Is cold email legal in Canada? B2B rules for 2026

Only with consent. Canada's Anti-Spam Legislation (CASL) prohibits sending a commercial electronic message without the recipient's express or implied consent, and it makes no exception for business recipients. For B2B, consent can be implied when the recipient published their address conspicuously or gave it to you, but only if your message is relevant to their role, and a bought list never creates it. The CRTC says LinkedIn messaging counts as sending to an electronic address, so cold sales DMs need consent too. Even an email asking "may we email you?" counts as a commercial message.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

Like Germany, Canada starts from consent; unlike Germany, it lets consent be implied in defined B2B situations. CASL also covers messages sent from abroad. All countries: cold email laws by country.

Canada at a glance

What CASL says

Section 6(1) of CASL (S.C. 2010, c. 23):

"It is prohibited to send or cause or permit to be sent to an electronic address a commercial electronic message unless (a) the person to whom the message is sent has consented to receiving it, whether the consent is express or implied; and (b) the message complies with subsection (2)."

Subsection (2) requires that each message identifies the sender, gives contact information and sets out an unsubscribe mechanism, and unsubscribes must take effect "no later than 10 business days after the indication has been sent" (s. 11(3)). An electronic address includes "an instant messaging account" and "any similar account" (s. 1(1)). A request for consent "is also considered to be a commercial electronic message" (s. 1(3)), so a cold email asking permission is caught too. Whoever claims consent "has the onus of proving it" (s. 13). Source: CASL on Justice Laws, current to 21 September 2026.

What the CRTC says

The CRTC's FAQ on addresses found online:

"The conspicuous publication exemption under CASL does not provide persons sending CEMs with a broad licence to contact any electronic address they find online; rather, it provides for circumstances in which consent can be implied by such publication, to be evaluated on a case-by-case basis."

A list seller's copy of an address "would not create implied consent on its own", and the general advice is: "It is best not to assume implied consent: if you are unsure, ask for express consent." Messages sent to Canada from another country must comply too. Source: CRTC FAQ (archived copy, 10 October 2026; crtc.gc.ca blocked automated access).

Named employees, sole traders and the B2B exemption

CASL does not separate legal and natural persons, so a named employee needs consent like anyone. Three B2B routes exist:

1. Conspicuous publication (s. 10(9)(b)): the person or their employer published the address conspicuously, with no refusal statement, "and the message is relevant to the person’s business, role, functions or duties in a business or official capacity".
2. Disclosure (s. 10(9)(c)): the person gave you the address, for example on a business card, without saying no, and the message is relevant to their role.
3. The B2B exemption (SOR/2013-221, s. 3(a)(ii)): messages between two organisations' employees "if the organizations have a relationship and the message concerns the activities of the organization to which the message is sent". The CRTC stresses that the relationship must be between the organisations, not just their employees.

In the CRTC's own example, a training company emailing a COO about a course "on how to be an administrative assistant" cannot rely on conspicuous publication. For sole traders, the Act's "person" includes an individual, a partnership and a corporation alike, so the same rules apply (our reading; we found no CRTC text on sole proprietors).

LinkedIn and social media messages

"For example, a Facebook wall post would not be captured. However, messages sent to other users using a social media messaging system (e.g., Facebook Messenger and LinkedIn messaging), would qualify as sending messages to "electronic addresses.""

Sender details and an unsubscribe mechanism shown in the platform's interface can stand in for those in the message, but consent is still required (SOR/2013-221, s. 3(d)). And being connected is not a personal relationship: "Someone who sends a CEM on behalf of a corporation may not claim to have a personal relationship with the recipient." We found no court ruling on LinkedIn.

Privacy law: PIPEDA

PIPEDA does not apply to business contact information used solely to communicate with someone "in relation to their employment, business or profession" (s. 4.01). But harvested addresses may not be collected or used without consent (s. 7.1(2)); Compu-Finder acknowledged harvesting about 170,000 addresses from websites (OPC findings #2016-003; PIPEDA).

Penalties and real cases

The maximum administrative monetary penalty "is $1,000,000 in the case of an individual, and $10,000,000 in the case of any other person" (s. 20(4)). Two B2B decisions:

• Compu.Finder, 2017: CAD 200,000. Training offers emailed "primarily to individuals working in the province of Quebec". The CRTC found the relevance test often unmet: "The company appears to have relied on the general public availability of electronic addresses, coupled with assumptions or speculation as to what the functions of the receiving organization or individual might be." (Decision CRTC 2017-368, archived copy)
• Blackstone Learning, 2016: CAD 50,000 for training offers "targeted primarily to government employees" (Decision CRTC 2016-428, archived copy).

Checklist for B2B email to Canada

1. Record a consent basis for every lead before the first message; the burden of proof is yours.
2. For implied consent by publication, log where and when you found the address, that it was conspicuous, that no refusal statement was attached and why your message fits the role.
3. Never rely on an address a list seller published, and do not email to ask for consent.
4. In every message, identify yourself, give contact details and an unsubscribe mechanism, and act on unsubscribes within 10 business days.
5. Apply the same rules to LinkedIn messages.

How Leo handles Canada

Leo, the buying-signal agent Revexa builds, blocks only Germany automatically, not Canada. CASL requires express or implied consent, and you read and approve every draft in review mode, so whether you can show consent for a Canadian lead is yours to check before you approve. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise.

Common questions

Is B2B cold email legal in Canada?

Only with consent, express or implied, B2B included. Implied consent can come from a conspicuously published or personally disclosed work address when the message is relevant to the recipient's role, or from an existing business relationship.

Can I email an address I found on a company website?

Only if the person or their organisation published it conspicuously, without a refusal statement, and your message is relevant to their role. The CRTC says publication is not "a broad licence to contact any electronic address they find online".

Do CASL rules apply to LinkedIn messages?

Yes. The CRTC says messages sent through a social media messaging system, naming Facebook Messenger and LinkedIn messaging, are sent to electronic addresses; a wall post is not.

Does CASL apply to companies outside Canada?

Yes. The CRTC says commercial electronic messages sent to recipients in Canada from another country must comply with CASL.

What are the penalties under CASL?

Up to CAD 10 million per violation for a business. In 2017 the CRTC fined training provider Compu.Finder CAD 200,000 for emails sent without consent, mainly to people working in Quebec.