CASL for Canadian Service Businesses: How Long You Can Legally Contact a Customer
TL;DR: Under Canada's anti-spam legislation, the clock on contacting a customer depends on what they did. A completed purchase or contract gives you up to two years of implied consent. A quote request or inquiry that did not become a job gives you six months. Express consent does not expire until it is withdrawn.
That distinction is the whole thing, and most contractor CRMs do not model it. They store a customer record and a phone number. They do not store which kind of consent you have, when it started, or when it dies — which means the tune-up reminder you send in month eight to someone who only ever asked for a quote is a problem.
This is not legal advice. It is a practical guide to what the rules say and what your systems need to track.
This is not legal advice. We build software, not legal opinions. CASL enforcement turns on facts and context, penalties are significant, and the summary below is not a substitute for a lawyer who knows your business. Use it to have a better-informed conversation, not instead of one.
Why this catches service businesses specifically
Most CASL guidance is written for e-commerce and newsletter marketing: someone subscribes, you email them, they unsubscribe. Clean.
Service businesses do not work like that. Your contact list is a mixture of people who bought a furnace in 2023, people who asked for a roof quote last month and never replied, people whose maintenance plan lapsed, and people a technician met at a property they were servicing for someone else. Every one of those is a different consent situation with a different expiry date, and they all sit in the same customer table.
Then someone runs a spring tune-up campaign against "all contacts", and the six-month bucket goes out with the two-year bucket.
The two clocks
CASL distinguishes express consent, which you were given explicitly, from implied consent, which arises from a relationship. Implied consent is the part that expires, and there are two different timers.
| What happened | Consent type | How long it lasts |
|---|---|---|
| They explicitly opted in | Express | No expiry until withdrawn |
| They bought something, or you had a contract | Implied — existing business relationship | Up to 2 years |
| They asked for a quote or made an inquiry | Implied — inquiry or application | 6 months |
Translated into a contractor's week:
- You replaced their water heater in March 2025. Implied consent from an existing business relationship runs up to two years from that transaction. A maintenance reminder in late 2026 is inside the window.
- They requested a roof quote in March 2026 and never booked. Six months. By late September 2026 that consent has expired, and the follow-up campaign you were planning needs express consent instead.
- They signed up for your newsletter at a home show. Express consent, no expiry, until they unsubscribe.
The trap is that the six-month bucket looks exactly like the two-year bucket in most CRMs. Both are "a contact with an email address and a job record". Only one of them is still contactable.
Express consent, and when to get it
Because express consent does not expire, the highest-value moment in your entire customer lifecycle is the one where you can ask for it — and for a service business, that moment is obvious: you are standing in their house having just fixed their heating.
A technician asking "would you like us to email you when your unit is due for service?" and recording a yes is worth more, in list terms, than any amount of later campaign optimisation. It converts a two-year timer into a permanent relationship.
What matters is that the consent is genuinely express: the person actively agreed, they knew what they were agreeing to and who from, and you can produce a record of it. A pre-checked box on a form is not express consent. A record with a timestamp, a source and what they were told is.
What every message must contain
Separate from consent, CASL requires identification in the messages themselves:
- Your business name.
- A current mailing address.
- At least one of a phone number, email address or website.
- That contact information must remain valid for at least 60 days after the message is sent.
The 60-day rule catches businesses that use campaign-specific email addresses or landing pages and tear them down when the promotion ends. If someone replies to a spring campaign in July, that address still has to work.
Unsubscribe handling
Every commercial electronic message needs an unsubscribe mechanism, and two requirements about it are frequently missed:
- It must be actioned within 10 business days. Not "at the next list sync", not "when we next export to the campaign tool". Ten business days.
- It must be free. No charge, and no barrier that amounts to one.
In practice the ten-day rule is a systems problem, not a policy problem. If unsubscribes live in your email tool but your technicians send texts from a different system, you have two lists and only one of them knows. That is the gap most businesses have and most do not discover until someone complains.
What your CRM actually has to track
Here is the practical translation. To be defensibly compliant, a system needs to store, per contact and per channel:
- Consent type — express, implied from a transaction, or implied from an inquiry. Not a single "opted in" checkbox.
- The date the clock started — the transaction date or the inquiry date, not the record creation date.
- The computed expiry — two years or six months out, so a campaign can filter on it.
- The source — what form, what conversation, what event. This is your evidence.
- Channel separation — email consent and SMS consent are not the same permission and should not share a field.
- Withdrawal, propagated everywhere — an unsubscribe recorded in one system must reach every system that can send.
Where we sit on this, stated plainly. Gravun enforces consent at the database level rather than as a checkbox in the interface, and enforces quiet hours on automated messages. That is an architectural choice: a campaign cannot send to a contact whose consent has lapsed because the data layer refuses, not because someone remembered to filter the list. We built it that way because we are a Toronto company and CASL is our own regulator. It does not make you compliant on its own — nothing does — but it removes the most common way businesses become non-compliant, which is a well-intentioned person exporting the wrong segment.
If you also operate in the US
Different regime, and two things changed recently enough that a lot of published guidance is now wrong.
The one-to-one consent rule never took effect. The FCC rule that would have required separate consent for each individual seller was vacated by the Eleventh Circuit on 24 January 2025, days before it was due to commence. Guidance still telling contractors to collect per-seller consent on shared lead forms is out of date.
Revocation now travels across message types. The FCC's consent-revocation rule took effect on 11 April 2025, but one provision was waived for a year: that revoking consent for one type of message revokes it across all of that sender's calls and texts. That waiver ended on 11 April 2026.
The practical consequence for a contractor: a customer replying STOP to an appointment reminder now also stops your marketing texts — and, depending on how your systems are configured, potentially your calls. If your reminder system and your campaign system are separate tools with separate opt-out lists, that is a live exposure right now.
Worth checking this month, not next year.
A practical checklist
- Segment your list by consent type, not by customer status. Transactions, inquiries and express opt-ins are three different lists.
- Find your six-month bucket. Quote requests older than six months that never became jobs. That is your highest-risk segment and probably your largest.
- Start asking for express consent at the job. Technicians are your best consent-collection channel and almost nobody uses them for it.
- Check your identification block. Business name, current mailing address, and contact details that will still work in 60 days.
- Test an unsubscribe end to end. Unsubscribe from a campaign, then have a technician try to text that contact. If the text sends, you have found your gap.
- If you send in the US, check your STOP handling against the April 2026 rule.
- Keep your evidence. Consent records are only useful if you can produce them.
- Get a lawyer to review it. Once, properly. It is cheaper than the alternative.
FAQ
How long can I email a customer after a job in Canada?
Under CASL, a completed purchase or contract creates implied consent that lasts up to two years from that transaction. After that, you need express consent to keep sending commercial electronic messages. Express consent, once given, does not expire until the person withdraws it.
How long does consent last after someone requests a quote?
Six months. Under CASL, an inquiry or application creates implied consent that lasts six months, which is considerably shorter than the two years that follows an actual purchase or contract. A quote request that never became a job expires on the shorter clock.
Does CASL apply to text messages?
Yes. CASL covers commercial electronic messages generally, which includes SMS as well as email. Consent for email and consent for text are best treated as separate permissions rather than a single opt-in, and an unsubscribe must be honoured across every channel and system you send from.
How quickly do I have to process an unsubscribe under CASL?
Within 10 business days, and at no cost to the person unsubscribing. The practical difficulty for service businesses is that unsubscribes often live in a marketing tool while technicians send texts from a separate system, so the withdrawal never reaches every place that can send.
What information must a commercial message include under CASL?
Your business name, a current mailing address, and at least one of a phone number, email address or website. That contact information must remain valid for at least 60 days after the message is sent, which matters if you use campaign-specific addresses or landing pages.
Did the US one-to-one consent rule take effect?
No. The FCC rule requiring separate consent for each individual seller was vacated by the Eleventh Circuit on 24 January 2025, shortly before it was due to commence. Separately, the FCC's consent-revocation rule provision making a revocation apply across all of a sender's calls and texts came out of waiver on 11 April 2026 and is now in force.
Sources
- Innovation, Science and Economic Development Canada — CASL consent rules, expiry periods, identification and unsubscribe requirements
- Insurance Marketing Coalition v. FCC, 11th Circuit, 24 January 2025 — one-to-one consent rule vacated
- FCC limited waiver of part of the TCPA consent revocation rule
- Gravun — consent enforcement and quiet hours
This article is general information about published regulatory requirements, not legal advice, and does not create a solicitor-client relationship. Regulations change and enforcement depends on specific facts. Consult a qualified lawyer about your own obligations before relying on anything here.
Consent that expires on its own is a data problem, not a policy problem. Gravun enforces consent at the database level and quiet hours on automated messages. Start a 14-day free trial or book a walkthrough.