CASL for Shopify stores in 2026: email and SMS consent done right

What CASL covers

A commercial electronic message is any email, text or similar message whose purpose, or one of its purposes, is to encourage commercial activity. Newsletters, promotions and win-back campaigns all qualify, and so does an email asking for consent.

The law applies when a computer system in Canada is used to send or open the message. A store in the United States or Europe emailing customers in Canada is covered in the same way as a store in Toronto.

Every commercial message must meet three requirements: you have the recipient’s consent, the message identifies you, and it includes a way to unsubscribe.

Express consent: an empty box the customer ticks

Express consent is the strongest kind and doesn’t expire unless the person withdraws it. The request must state its purpose and who is asking, give a mailing address and a phone number, email or web address, and say that consent can be withdrawn.

The CRTC is clear that a pre-checked box doesn’t count. The customer must take a positive action, such as ticking an empty box. The request also can’t be folded into your terms and conditions of use or sale; ask for it on its own.

Shopify’s default sign-up label asks customers to get news and offers, but names no business, contact details or way to withdraw. Adding those to the label, or right beside it, brings the request closer to what the regulations list.

Implied consent and its time limits

Without express consent, you may still email someone with whom you have an existing business relationship. A purchase gives you two years from the purchase date; an inquiry or application gives you six months. For a subscription, the clock starts when the subscription ends.

An abandoned cart isn’t a purchase. The CRTC’s FAQ says it doesn’t start the two-year period, and warns that treating it as an inquiry could draw complaints from shoppers who consider that no business relationship was formed.

Shopify’s own email tool sends campaigns only to customers who have subscribed, so implied consent matters mainly if you use another email platform. There, segment by last order date and stop marketing to non-subscribers two years after their last purchase.

Every message needs your name and a working unsubscribe

Each commercial message must identify the sender with a name, a mailing address and either a phone number, an email address or a web address, valid for at least 60 days after sending. The unsubscribe must be free and easy to use, keep working for at least 60 days and be honoured within 10 business days.

Texts have little room, so the required information can sit on a web page linked from the message. Make unsubscribing from a text as simple as from an email.

Some messages don’t need consent: confirmations of a transaction, delivery updates, warranty and recall notices and factual account information. Where such a message is commercial, it still needs the identification and unsubscribe details. Keep promotions out of order and shipping emails, because adding an offer means the exemption no longer applies.

Set up Shopify for CASL

Shopify stores each customer’s consent state, opt-in level and the date consent was last updated, which you can read through the Admin API. Those fields may not show what the customer actually saw, so keep dated screenshots of your forms and checkbox wording whenever they change.

• In Settings > Checkout > Marketing opt-in, choose where the email sign-up box appears: at checkout, on the sign-in page or both.
• For preselection, choose Regions you choose and leave Canada unselected, so Canadian customers start with an empty box. The SMS box can’t be preselected.
• Edit the checkbox label so it names your store, says what you will send and says customers can unsubscribe at any time.
• Consider double opt-in under Settings > Notifications > Customer notifications > Marketing double opt-in. CASL doesn’t require it, but a confirmed subscription is strong evidence of consent.
• Keep the abandoned-checkout automation addressed to subscribers only, which is Shopify’s default.
• When importing customers, set Accepts Email Marketing to yes only for people who consented, and keep the evidence.
• In Shopify Forms, subscribe customers only when they tick a box, and write your own consent wording.

Penalties and enforcement

The maximum administrative monetary penalty is $1 million per violation for an individual and $10 million for a business. Actual amounts have been far smaller. In June 2024, Hudson’s Bay Company agreed to pay $120,000 after the CRTC alleged it had sent promotional emails without an unsubscribe mechanism that could readily be performed.

The government’s report for fiscal 2024–25 counts two undertakings, more than $137,000 in penalties and over 414,000 complaints to the Spam Reporting Centre. Customers can’t sue under CASL: the private right of action never came into force and was repealed on December 31, 2025.

This article is general information, not legal advice. For your own consent wording and records, talk to a lawyer.

A checklist for Canadian email and SMS

• Make every sign-up box start empty for Canadian customers.
• Reword sign-up forms to name your store, describe what you will send and say people can unsubscribe.
• Send campaigns only to subscribers, unless you track implied consent with dates.
• Keep abandoned-checkout emails for subscribers.
• Check every template for your mailing address, contact details and a working unsubscribe.
• Process unsubscribes within 10 business days, from email and text alike.
• Save dated screenshots of every form and of your checkout wording.