WhatsApp Business and CASL: What Canadian Small Businesses Must Know in 2026

CASL in Plain Terms: Why Canadian Businesses Can't Ignore It

Canada's Anti-Spam Legislation (CASL, S.C. 2010, c. 23) came into full force in July 2014. It governs all 'commercial electronic messages'—any electronic message that encourages participation in a commercial activity. That definition covers WhatsApp messages, SMS, email, and even direct messages on social platforms when they have a commercial purpose.

CASL is enforced by the Canadian Radio-television and Telecommunications Commission (CRTC), the Competition Bureau, and the Office of the Privacy Commissioner. Maximum penalties are $1 million per violation for individuals and $10 million per violation for organizations. The CRTC has levied fines against large companies, but it has also pursued smaller businesses. Ignorance of the law is not a defence recognized under CASL.

For a Canadian salon, restaurant, or retail shop using WhatsApp to message clients about appointments, promotions, or new services, CASL is not optional background noise. It is the legal framework every outbound message operates within.

Express Consent vs Implied Consent: The Core Distinction

CASL distinguishes between two types of consent:

Express consent is explicit, documented agreement. The recipient actively opted in—checked a box, signed a form, responded to a consent request—with a clear description of what they were consenting to. Example: a checkbox on your booking form that reads 'I consent to receive appointment reminders and promotional messages from [Business Name] via WhatsApp and other electronic channels.' Express consent does not expire under CASL, but it can be withdrawn at any time.

Implied consent is narrower than many business owners assume. CASL recognizes implied consent in two primary scenarios:
- Existing business relationship: A customer who purchased from you or contracted your services within the past two years. The clock resets with each new transaction.
- Conspicuous publication: The recipient has published their contact information online (website, directory) without stating they do not want commercial messages, AND the message is relevant to their professional role.

Implied consent from an existing business relationship expires after two years of no transactions. After that, you need express consent to continue messaging them.

Practical implication: if a client visited your salon 18 months ago and you have been sending WhatsApp appointment offers since, you have implied consent—but only for another six months. After the two-year mark, you need to get express consent or stop.

What Every CASL-Compliant WhatsApp Message Needs

Every commercial electronic message sent from a Canadian business must contain three mandatory elements under CASL:

1. Identification of the sender
Your business name must appear in the message. A WhatsApp Business profile with your business name set up correctly helps, but the message body itself should be unambiguous. 'Maple Leaf Cuts – your appointment is confirmed' is compliant. An anonymous link with no sender identification is not.

2. Contact information
You must provide a way for the recipient to contact you: a mailing address, or a phone number or email address that will be monitored for at least 60 days after the message is sent. A WhatsApp Business profile showing your business address, email, and phone number satisfies this requirement for most purposes, but the contact information must be functional and current.

3. Unsubscribe mechanism
Every marketing message must include a way to opt out that is 'readily performed'—meaning it works, it is easy to use, and unsubscribe requests are honored within 10 business days. For WhatsApp, a standard approach is: 'Reply STOP to unsubscribe from [Business Name] messages.' Once someone unsubscribes, you cannot send them commercial messages, and you cannot require them to pay a fee or provide personal information to unsubscribe.

Transactional messages—a booking confirmation sent immediately in response to a client's booking—are generally considered non-commercial and do not require the same three elements, though best practice is to include identification and a contact point anyway.

WhatsApp Business Setup for Canadian Compliance

The WhatsApp Business App (free, for solo operators) and the WhatsApp Business Platform (API, for automated messaging at scale) both operate within CASL when you message Canadian numbers. The platform does not handle CASL compliance for you—that is your responsibility.

For Canadian businesses, the recommended setup:

On your intake form (digital or paper): Include a CASL-compliant consent checkbox separate from your service agreement. Separate checkboxes matter: bundling consent to messaging into your terms of service is generally not considered express consent under CASL. The checkbox should read something like: 'I consent to receive appointment reminders and promotional messages from [Your Business Name] via WhatsApp and/or email. I can unsubscribe at any time by replying STOP or contacting us directly.'

On your WhatsApp Business profile: Set your business name, address, email, and phone number. This functions as your identification and contact information under CASL.

In your CRM or booking system: Keep a timestamped record of every consent—who consented, when, via which mechanism (paper form, digital checkbox, email consent request). If the CRTC investigates, you bear the burden of proving consent existed. If you cannot produce the record, the presumption under CASL is that you did not have it.

For existing contacts: If you have clients in your database you have been messaging without documented consent, you can run a consent campaign—a single message (to those with whom you have an existing business relationship within two years) asking them to confirm they want to continue receiving messages. Document their responses.

CASL vs TCPA: If You Have US and Canadian Clients

Many Canadian small businesses also serve US customers—an e-commerce store shipping across the border, a consultant working with US clients, a tourism business that markets to both markets. In that case, both CASL and the US TCPA apply, each to messages sent to phone numbers in the respective country.

The stricter standard applies in practice. CASL is generally considered more demanding than TCPA for marketing consent: CASL requires opt-in consent (you must have consent before sending), while TCPA operates more on an opt-out model for certain message types. If you apply CASL-level consent practices to all your commercial messaging, you will meet TCPA requirements as well.

For WhatsApp specifically: Canada has approximately 19 million WhatsApp users (Statista, 2024), representing about 50% penetration among smartphone users—higher than the US average of ~30%. In large urban centres with significant immigrant communities (Toronto, Vancouver, Montreal), WhatsApp is a natural communication channel for many clients. The consent discipline remains the same regardless of penetration rates.

CASL in Practice: Three Business Scenarios

Scenario 1: A Toronto hair salon
The salon adds a CASL consent checkbox to its Fresha booking page. Each client who books online sees: 'Tick here to receive appointment reminders and seasonal promotions from Salon Name via WhatsApp and email.' The booking system timestamps the consent. Appointment reminders are sent 48 hours before each visit. When a client texts STOP, the system removes them within 24 hours. After two years of no bookings, the salon sends a re-consent message to lapsed clients before continuing to message them. This workflow is CASL-compliant.

Scenario 2: A Vancouver retail shop
The shop owner asks clients verbally at checkout if they want WhatsApp updates about new arrivals. No written record is kept. This is not express consent under CASL. If the CRTC investigates, the business cannot prove consent existed. Even if the client said yes, without documentation it provides no legal protection.

Scenario 3: A Calgary tradesperson
A plumber messages past clients (who booked within the last two years) with a seasonal maintenance offer. This is implied consent from an existing business relationship—compliant, as long as the message includes identification, contact information, and an unsubscribe option, and as long as the business relationship is less than two years old.

The dividing line in every scenario: documentation. CASL compliance is as much a records management question as a legal one.