The Compliance Confusion: Three Regulators, One Email Campaign

Here's a common and expensive assumption in Canadian e-marketing: that passing a CASL review means the campaign is compliant. It doesn't. Enforcement is split three ways, and a campaign can clear one regulator's test and fail another's on the same send.

The Office of the Privacy Commissioner of Canada lays out the division directly. The CRTC's CASL mandate covers exactly three things: sending commercial electronic messages, altering transmission data, and installing software without consent. Everything else in the e-marketing compliance space belongs to someone else.

That "someone else" matters more than most marketers realize:

• Collecting and using email addresses falls under PIPEDA, enforced by the OPC, which prohibits address harvesting with very limited exceptions.
• False or misleading claims fall under the Competition Act, enforced by the Competition Bureau, not the CRTC.
• Privacy practices in commercial activity generally sit with the OPC, which shares the file with the CRTC and the Competition Bureau.

The penalties on those non-CRTC axes are not small. Cineplex was ordered to pay over $38.9 million in penalties and costs for drip pricing through a mandatory $1.50 online booking fee, according to the Competition Bureau's cases and outcomes database. That outcome had nothing to do with consent or unsubscribe mechanics, which is precisely the point.

Two more traps sit inside this confusion. First, hiring an agency doesn't move the risk: under CASL, the primary organization remains liable even when a vendor sends on its behalf, and under PIPEDA it stays accountable for how a supplier collected addresses. Second, the B2B exemption is narrower than it looks and, per compliance guidance on CASL's business exemptions, is often mistakenly over-applied. Most B2B outreach still needs consent, clear sender identification, and a working unsubscribe.

For anyone choosing a growth provider, the practical question isn't "are you CASL compliant?" It's which regulator's rules each part of the campaign touches. Worqd's permission-aware outreach and explicit-consent booking funnel address the CRTC side of that map, and the rest of the campaign has to hold up against the other two.

The Three Things the CRTC Doesn't Touch

Most marketers assume the CRTC oversees all of Canadian marketing law. It doesn't. The CRTC's actual mandate is narrow, and three big compliance areas sit entirely with other regulators.

The clearest map comes from the Office of the Privacy Commissioner of Canada, which spells out the division of labour in its CASL compliance guide. Here's what falls outside the CRTC's hands:

• How you collect email addresses and personal data. PIPEDA governs the collection, use, and disclosure of personal information, including email addresses. PIPEDA prohibits address harvesting, with very limited exceptions. The CRTC handles the sending of messages; the OPC handles how you got the addresses in the first place.
• The accuracy of your marketing claims. False or misleading representations and deceptive marketing practices are enforced by the Competition Bureau under the Competition Act. The penalties are real: Cineplex was ordered to pay over $38.9 million for drip pricing through a mandatory $1.50 online booking fee, and Keurig Canada paid a $3 million penalty.
• Privacy practices in commercial activity generally. The OPC shares this responsibility with the CRTC and the Competition Bureau, which means day-to-day privacy compliance sits mostly outside the CRTC's mandate.

Even within CASL itself, the CRTC's job is limited to three things: the sending of unsolicited commercial electronic messages, the alteration of transmission data, and the installation of software without consent. Everything else in e-marketing compliance involves a different regulator.

One honest caveat: no official source publishes a complete list of what the CRTC doesn't regulate. The boundaries above are drawn from the OPC's explicit division of authority, not from an exhaustive exclusion list. That's worth knowing before you treat this as legal advice.

This matters when you're choosing a provider. If an agency sends emails on your behalf, you stay liable under CASL for the sending, and you remain accountable under PIPEDA for how your supplier collected addresses. Both regulators' rules apply to you, not just the CRTC's. It's why we at Worqd build our B2B outreach around explicit, permission-aware consent rather than assuming the rules stop at the sending stage.

The practical takeaway: when you evaluate a marketing partner, ask how they handle consent records, data collection, and claim accuracy. A provider can be compliant on one axis and exposed on the other two.

The Traps That Catch Marketers Anyway

Three misconceptions about Canadian marketing law create more risk than any actual gap in the CRTC's mandate. Each one assumes the CRTC is the only regulator that matters, and each one is wrong in a way that costs money.

Start with the B2B exemption. Many marketers treat business-to-business outreach as outside CASL entirely, but the exemption is narrower than that, and according to compliance guidance from Global Relay, it "is often mistakenly over-applied." CASL still covers most B2B messages, which must satisfy consent, sender identification, and a working unsubscribe mechanism.

Then there's the agency handoff. Hiring a vendor does not move the liability. Under CASL, the primary organization stays liable for messages a vendor sends on its behalf, and under PIPEDA, the same organization remains accountable for how a supplier collected the addresses in the first place, as the Office of the Privacy Commissioner of Canada sets out. This is why Worqd builds outreach around permission-aware contact and an explicit consent step in its booking funnel.

The third trap is the belief that digital channels sit outside regulation. They don't:

• The Online Streaming Act, enacted in April 2023, extended CRTC authority to social media broadcasting and online streaming services.
• CASL's electronic messaging rules cover emails, texts, and social media messages that encourage commercial activity.
• The CRTC also enforces consent requirements before installing software on another person's device.

What the CRTC does enforce carries real weight. Maximum CASL penalties reach $10,000,000 for organizations, unsubscribe requests must be honored within 10 business days, and 2025 fines for message rule violations ranged from $5,000 to $250,000.

The lesson for anyone checking a provider's compliance practices: compliance on one axis says nothing about the others. Collection sits with PIPEDA, claim accuracy sits with the Competition Act, and the primary organization keeps the liability no matter who hits send.

How to Vet a Provider Across All Three Regulators

A growth provider can tick every CASL box and still expose you to PIPEDA or Competition Act risk. The three regulators don't overlap, and a vendor who only thinks about one of them leaves the other two wide open.

Start by asking where they get their contact lists. The CRTC doesn't police how email addresses are collected; the Office of the Privacy Commissioner of Canada makes that division explicit. PIPEDA, not CASL, governs the collection, use, and disclosure of personal information, including addresses. So if your provider scrapes LinkedIn, buys a list, or pulls from a third-party database without documenting consent at the point of collection, the CRTC can't save you. Ask to see the consent trail for every list source, not just the unsubscribe mechanism.

Then check the claims. The Competition Bureau, not the CRTC, prosecutes false or misleading representations under the Competition Act. Recent penalties have hit $38.9 million for drip pricing at Cineplex, $9 million against Facebook, and $5 million against FlightHub. If a provider promises "10x ROI," "guaranteed leads," or shows testimonials you can't verify, that's a Competition Act exposure sitting on your brand, not a CASL issue.

Finally, confirm the sending side. CASL still requires explicit or implied consent, working sender identification, and an unsubscribe processed within 10 business days. Maximum penalties run to $1 million for an individual and $10 million per violation for a corporation, and 2025 CRTC fines for CEM breaches ranged from $5,000 to $250,000.

A practical checklist for any vendor conversation:

• Where did each address on the list come from, and can you show the consent record?
• What proof backs every testimonial, case study, and conversion claim in your pitch deck?
• How do you handle unsubscribe requests, and what's your documented turnaround time?
• Do you rely on the B2B exemption? If so, how do you confirm a relevant relationship exists?
• Who carries liability if the OPC or Competition Bureau comes calling: you or us?

That last question matters most. Hiring an agency doesn't shift the risk. Under CASL, the primary organization stays liable even when a vendor sends on its behalf, and under PIPEDA, you're accountable for your supplier's address-collection practices. The vendor can be your partner in compliance, but the fine, the investigation, and the reputational hit land on you.

Worqd builds permission-aware outreach around explicit consent and uses clearly marked placeholders until real evidence is approved, which keeps the CRTC and Competition Act axes covered from the first message. If you want to see how that looks in practice, book a growth call and we'll walk through the compliance posture before any campaign goes live.

Compliance as a Growth Advantage

Compliance gets treated like a cost centre, but the businesses that handle it well find it pays them back in booked calls. Permission-aware outreach simply performs better than a template blast, because it reaches people who actually want to hear from you.

Consider what clean practice looks like day to day. You capture explicit consent at the point of collection, you keep records you could actually produce if asked, and you make unsubscribing work the first time someone clicks. Under CASL, unsubscribe requests must be processed within 10 business days, and the maximum penalty for a violation runs to $10,000,000 for organizations. Those aren't small numbers, and they're easier to avoid than most marketers assume.

The day-to-day habits that keep you clean:

• Explicit consent captured at the moment of collection, not inferred later
• Consent records you can verify and produce on request
• Unsubscribe mechanisms that work immediately and reliably
• Honest reporting, with no invented numbers in your claims

That last point matters more than it sounds. False or misleading representations fall under the Competition Act, not the CRTC, and the Competition Bureau enforces them with real money: Cineplex was ordered to pay over $38.9 million in penalties and costs for drip pricing. Evidence-backed claims build trust the Competition Bureau never has to question, which is why Worqd's anti-fabrication policy matters beyond marketing: it's risk management too.

Here's the part most businesses miss. Hiring an agency doesn't transfer your compliance risk. The primary organization stays liable under CASL even when a vendor sends on its behalf, and stays accountable under PIPEDA for how a supplier collected addresses. That's the provider question worth asking before you sign anything.

Your next step is a growth call to review how you handle leads against all three regulators' rules. Bring your capture process, your consent records, and your current claims. More demand and faster follow-up only compound when the foundation underneath them is clean.