The Compliance Perimeter Problem: Why Marketers Assume the CRTC Covers Everything

Most marketers treat the CRTC as the regulator of all Canadian communications. It isn't. The CRTC is a statute-bound tribunal whose authority comes from Parliament, and everything outside those statutes sits beyond its reach.

The commission regulates only "many of the activities" of broadcasting and telecommunications, per its own submission to the Legislative Review Panel. That phrasing matters. It's an admission of partial coverage, not a claim of total jurisdiction.

For marketers, the practical perimeter is narrower still. The CRTC enforces exactly three regimes: the Unsolicited Telecommunications Rules, Canada's Anti-Spam Legislation, and the Voter Contact Registry, as stated on its enforcement page. Communications that don't fall under those three frameworks aren't CRTC-enforced, no matter how "communications-related" they look.

That gap creates real risk, because the assumption runs in one direction. Teams build consent flows, suppression lists, and disclosure language around a regulator that may never touch their channel.

Here's what falls outside the CRTC's perimeter:

• Email and voice rules stay legally separate. The Telecommunications Act bars the CRTC from using telemarketing rules to regulate messages CASL already covers, and the 2026-132 consultation is a voice proceeding, not an email one.
• Privacy, consumer protection, and online safety sit in separate legislative frameworks, which the Panel described as an ecosystem of regimes that must work together.
• Criminal threats and safety issues go to local law enforcement, not the CRTC.
• Passive infrastructure such as support structures, public property, and privately owned buildings falls under limited direct jurisdiction, shared across multiple levels of government.

Not CRTC-regulated does not mean unregulated. It means regulated somewhere else, by someone else, under rules you still have to follow. Map the perimeter before you build the process.

The Three Regimes the CRTC Actually Enforces (And What Falls Outside Them)

For all the talk about what the CRTC oversees, the more useful question for a marketer is where its authority stops. The CRTC enforces exactly three regimes: the Unsolicited Telecommunications Rules, Canada's Anti-Spam Legislation, and the Voter Contact Registry, as its own enforcement page states. Everything else sits somewhere else.

That perimeter is narrower than most people assume. The CRTC regulates only "many of the activities" of broadcasting and telecommunications, and it follows a stated policy of leaving markets alone absent evidence of market failure. Outside its three regimes, your marketing communications are simply not CRTC-enforced.

The separations matter in practice:

• Voice and email rules are legally distinct. The Telecommunications Act bars the CRTC from using telemarketing rules to reach messages CASL already covers, a split confirmed in the 2026-132 consultation.
• Privacy, consumer protection, and online safety live in separate legislative frameworks, not CRTC mandates.
• Criminal threats and safety issues go to local law enforcement, not the Commission.
• Passive infrastructure such as support structures and privately owned buildings falls largely outside CRTC jurisdiction.

The scale of enforcement inside the perimeter is why the boundary is worth knowing. The National Do Not Call List holds more than 15.2 million numbers, and the CRTC has logged over 944,000 complaints since 2008, with more than $17.6 million in penalties across 3,500+ investigations. The largest listed settlement, against Zoominfo Technologies LLC, reached $1,500,000.

Two rules follow from this. First, consent has to be a positive indication: pre-checked boxes don't count, and each act under CASL Sections 6 through 8 needs specific, separate consent. Second, if you run AI voice agents outbound, watch the 2026-132 proceeding, which is weighing whether callers must disclose up front that no live person is on the line.

None of this means "unregulated." It means a different regulator, or a different statute, owns the problem. At Worqd, we treat that as a design input rather than an afterthought: permission-aware outreach, explicit opt-in consent on our booking funnel, and no sensitive form fields sent to public analytics. If you want a growth partner who builds campaigns with the compliance map already drawn, book a growth call. More demand. Faster follow-up. Better creative.

What This Means for Your Campaigns: Channel-by-Channel Compliance

If you run campaigns across phone, email, and paid channels, the fastest way to waste compliance effort is treating every channel the same. The CRTC's enforcement perimeter covers exactly three regimes: the Unsolicited Telecommunications Rules, CASL, and the Voter Contact Registry. Everything else sits outside its oversight, and knowing which channel falls where changes how you build consent flows.

Start with consent, because it's where most marketers get burned. Under CASL, the CRTC requires a "positive indication" of consent, which means a pre-checked box is not acceptable. It also requires specific and separate consent for each distinct act, plus a clear, easy unsubscribe mechanism. In practice, that looks like an explicit "I agree to be contacted" checkbox the user has to tick themselves, which is how we handle consent in our own booking funnel. One checkbox covering "any communications, ever" won't survive scrutiny.

Voice and email are legally separate regimes, and conflating them is a common mistake. The Telecommunications Act itself bars the CRTC from using telemarketing rules to regulate a message CASL already covers, so a call and an email about the same offer follow different rulebooks. The current 2026-132 consultation is a voice proceeding covering telemarketing, Do Not Call, and robocall rules. It is not an email proceeding. Industry commentary calls the possible alignment of telemarketing definitions with CASL's "commercial electronic message" a "convergence of vocabulary, not of jurisdiction."

If you use AI voice agents for outbound or inbound calls, watch that consultation closely. The CRTC is considering whether telemarketers must disclose at the start of a call that the consumer is not speaking to a live person. That requirement isn't law yet, but if AI voice is part of your follow-up path (as it is in the AI SDR work we do for clients), plan for a disclosure script now so you're not rewriting call flows under deadline.

A few practical guardrails for a multi-channel campaign:

• Treat phone, email, and any voter-contact work as three separate compliance tracks with their own consent records.
• Never use pre-checked consent boxes; require an affirmative action from the user.
• Keep unsubscribe mechanisms obvious and functional on every commercial email.
• If you run AI voice calls, draft an AI-disclosure line now, before a rule makes it mandatory.
• Remember "not CRTC-regulated" doesn't mean "unregulated": privacy, consumer protection, and online safety live in separate frameworks, and criminal matters go to law enforcement.

The stakes are real. The CRTC's enforcement history includes more than $17.6 million in penalties across over 3,500 investigations, with the largest listed settlement at $1.5 million against Zoominfo Technologies for Unsolicited Telecommunications Rules violations. Concentrate your compliance effort on the three regimes the CRTC actually enforces, and don't assume a rule that applies to your email program applies to your phone program.

Building a Compliance Practice That Matches the Real Perimeter

Most compliance advice tells you to "check with the CRTC" and leaves it there. That's useless if you don't know where the CRTC's authority actually stops. The good news: the perimeter is small, and you can audit against it in an afternoon.

Start with the three regimes the CRTC actually enforces: the Unsolicited Telecommunications Rules, Canada's Anti-Spam Legislation, and the Voter Contact Registry. According to the CRTC's own enforcement page, those are the frameworks it promotes compliance with, and its tools are citations, Notices of Violation, settlements, and undertakings. Everything outside them isn't CRTC-enforced. That doesn't make it legal, though. Privacy, consumer protection, and online safety sit in separate legislative frameworks, and criminal matters go to local law enforcement.

Audit your current practices against that boundary, channel by channel:

• Outbound calls and robocalls: check against the UTR and the National Do Not Call List, which holds more than 15.2 million numbers.
• Commercial email: check against CASL, which the Telecommunications Act keeps legally separate from telemarketing rules.
• AI voice agents: watch Consultation 2026-132, which is considering whether callers must disclose up front that no live person is on the line.
• Social ads, SEO, and landing pages: outside the CRTC perimeter, but still subject to privacy and consumer protection law.

Concentrate your effort where penalties land. The CRTC has logged over 944,000 complaints since 2008 and more than $17.6 million in penalties across 3,500+ investigations, with the largest listed settlement at $1.5 million. That's where sloppy consent gets expensive.

Document consent properly: a positive indication, never a pre-checked box, and specific, separate consent for each distinct act. When Worqd builds outreach and AI SDR follow-up for clients, that's the standard we work to, and it's the same standard we'd hold any provider to when you're choosing one.