Why 'Not Regulated by the CRTC' Is Easy to Get Wrong

Most marketers have heard of CASL. Far fewer can say with confidence where the CRTC's authority actually ends, and that gap is where compliance mistakes happen. If you're evaluating an outreach provider, this is one of the first things to pin down.

The fastest way to figure out what falls outside CRTC oversight under CASL is a two-part test from the CRTC's own guidance: a message is caught only if it's both a commercial electronic message (CEM) and sent to an electronic address. If either element is missing, CASL doesn't apply. That's why voice telemarketing calls, faxes, robocalls, website and blog ads, and posts to your own social media accounts sit outside CASL entirely, per the ANA's compliance guide.

Here's where people get tripped up, though. The line between "inside" and "outside" is thinner than it looks:

• A Facebook wall post isn't covered, but a Facebook Messenger or LinkedIn direct message is an "electronic address" under CASL.
• The B2B exemption is "often mistakenly over-applied" according to Global Relay's analysis; CASL still applies to most B2B communications.
• Political messages are excluded only while they stay non-commercial; add advertising for a commercial activity and section 6 can come back into play.

The bigger mistake is assuming "not CASL" means "not regulated." It doesn't. Voice telemarketing falls under the separate Unsolicited Telecommunications Rules and the National Do Not Call List, which the CRTC also enforces, as CMA programming with senior CRTC officials makes clear. Those rules carry their own obligations: calling hours of 9:00 a.m. to 9:30 p.m. on weekdays, internal do-not-call entries added within 14 days and retained for 3 years and 14 days.

The stakes are real. CASL penalties reach $10,000,000 per violation for organizations, and 2025 CRTC fines for CEM violations ranged from $5,000 to $250,000. There's also an active review underway: M3AAWG has formally intervened in the CRTC's consultation on unwanted-call rules, arguing the telemarketing framework hasn't kept pace with AI-generated voice calling.

When you're choosing a provider, ask how they handle both the channels CASL covers and the ones it doesn't. At Worqd, we treat permission-aware outreach as the baseline across every channel we run, because a provider who only knows where the rules end is the one who eventually finds out where enforcement begins.

What Sits Outside CASL Entirely

Voice calls sit outside CASL, but that doesn't mean they're unregulated. Live and automated telemarketing calls fall under the Unsolicited Telecommunications Rules and the National Do Not Call List, which the CRTC enforces separately from the anti-spam law. If you run AI voice agents for inbound sales or after-hours follow-up, this is the rulebook that actually applies to you, and it's in active review: the UTR framework hasn't been substantively updated since 2014.

A few categories are carved out of CASL entirely:

• Federal, provincial, and territorial government activities, though crown corporations and municipal governments acting commercially still fall under CASL.
• Political messages that aren't commercial in nature, such as texts asking for support or opinions.
• Commercial messages between people with a genuine personal or family relationship. A corporation can't have a personal relationship.
• Websites, blogs, and micro-blogging, since those aren't treated as "electronic addresses."
• Non-commercial push notifications, like weather alerts or security warnings.

Social media is where the line gets sharp. A post on your own Facebook wall isn't captured by CASL, but a direct message sent through Facebook Messenger or LinkedIn messaging does qualify as sending to an electronic address, so the consent and identification rules apply. Same channel, two very different compliance postures.

One caution worth repeating: "not CASL" doesn't mean "not regulated." The B2B exemption is often mistakenly over-applied, and CASL still applies to most business-to-business communications. Registered charities are exempt from DNCL calling restrictions but not from robocall rules, and exempt organizations must still keep internal do-not-call lists.

Privacy sits with the Office of the Privacy Commissioner under PIPEDA, election advertising spending with Elections Canada, and carrier SMS policies with the CWTA. A provider that treats exemptions conservatively, the way Worqd builds consent into every outreach step, tends to be the safer bet.

Want outreach that books calls without compliance headaches? Book a Growth Call and we'll map your lead-handling path, consent-aware and permission-first, from first click to booked call. Every inquiry qualified in under 60 seconds, 24/7, with consent built into every step.

Exemptions That Look Bigger Than They Are

You likely assume that if a message doesn't trigger a CASL violation, it’s entirely off the hook. That assumption creates significant risk. The CRTC’s exemptions are narrower than most marketers believe, and misinterpreting them leads to costly compliance gaps.

Consider the B2B exemption. Many teams treat all business-to-business email as exempt from consent requirements. This is a dangerous misconception. According to Global Relay’s compliance insights, this carve-out is "often mistakenly over-applied." CASL still applies to most B2B communications unless they fall into specific, narrow categories like ongoing business relationships or direct responses to inquiries.

Registered charities face a similar trap. While they are exempt from National Do Not Call List restrictions, this does not grant them total freedom. Charities are not exempt from robocall constraints under the Anti-Spam Act. They must still adhere to calling hours and identification rules. Furthermore, even if exempt from consent, they must maintain internal do-not-call lists and honor opt-out requests within 14 days, as noted by CallHub.

Political messages offer another layer of complexity. The exemption applies only when the message’s primary purpose is not commercial. The moment you include an advertisement or encourage participation in a commercial activity, the exemption vanishes. For example, a fundraising event with a fee brings CASL rules back into play immediately.

Narrower exemptions exist for specific transactional contexts, but they require precision.

• Quotes and estimates sent in response to an inquiry.
• Messages facilitating a transaction, such as order confirmations.
• Refer-a-friend messages, provided the referrer’s full name is included.
• Warranty, recall, or safety information related to a product.

These exemptions are strict. A transactional email cannot contain any commercial content beyond the necessary transaction details. Even a subtle tagline encouraging a future purchase can turn a safe message into a violation.

When you are evaluating a marketing provider, look for how they handle these gray areas. Do they assume B2B emails are safe? Do they treat charity or political exemptions as blanket permissions? A compliant partner treats these rules conservatively.

At Worqd, we build outreach strategies that respect these boundaries. Our approach ensures that every communication is permission-aware and consent-driven, avoiding the pitfalls that catch up teams relying on misinterpreted exemptions. We map your lead-handling path to keep you safe while you scale.

Book a Growth Call to see how we integrate compliance into your growth strategy from the first click to the booked call.

Who Regulates What the CRTC Doesn't

The CRTC's marketing rules cover three frameworks: Canada's Anti-Spam Legislation, the Unsolicited Telecommunications Rules, and the Voter Contact Registry. Everything else belongs to someone else, and knowing which regulator owns which channel is how you judge a provider's full compliance posture.

Privacy is the clearest handoff. Personal information handling under PIPEDA sits with the Office of the Privacy Commissioner, not the CRTC. Election advertising spending limits and third-party communication rules fall to Elections Canada, and carrier-level SMS policies come from the Canadian Wireless Telecommunications Association rather than any government body.

Then there's the gap that matters most right now. The Unsolicited Telecommunications Rules framework hasn't been substantively updated since 2014, according to M3AAWG's intervention with the CRTC, filed under Notice of Consultation 2026-132. Someone can now spin up thousands of AI-generated voice calls with a cloud subscription, a language model, and a phone number list. The rules under review were written for a different era of calling.

For marketers, that gap cuts both ways:

• AI voice agents and AI receptionists operate in actively reviewed territory, so "compliant today" may not mean compliant after the consultation closes.
• A provider that treats the review as a reason to wait is telling you something about how it handles uncertainty.
• STIR/SHAKEN verifies where a call came from, not whether the call is honest or wanted.
• The B2B exemption is "often mistakenly over-applied," per Global Relay's compliance guidance, so most B2B outreach still falls under CASL.

A provider worth trusting maps its own obligations across all four bodies rather than the CRTC alone. At Worqd, B2B outreach is built as permission-aware contact with relevant accounts, and the booking funnel requires explicit consent before any follow-up begins. Ask any vendor which regulator governs each channel they touch. The answer tells you whether they've actually thought about it.

How to Check a Provider's Compliance Practices

You are about to hand over your brand’s reputation to a third party. That requires more than a sales pitch; it demands a forensic look at their operations. When evaluating a growth partner, you need to verify how they handle the specific regulatory gaps that often trip up marketers.

The CRTC’s oversight is not monolithic. It splits across different frameworks depending on the channel. Voice telemarketing calls are not covered by CASL, meaning they fall under separate Unsolicited Telecommunications Rules. This distinction is critical. A provider claiming "CASL compliance" for email does not automatically guarantee they follow the calling rules for phone outreach.

Start by asking how they run B2B outreach. The B2B exemption is often mistakenly over-applied, as compliance analysis notes. Most B2B communications still require consent. Your provider should describe a process of personalized, permission-aware outreach to relevant accounts, rather than template blasts that ignore the nuance of commercial intent.

Next, probe their AI calling tools. If they use AI voice agents, you must know how they handle telemarketing rules. The regulatory guidelines are strict on calling hours. Weekday calls must occur between 9:00 a.m. and 9:30 p.m. Weekend calls are restricted to 10:00 a.m. and 6:00 p.m. Ensure their systems enforce these windows automatically. They must also display accurate caller ID and maintain internal do-not-call lists, adding numbers within 14 days of a request.

Finally, verify their consent tracking. Implied consent has an expiration date. It lasts 24 months after a subscription or transaction ends, and only 6 months after an inquiry. Your provider needs a system that tracks these windows precisely. If they cannot prove they stopped contacting a lead after the consent window closed, they are operating in a gray area that invites penalties.

Here is what to look for in their compliance posture:

• Explicit confirmation that AI voice agents respect strict calling hours and caller ID requirements.
• A documented process for honoring opt-outs within the required 14-day window.
• Proof that consent records are tracked against the 24-month and 6-month expiration clocks.
• Clarity on how they distinguish between commercial electronic messages and exempted personal communications.

At Worqd, we build permission-aware outreach into every step of the lead-handling path. We do not treat compliance as an afterthought; it is the foundation of the system. When you book a call, you agree to be contacted about your specific request. We use that data to prepare for the conversation, not to blast you with generic marketing.

The goal is simple. We help you get more leads and turn them into booked calls without the risk of regulatory missteps. Book a Growth Call to see how we map your lead-handling path, ensuring every interaction is consent-aware and efficient. We test more winning ad creative and revive old leads, all while keeping your brand safe.