Email remains one of the most cost-effective marketing channels for small businesses. Unlike social media, where algorithms decide who sees your posts, email lets you reach customers directly. SMS marketing can be even more immediate. For Ontario merchants running Shopify stores and physical locations, these channels can drive both online sales and store visits.
But Canada has some of the strictest anti-spam rules in the world. Canada's Anti-Spam Legislation (CASL) sets clear requirements for sending commercial electronic messages, and penalties for violations can be significant. The good news: following CASL generally leads to better marketing, because you're communicating with people who actually want to hear from you.
This article explains CASL in plain language and shows how to build compliant, effective email and SMS marketing with Shopify. It's educational information, not legal advice.
What CASL covers
CASL applies to commercial electronic messages (CEMs), which include emails, text messages, and direct messages on some platforms that encourage participation in commercial activity. Promotional newsletters, sale announcements, and product recommendations are all CEMs.
CASL has three core requirements for CEMs:
- Consent: You must have the recipient's consent (express or implied).
- Identification: Messages must clearly identify who is sending them.
- Unsubscribe mechanism: Every message must include an easy way to unsubscribe.
Understanding consent
Express consent
Express consent is when someone actively agrees to receive your messages, such as by checking an unchecked box or entering their email in a clearly labelled newsletter signup. Express consent doesn't expire unless the person withdraws it.
When requesting express consent, you must clearly state:
- The purpose (for example, "to receive news, offers, and updates")
- Who is requesting consent (your business name)
- Your contact information (mailing address plus phone, email, or web address)
- That the person can withdraw consent at any time
Important: Pre-checked boxes don't count as express consent under CASL. The customer must take a positive action.
Implied consent
Implied consent applies in specific situations, including:
- Existing business relationship: A customer who purchased from you within the past two years.
- Inquiries: Someone who asked about your products or services within the past six months.
- Conspicuous publication: Someone who publicly posted their business email without stating they don't want messages, when your message relates to their business role.
Implied consent expires. If you rely on it, you need to track dates and stop messaging people once the window closes, unless they've given express consent in the meantime.
A best practice is to convert implied consent into express consent whenever possible, for example, by inviting recent customers to join your newsletter with a clear opt-in.
Keeping records
The burden of proving consent is on the sender. Keep records of:
- When and how consent was given
- The wording presented at the time
- The source (website form, POS signup, event)
Shopify records marketing consent status and timestamps on customer profiles, which helps, but also document your forms and processes.
Identification and unsubscribe requirements
Each CEM must include:
- Your business name (and the name of anyone sending on your behalf)
- Your mailing address
- At least one other contact method (phone, email, or website)
- An unsubscribe mechanism that is easy to use, at no cost to the recipient
Unsubscribe requests must be processed within 10 business days. Shopify's marketing tools include unsubscribe links automatically, but confirm your footer includes all required information.
Penalties
CASL violations can result in significant administrative monetary penalties, with maximums in the millions of dollars for businesses. Beyond fines, spam complaints damage your sender reputation, causing emails to land in junk folders. Compliance protects both your legal position and your marketing effectiveness.
Collecting consent the right way
On your website
- Use signup forms with clear, unchecked consent boxes.
- Explain what subscribers will receive and how often.
- Offer an incentive if appropriate (such as a welcome discount), but make the terms clear.
- Include consent language at checkout, again with an unchecked box.
Shopify Forms and many theme sections support newsletter signups that record consent in customer profiles.
At the point of sale
In-store signups are a valuable opportunity. With Shopify POS:
- Staff can ask customers whether they'd like to receive emails or texts.
- Consent can be recorded on the customer profile.
- A customer-facing display can let customers enter their own details.
Train staff to ask a clear question, such as: "Would you like to receive our email newsletter with new arrivals and offers? You can unsubscribe anytime." Never add customers to marketing lists just because they asked for a digital receipt. A receipt is a transactional message, not consent for marketing.
At events
Collect signups at markets, trade shows, and in-store events using a tablet or POS device rather than paper forms, which are harder to verify and store.
Transactional vs. commercial messages
Some messages are exempt from CASL's consent requirement (though they may still need identification information). These include messages that:
- Confirm a transaction (order confirmations, receipts)
- Provide warranty or safety information
- Deliver product updates related to a purchase
- Provide information about an ongoing subscription or account
Keep transactional messages focused on the transaction. Adding heavy promotional content to an order confirmation can blur the line.
Building an email program with Shopify
Shopify's built-in marketing email tool, now part of Shopify Messaging (formerly known as Shopify Email), integrates directly with your customer data. You can also use third-party email platforms that connect to Shopify.
Essential automated flows
Automations send the right message at the right time without manual work. Start with:
- Welcome series: Introduce your brand to new subscribers over a few emails.
- Abandoned checkout: Remind customers who started checkout but didn't finish. (Ensure you have consent for marketing follow-ups, or keep these clearly tied to the transaction and seek advice on your approach.)
- Post-purchase: Thank customers, share care tips, and request reviews.
- Win-back: Re-engage customers who haven't purchased in a while.
- Birthday or anniversary: Celebrate customers with a small reward.
Shopify Flow and Shopify's marketing automations can trigger many of these.
Regular campaigns
Plan a content calendar that mixes:
- New arrivals
- Seasonal promotions
- Educational content (how-to guides, care tips)
- Behind-the-scenes stories
- Local events and store news
- Customer spotlights
For Ontario businesses, local and seasonal relevance works well: patio season, cottage weekends, back-to-school, Thanksgiving, holiday gifting, and winter survival kits.
Segmentation
Use Shopify's customer segments to send more relevant messages:
- In-store shoppers near a specific location
- Online-only customers
- High-value customers
- Customers who bought a specific category
- Customers who haven't purchased recently
Sending fewer, more relevant emails generally improves engagement and reduces unsubscribes.
SMS marketing
Text messages have high open rates but feel more personal and intrusive. Use SMS thoughtfully:
- Get explicit consent specifically for SMS.
- Send less frequently than email.
- Keep messages short and valuable (flash sales, back-in-stock alerts, pickup notifications).
- Always include your business name and opt-out instructions.
- Respect quiet hours.
Remember that order and pickup notifications by SMS are transactional; promotional texts require consent.
Deliverability basics
Even compliant emails can land in spam folders. Improve deliverability by:
- Authenticating your domain with SPF, DKIM, and DMARC records. Major mailbox providers now expect these from bulk senders. Shopify provides guidance on authenticating your sending domain.
- Cleaning your list by removing inactive subscribers periodically.
- Avoiding purchased lists, which are both a CASL risk and a deliverability disaster.
- Maintaining consistent sending rather than blasting after months of silence.
- Making unsubscribing easy, which reduces spam complaints.
Measuring email and SMS performance
Track:
- Revenue per email sent
- Click-through rate
- Conversion rate
- Unsubscribe rate
- Spam complaint rate
- List growth rate
- In-store impact (for example, redemptions of in-store discount codes)
Open rates have become less reliable due to privacy features in email apps, so focus more on clicks and conversions.
A CASL compliance checklist
- [ ] Signup forms use unchecked consent boxes with clear language.
- [ ] Consent requests identify my business and contact information.
- [ ] Staff know how to request and record consent at POS.
- [ ] I don't add customers to marketing lists based on receipts alone.
- [ ] I track implied consent expiry dates or convert to express consent.
- [ ] Every CEM includes my business name, mailing address, contact info, and unsubscribe link.
- [ ] Unsubscribes are processed promptly (within 10 business days).
- [ ] I keep records of how and when consent was obtained.
- [ ] My sending domain is authenticated.
- [ ] I never use purchased lists.
Key takeaways
- CASL requires consent, identification, and an unsubscribe mechanism for commercial electronic messages.
- Express consent requires a positive action; implied consent is limited and expires.
- Shopify records consent on customer profiles, but you're responsible for compliant forms, processes, and records.
- Build automated flows and segmented campaigns to deliver relevant, valuable messages.
- Use SMS sparingly and with specific consent, and authenticate your domain for better deliverability.
This article is general information, not legal advice. Consult the Canadian Radio-television and Telecommunications Commission (CRTC) guidance on CASL and a qualified lawyer for your specific situation.