# AI tells a Canadian business that implied consent is valid indefinitely under Canada's Anti-Spam Legislation (CASL)

- **ID:** `legal/canada-anti-spam-casl-consent`
- **Domain:** legal
- **Category:** legal_risk
- **Error Code:** `CAN-CASL-CONS-006`
- **Verification:** ai_generated
- **Fix Rate:** 77%

## Root Cause

CASL (S.C. 2010, c. 23) establishes a two-year expiry for implied consent (Section 10(9)), after which express consent must be obtained; implied consent from an existing business relationship or a published email address expires 2 years from the date it was given

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| CASL S.C. 2010, c. 23 | active | — | — |
| CRTC Compliance and Enforcement Bulletin CRTC 2012-548 | active | — | — |

## Workarounds

1. **Implement a consent tracking system that logs the date and type of consent (implied vs. express). For implied consent, set a 2-year timer and send a re-consent request before expiry. For example, use a database field `consent_expiry_date` with a cron job to flag expiring consents.** (82% success)
   ```
   Implement a consent tracking system that logs the date and type of consent (implied vs. express). For implied consent, set a 2-year timer and send a re-consent request before expiry. For example, use a database field `consent_expiry_date` with a cron job to flag expiring consents.
   ```
2. **Obtain express consent by sending a clear opt-in email with an unchecked checkbox and a link to your privacy policy. The CRTC recommends that consent be 'obtained through a clear, positive action' and that the purpose of the communication be stated explicitly.** (90% success)
   ```
   Obtain express consent by sending a clear opt-in email with an unchecked checkbox and a link to your privacy policy. The CRTC recommends that consent be 'obtained through a clear, positive action' and that the purpose of the communication be stated explicitly.
   ```

## Dead Ends

- **** — Assuming that a 'business relationship' clause in terms of service constitutes express consent — CASL requires express consent to be obtained through a clear, affirmative action (e.g., checking an unchecked box), not buried in fine print (70% fail)
- **** — Using a pre-checked consent checkbox for email marketing — CASL prohibits pre-checked boxes (Section 10(5)); the user must actively check the box to give express consent (80% fail)