The Cost of Getting SMS Consent Wrong in Canada

A single unsolicited text message could cost your business up to $10 million. That's not a scare tactic — it's the maximum penalty under Canada's Anti-Spam Legislation, and regulators have shown they will use it.

CASL penalties reach $1 million per violation for individuals and $10 million per violation for businesses, according to Canadian compliance guidance. And the liability doesn't stop at the company: officers, directors, and agents who authorize or acquiesce in non-compliant texting can be held personally responsible.

The enforcement record proves this is not theoretical. Porter Airlines received a $150,000 fine for being unable to provide a definitive consent history, as documented in CASL enforcement analysis. Hudson's Bay Company was fined $120,000 in 2024 for promotional texts sent without proper consent documentation, per Canadian SMS compliance research.

Individual senders aren't exempt either. One person paid a $17,000 settlement for sending over 111,000 unsolicited texts. Between October 2021 and March 2022 alone, the Spam Reporting Centre logged 167,939 complaints — more than 6,400 every week.

The rule that trips up most businesses is simple but brutal: the burden of proving consent is on the sender. As CRTC guidance puts it, "the onus of proving consent, be it express or implied, is on the person who claims they have consent." If you can't produce records showing when, how, and why consent was obtained, you're exposed.

What that means in practice:

• Log consent records from day one — timestamp, method, and purpose of every opt-in
• Check implied consent windows: 2 years after a purchase, 6 months after an inquiry
• Never assume email consent covers texting — it doesn't transfer to SMS
• Honor opt-outs within 10 business days, ideally immediately

This is why compliance should be a checkpoint when you evaluate any marketing partner. At Worqd, every outreach campaign we run starts by verifying consent status before the first text goes out — permission-aware outreach is built into how we handle both new campaigns and old lead reactivation, where expired consent windows are the biggest risk.

The good news: CASL recognizes due diligence as a defence. As compliance experts note, that defence only works if you can prove you had policies, trained your team, ran audits, and acted on what you found. The cost of getting consent wrong is high — but the cost of proving you got it right is just good process.

The Three Legal Requirements Every Commercial Text Must Meet

Every commercial text message in Canada has to clear three hurdles before it goes out. Miss any one of them, and you're not just risking annoyed customers — you're risking fines that can reach $1 million per violation for individuals and $10 million per violation for businesses under CASL, Canada's Anti-Spam Legislation in force since July 2014.

The first hurdle is consent, and it comes in two flavours. Express consent is the gold standard: someone actively opts in through a checkbox or a keyword text, and that permission never expires. Silence doesn't count, and pre-checked boxes are invalid. Implied consent is the fallback, and it's strictly time-limited — you have 2 years after a purchase and just 6 months after an inquiry before the window closes.

The second hurdle is sender identification. Every message must clearly state who's sending it and on whose behalf, and that identification has to remain valid for at least 60 days after the message is sent. The third hurdle is a working unsubscribe — a simple "reply STOP" that must be honoured within 10 business days, though processing it immediately is the accepted best practice.

One trap catches even experienced marketers: email consent never transfers to SMS. If a subscriber opted into your newsletter, that does not give you permission to text them. This matters enormously for database reactivation — digging into old CRM contacts by text means verifying consent was for SMS specifically and that the implied consent windows haven't lapsed. It's a check we build into every outreach campaign before the first message goes out.

The burden of proof sits squarely on the sender. The CRTC is explicit: "The onus of proving consent, be it express or implied, is on the person who claims they have consent." Businesses must record when, how, and why consent was obtained — and failing to produce that record gets expensive. Porter Airlines was fined $150,000 simply for being unable to provide a definitive consent history, and Hudson's Bay Company paid $120,000 in 2024 over promotional texts without proper consent documentation.

Before you hit send, run your message through this checklist:

• Do you have express consent, or implied consent still inside the 2-year/6-month window?
• Does the message clearly identify the sender and anyone on whose behalf it's sent?
• Is there a working opt-out, and can you process STOP within 10 business days?
• Can you produce consent records if the CRTC ever asks?

Most Canadian small and mid-sized businesses fall short on at least one of these, usually because of legacy lists with no consent records. The good news: CASL is rigorous but navigable. Treat consent seriously, document everything, and texting stays one of the highest-performing channels available — with open rates above 90% for those who play by the rules.

Operational Rules Beyond CASL: Bilingual Keywords, Quiet Hours, and Content Bans

Text message marketing in Canada demands more than just CASL compliance—carriers and industry standards impose additional operational rules that shape how businesses engage audiences. Beyond legal requirements, Canadian telecom providers enforce strict guidelines on content, timing, and language, creating a layered compliance framework. For example, SMS programs must support bilingual opt-out keywords like STOP/ARRET to meet federal standards, ensuring accessibility for both English and French speakers (Startelecom).

Canadian carriers also enforce 9am–9pm quiet hours for promotional messages, a de facto rule despite no explicit CASL mandate. Sending outside this window increases complaints and carrier filtering, with 167,939 spam reports filed between 2021 and 2022 (ISED Canada). Additionally, SHAFT content restrictions block adult material, hate speech, and regulated categories like alcohol, cannabis, and tobacco, which require age verification and federal/provincial compliance (OtterText).

• Bilingual opt-out keywords (STOP/ARRET) must be supported
• Promotional texts limited to 9am–9pm local time
• SHAFT content bans apply to adult, hate, alcohol, firearms, and tobacco/vaping messaging

For businesses like Worqd, these rules shape campaign design. Their Pipeline Recovery service ensures old leads are reactivated only with valid, SMS-specific consent, avoiding expired implied windows (Latin Launch). By integrating bilingual keywords, quiet-hour discipline, and content screening, Worqd aligns with both legal and carrier standards, minimizing risks while maximizing engagement. As SMS open rates exceed 90% (OtterText), compliance becomes a competitive advantage—ensuring messages reach audiences without triggering penalties or carrier blocks.

How to Build a Compliant SMS Workflow (and How Worqd Handles It)

Knowing the rules is one thing. Building them into your daily workflow is what actually keeps you safe — because under CASL, the burden of proving consent falls on the sender, not the recipient.

That burden is real. Porter Airlines was fined $150,000 simply because it could not produce a definitive consent history, and Hudson's Bay Company paid $120,000 in 2024 over promotional texts without proper consent documentation. Most Canadian small businesses today sit out of compliance due to legacy lists with no consent records and expired implied consent, according to industry analysis.

A compliant workflow comes down to three habits:

• Log consent records from day one. Record when, how, and why consent was obtained for every contact. If you cannot produce that history on request, you are exposed.
• Audit implied-consent windows regularly. Implied consent lasts only 2 years after a purchase and 6 months after an inquiry. A list that was legal last year may not be legal today.
• Process opt-outs immediately. The law gives you 10 business days, but treating every STOP as instant is the standard that keeps complaints and penalties away. Support both English and French keywords, since Canadian programs must handle both languages.

One trap catches even careful teams: consent for email does not transfer to SMS. As one industry guide puts it, a newsletter opt-in gives you no permission to text. This matters most when reactivating old leads — before texting contacts already sitting in a CRM, you need to confirm their consent covered SMS specifically and that no implied-consent window has lapsed.

This is the thinking behind how Worqd runs outreach. Every campaign starts from permission-aware targeting, consent is captured through an explicit opt-in ("I agree to be contacted about my request"), and Pipeline Recovery work begins by checking consent status and implied-consent windows before any old contact hears from you. Compliance is not a checkbox bolted on at the end — it shapes who gets messaged in the first place.

The due diligence defence CASL recognizes only works if you can prove you had policies, trained your team, and acted on what you found, as one compliance analysis notes. Build the workflow so the proof exists before anyone asks for it.

If you want a second pair of eyes on how your follow-up handles consent, book a Growth Call and we will walk through it together.