Canadian compliance
CASL compliance for website forms and newsletters
Canada's anti-spam legislation regulates the message and the proof behind it. On a WordPress site both start at the form. WP Doctor™ traces a subscriber from the checkbox to the mailing platform and documents what record exists.
Not legal advice. This page is technical information about how a WordPress site captures and stores consent for commercial email. It is not a legal opinion. For your own obligations, consult a lawyer.
[WPDOCTOR_LEGAL_REVIEW_COMPLIANCE]
What counts as a commercial electronic message
A commercial electronic message is an electronic message that, judged by its content, its links or its contact information, has as one of its purposes to encourage participation in a commercial activity. Offers, advertising and promotion are all covered. A message that asks for consent to send such messages is itself treated as one.
On WordPress the sources are wider than the newsletter: store follow-up and abandoned-cart emails, new-post notifications, and form autoresponders that carry a promotion.
Some messages need no consent, including one that solely provides a requested quote or confirms a transaction the recipient agreed to. They still need the identification and unsubscribe elements. The Act applies when a computer system in Canada is used to send or access the message, so a foreign mailing platform does not remove it.
Express vs implied consent and how long implied lasts
Express consent is given by a positive action in response to a clear request, and the Act sets no expiry for it. Implied consent comes mainly from an existing business relationship and is time-limited: two years from a purchase, lease or the end of a written contract, and six months from an inquiry or application.
A contact-form enquiry therefore supports six months of implied consent, counted back from the day each message is sent. Exporting old form entries into a newsletter list ignores that window. Implied consent means every address needs a date attached: last purchase or enquiry. Mailing platforms do not expire subscribers on their own.
The person who claims to have consent has the onus of proving it.
What your signup form must contain
A request for express consent must set out, clearly and simply, the purpose for which consent is sought, the name of the person seeking it and of anyone it is sought for, a mailing address with a phone number, email or web address, and a statement that consent can be withdrawn. The box cannot be pre-checked.
The CRTC's guidance is that a default state that assumes consent, such as a pre-checked box, cannot produce express consent. Express consent needs an opt-in action.
Three WordPress patterns miss these elements:
- a form builder's checkbox field with "checked by default" enabled;
- consent folded into "I agree to the terms and privacy policy" — the CRTC's guidance says a request for consent must not be "subsumed in, or bundled with" the terms of use or sale, and that an acceptable mechanism is an empty box, separate from the licence agreement, that has to be actively checked (Compliance and Enforcement Information Bulletin 2012-548, paras. 16 and 31);
- a footer field with an email input and a Subscribe button, and no sender identification or withdrawal statement.
The checkbox also needs a programmatic label, which is an accessibility requirement.
Identification and unsubscribe requirements
Every commercial electronic message must identify the sender and anyone on whose behalf it is sent, give a mailing address and one other contact method that remain valid for at least 60 days, and include an unsubscribe mechanism. An unsubscribe request must be given effect without delay, and within 10 business days at the latest.
The regulations add that this information must be set out clearly and prominently and that the unsubscribe mechanism must be able to be readily performed.
Mailing platforms usually add the footer. Messages WordPress sends itself often lack it: store follow-ups, membership and course notifications, promotional autoresponders. The second gap is synchronization. An unsubscribe recorded in the mailing platform does not stop a WordPress plugin that keeps its own list.
Consent records — the part you must be able to produce
Section 13 puts the onus of proving consent on the sender. Without a record, consent cannot be shown, whatever the form looked like on the day. A usable record holds the email address, the date and time, the form and page it came from, the consent wording displayed, and whether consent was express or implied.
That matches the CRTC's own example of acceptable written consent: a box checked on a web page "where a record of the date, time, purpose, and manner of that consent is stored in a database" (Bulletin 2012-548, paras. 26–27).
The maximum administrative penalty per violation is $1,000,000 for an individual and $10,000,000 for any other person. Due diligence is a defence.
The private right of action in sections 47 to 51 never came into force. The Justice Laws consolidation (current to September 2026, last amended 1 January 2026) shows sections 47 to 51 and 55 as repealed before coming into force. Enforcement stays with the CRTC, the Competition Bureau and the Privacy Commissioner.
On WordPress the common weakness is that the entry stores the checkbox value and not the label text. When the label is edited, earlier entries no longer show what was agreed to.
Form plugins and CRM integrations: where consent gets lost
Consent is usually lost in transit. The form captures a checkbox, but the integration that pushes the contact to the mailing platform or CRM sends only a name and an email address. The platform then holds a subscriber with no consent date, source or wording, and the WordPress entry that held them is later deleted.
The mechanisms are specific:
- an add-on that subscribes every submitter, because the checkbox was never set as the condition;
- an automation or webhook that passes a subset of fields;
- forms set to email-only, with entry storage off, leaving a mailbox as the only record;
- CSV imports that drop the source and date columns.
Retention pulls the other way. PIPEDA expects form data to be deleted when no longer needed. The workable rule is to keep the consent record for as long as the address is mailed and delete the rest of the entry on schedule.
Checklist
A CASL review of a WordPress site follows one subscriber from form to inbox and checks seven things, listed below. WP Doctor records each in a Health Report, with the form, the field mapping and a sample record. Whether the evidence would satisfy a regulator is a legal conclusion for counsel.
- Every consent checkbox is unchecked by default and separate from other agreements.
- Each consent request names the sender, gives contact details and states that consent can be withdrawn.
- Every commercial message sent by WordPress or the mailing platform carries identification and a working unsubscribe.
- Unsubscribes take effect in every system within 10 business days.
- Each subscriber record holds date, source and consent wording.
- Implied-consent addresses carry the date that starts the two-year or six-month window.
- Integrations pass the consent fields.
Other regimes are indexed on the compliance hub.
---
Every one of these is checked in a Health Report
A paid, fixed-scope diagnosis of your WordPress site — technical, performance, security and Canadian compliance — delivered as a written report you own.
Book a Health Report Back to the compliance hub