How I track consent expiry
Canada's anti-spam law puts time limits on implied consent, so I build those limits into your email system and nobody has to remember the dates.
The short version
Under CASL you need consent to send commercial email, and it comes in two kinds. Express consent means the person clearly said yes, and it doesn't expire unless they unsubscribe. Implied consent comes from a business relationship and does expire: two years after their last purchase, or six months after their last inquiry. A new purchase resets the two-year clock (CRTC, CASL guidance on implied consent).
What I set up
Every contact gets these fields in the email platform:
| Field | What it holds |
|---|---|
| consent_type | express / implied-purchase / implied-inquiry |
| last_purchase_date | date of the most recent order |
| last_inquiry_date | date of the most recent inquiry |
| consent_expiry_date | calculated: purchase + 2 years, or inquiry + 6 months |
What happens automatically
About 60 days before implied consent expires, the contact gets a plain email asking whether they'd like to keep hearing from you, and a reminder follows about 14 days before. If they say yes, they move to express consent, which doesn't expire, and if they buy again the two-year clock resets. If neither happens by the expiry date, the contact is tagged "no-CEM" and taken off promotional emails.
The basics in every email
Every email carries your business name and contact information and a working unsubscribe link, and unsubscribe requests are processed within 10 business days. Consent records are kept as evidence in case anyone asks.
Who's responsible for what
You're responsible for how your list was collected. I set up the tracking, keep the records and send only to contacts with valid consent.
Fine print
This page explains how I set up the system, and it isn't legal advice. For the official rules, read the CRTC's guidance on implied consent: https://www.crtc.gc.ca/eng/com500/guide.htm
Not sure where your list stands?
The $500 CASL Consent Clean-up tags your existing list by consent type and date and then runs a re-permission campaign, so you know exactly who you can email.