Email, SMS and CASL: what a Shopify store can send, and to whom

In Canada, Canada’s Anti-Spam Legislation (CASL) applies to commercial email and SMS. A Shopify store can message people who gave express consent, or recent customers under implied consent. Every message must identify the sender and offer a working unsubscribe, honoured within ten business days.

This article is for information only and is not legal advice. For your situation, consult a lawyer or the CRTC, which enforces CASL.

Email and SMS often earn more than advertising, because they speak to people who already know the brand. But you need the right to write to them. Our email and SMS flows on Klaviyo always start from that question.

Which messages are covered

CASL covers commercial electronic messages: those that invite people to buy, present an offer or promote a brand. Email and SMS are treated the same way.

Order-related messages, such as confirmations, shipping notices and invoices, don’t require consent. But if they slip in a promotion, they become commercial again.

The two kinds of consent

Consent	How it’s obtained	How long it lasts
Express	The person ticks an unticked box or signs up themselves, knowing what they’ll receive	Until they unsubscribe
Implied (purchase)	The person bought from you	Two years after the purchase
Implied (inquiry)	The person asked you a question or requested information	Six months after the inquiry

Implied consent expires. A good practice: use that window to invite the customer to subscribe, with express consent, to your newsletter.

What every message must include

• the name of the business sending it;
• a mailing address and a way to reach you, by email, phone or website;
• a simple way to unsubscribe that works and is honoured within ten business days at most.

For SMS, space is short: a link to your contact details and a working “STOP” reply do the job, depending on how your tool handles them.

The most common traps

The pre-ticked box. It doesn’t count as express consent.

The purchased list. Addresses obtained elsewhere never consented to your messages.

The email asking for consent. Writing to ask permission to write is already a commercial message.

Customers from three years ago. Their implied consent has expired.

The forgotten unsubscribe. A link that doesn’t work, or a request handled too late.

SMS in particular

A text is read within minutes. That’s its strength, and its risk. Keep it for moments that justify it: a shipment, a launch, a forgotten cart. SMS consent is collected separately from email consent, with the phone number.

Keep the proof

If there’s a complaint, the business has to prove consent. Klaviyo and Shopify keep the date, source and wording of the sign-up form: check that this information is being recorded.

FAQ

Can we email all our past customers? Only those who bought in the last two years, or who gave express consent.

Do we need separate consent for SMS? It’s good practice: customers choose email, SMS, or both.

What does a business risk? The CRTC can impose administrative penalties of up to 10 million dollars per violation for a business.

What about Quebec’s Law 25? It adds to CASL in Quebec: information collected, such as an email address or phone number, must be protected and used for the stated purposes.

A question about your project? Let’s talk it through. Write to us