your conditions visible.

Building a consent record that survives a CRTC or OPC review

A consent record is the difference between a complaint that ends in a warning and one that ends in a penalty. The CRTC can ask you to show consent. The Office of the Privacy Commissioner of Canada can ask how you collected and used personal information under PIPEDA. One record can serve both.

Record these fields for every consent: the date and time, the source, the exact wording shown, the channels covered, and the sender name. Add the IP address or platform identifier where you have one. Add the withdrawal date when someone opts out.

Keep the record for as long as you rely on the consent, and for a reasonable period after. If you rely on implied consent, keep the evidence of the transaction or inquiry that created it. If the window closes, stop sending until you have fresh consent.

Separate consent from the rest of your CRM data. A consent record should not be editable by the sales team. Use a log that records changes rather than overwriting them. If a person withdraws consent, keep the withdrawal record even if you delete the marketing profile.

Run a re-permission campaign before implied consent windows close. A short email that asks people to confirm they still want to hear from you can convert implied consent into express consent. Do not send it to people whose consent has already expired.

Privacy law adds a purpose limitation. Collect only what you need for the stated purpose. Cutting unused form fields reduces the personal information you hold and the consent you have to manage. That habit also lowers your breach exposure under PIPEDA. See social media contest rules us for the practical version.

Document your process, not just your data. A one-page consent policy that states what you collect, why, how long you keep it and how someone withdraws is easier to defend than a folder of screenshots. Review it when you add a channel or a new contest.

CASL social lead generation checklist for Canadian teams

Use this checklist before you launch or refresh a social lead funnel. It covers the consent, identification and unsubscribe rules that apply to commercial electronic messages in Canada.

• Every capture point states the sender name and the channels the person will hear from.
• Consent is collected with an unchecked box or a clear written reply, never a pre-checked box.
• The consent wording names the purpose, not just "updates".
• Implied consent sources are logged with the date and the transaction or inquiry that created them.
• A 24 month or 6 month expiry date is set on every implied consent record.
• Every message includes sender identification and a mailing address.
• Every message includes a working unsubscribe mechanism that stays live for at least 60 days.
• Unsubscribe requests are honoured within 10 business days, with no fee and no login.
• Contest rules state the sponsor, prize, value, odds and end date.
• Contest entry consent is separate from the entry itself.
• Quebec entrants receive French-language rules and consent language.
• Performance and price claims have evidence and visible conditions.
• Consent records are stored in a log that cannot be overwritten.
• A re-permission campaign runs before implied consent windows close.
• The team reviews the consent policy when a new channel or contest is added.

Then run the launch steps in order.

1. Define the lead and the offer, and write the consent wording before you build the form.
2. Set up the consent log with the fields you need: date, source, wording and channels. Add the sender name and the withdrawal date.
3. Build the capture point with an unchecked consent box and a link to the full identification and unsubscribe details.
4. Test the unsubscribe mechanism from a real inbox and a real social account, and time how long it takes to process.
5. Launch, then review the consent log weekly for the first month and monthly after that.
6. Before any contest, have the rules, the consent language and the French version reviewed.

Once the funnel is live, the work shifts to upkeep. New channels bring new consent questions. New contest formats bring new disclosure questions. A short review before each launch is cheaper than a complaint after it. If you want the questions other teams raise, see what social media accessibility requirements us state.

For the wider process, the social media strategy covers the steps from first line to sign-off.

Common questions

Do I need consent to send a DM on Instagram or LinkedIn? Yes, if the DM encourages participation in a commercial activity. CASL applies to commercial electronic messages sent through social platforms. You need express or implied consent, sender identification and a working unsubscribe mechanism.

How long does implied consent last under CASL? It depends on the source. An existing business relationship generally gives 24 months from the last transaction. An inquiry generally gives 6 months from the date of the inquiry. Express consent does not expire until it is withdrawn.

Can I add contest entrants to my email list? Only if they agreed. Entry alone is not consent to receive marketing messages. Add a separate, unchecked consent box at entry, and keep the contest confirmation separate from any marketing follow-up.

Who enforces CASL in Canada? The CRTC is the main enforcement body for CASL. The Office of the Privacy Commissioner of Canada handles privacy issues under PIPEDA, and the Competition Bureau Canada handles deceptive marketing claims under the Competition Act.

What has to be in every commercial electronic message? Sender identification, a mailing address, and a clear unsubscribe mechanism that works for at least 60 days. Unsubscribe requests must be honoured within 10 business days, without a fee or a login requirement.

Does Quebec change anything for social contests? Yes. French-language requirements under the Charter of the French Language apply to certain commercial documents and advertisements in Quebec. Plan French rules, forms and consent language if your contest reaches Quebec entrants.