Using Customer Data for Marketing Legally in Canada: The CASL and PIPEDA Line

A Toronto fitness studio I talked to last year bought an email list. Twelve thousand "opted-in leads" for $400. They blasted a launch promo, felt clever for about a week, then got a complaint forwarded from the CRTC. Under Canada's Anti-Spam Legislation, the penalty for that kind of thing tops out at $10 million per violation for a business (it's $1 million for an individual). They settled quietly and learned an expensive lesson: in Canada, the list you didn't build is a liability, not an asset.

That's the part most marketers get backwards. They treat customer data like fuel to burn as fast as possible. The law treats it like something you borrowed from the person it describes, and you're expected to give it back the moment they ask. Get that framing right and most of CASL and PIPEDA stops feeling like a trap.

CASL and PIPEDA are two different leashes

People lump these together and then comply with neither properly. They govern different things.

CASL is about the *channel*. It regulates commercial electronic messages: email, SMS, some social DMs. Before you hit send, you generally need consent, you need to identify yourself, and you need a working unsubscribe that you honour within 10 business days. The CRTC enforces it, and it has teeth that PIPEDA's regulator can only dream about.

PIPEDA (and Quebec's Law 25, which is stricter) is about the *data itself*. How you collect it, why, whether you told the person, whether you're using it for the purpose they agreed to. The Office of the Privacy Commissioner of Canada oversees PIPEDA federally; the Commission d'accès à l'information (CAI) handles Quebec. PHIPA covers health information in Ontario, enforced by the IPC.

So a single marketing email can break both at once. The send breaks CASL if you lacked consent. The targeting breaks PIPEDA if you used purchase history the customer never agreed to let you mine. Two different problems, two different regulators, and "but they were already a customer" is not a defence for either.

The consent that actually counts

Here's where the fitness studio went wrong, and where most small businesses do too. CASL recognizes two flavours of consent, and they are not equal.

Express consent is someone affirmatively saying yes: a ticked box (un-ticked by default), a form submission, a checkout opt-in worded clearly. It doesn't expire. It's the gold standard, and it's the only thing that survives an audit cleanly.

Implied consent is the grey zone, and it's where companies fool themselves. You have implied consent if someone bought from you or held a contract with you in the last 24 months, or made an inquiry in the last 6 months. After that window closes, the consent is gone. That trial user who downloaded a whitepaper 14 months ago? You can't email them a promo today unless they gave you express consent. The business relationship clock ran out.

The bought list had neither. No express opt-in, no relationship, no defence. Buying or harvesting addresses is the one thing CASL treats as flatly indefensible, and the CRTC has gone after data brokers and the buyers both.

Implied consent is a countdown timer, not a permanent right. The day you stop tracking when it started is the day you've lost the audit.

What using customer data for marketing legally Canada allows is more than you'd think

I want to be fair here, because the fear runs hotter than the reality. The rules reward businesses that are organized rather than punishing them for being ambitious.

You can email your active customers. You can segment them by what they bought, when they bought, what they clicked, and how much they spent. You can personalize. PIPEDA's actual standard is that you collect and use personal information for purposes a reasonable person would consider appropriate in the circumstances, and that you got meaningful consent for those purposes. Recommending running shoes to someone who just bought running shoes clears that bar without breaking a sweat.

The catch is the identify-yourself and purpose-match part. Every commercial message needs your real business name, a physical mailing address, and a way to contact you. The data you use to target has to connect back to a purpose the customer reasonably understood. If your signup form said "we'll email you about your account," you don't get to silently feed that profile into a third-party ad network. That's a purpose they never agreed to.

Where personalization quietly becomes a violation

This is the line that trips up sophisticated marketers, the ones doing everything "right" on the consent side.

Personalization based on data the customer gave you for that purpose is fine. Personalization based on data you inferred, scraped, or repurposed is where you cross over. A few concrete examples of the wrong side:

• Enriching your CRM with data bought from a broker, then targeting based on it. The customer never consented to that profile existing.
• Drawing health-adjacent inferences (someone bought pregnancy products, so you market baby gear). In Ontario that can stray toward PHIPA territory; everywhere it's a meaningful-consent failure.
• Cross-device tracking and lookalike audiences built from your customer list without disclosing it in your privacy policy.
• Quebec's Law 25 requires you to disclose when you use personal information to build a profile and to let people opt out of decisions made solely by automated processing. Score or segment Quebec residents algorithmically without telling them, and you've been offside since those provisions took effect in September 2023.

The test I give clients is blunt: could you explain, to the customer's face, exactly how you knew to send them this? If the honest answer involves a data broker, a tracking pixel they never noticed, or an inference they'd find creepy, you've drifted from personalization into surveillance. Regulators apply almost that same reasonableness standard.

Segmentation is fine. Surveillance is not.

Segmentation done with first-party, consented data is the safest, most effective marketing there is, and Canadian law genuinely encourages it over spray-and-pray. Split your list by purchase recency. Suppress people who haven't engaged in a year. Send the lapsed-customer win-back only to those still inside the 24-month implied-consent window, and route everyone outside it to a re-permission campaign instead of a promo.

What you cannot do is treat segmentation as a license to combine every data point you can scrape into a single profile and act on it. Law 25 made the direction of travel explicit: consent must be granular, and where confidentiality settings exist, they have to default to the most privacy-protective option. Less inferred data, more explicit permission, clearer records.

And records are the whole game. When the CRTC or OPC comes asking, the question is never "did you mean well." It's "show me the consent." You need to prove, per contact, what kind of consent you hold, when you got it, through which channel, and when any implied-consent clock started ticking. Spreadsheets fall apart at this the moment you pass a few thousand contacts, because consent state changes constantly and nobody updates the sheet.

Build the paper trail before you need it

Most CASL and PIPEDA trouble isn't malice. It's businesses that grew faster than their record-keeping. The launch promo goes out, three people complain, and suddenly you're being asked for documentation that was never captured in the first place. By then it's a defence you can't mount.

The fix is unglamorous: capture consent at the moment it's given, timestamp it, store the source, track the implied-consent windows automatically, and make unsubscribe instant and permanent across every list. Do that and marketing to your own customers becomes low-risk and high-return. Skip it and every campaign is a small bet against a $10 million ceiling.

If you'd rather not hand-build that infrastructure, Valdra keeps a per-contact, audit-ready record of marketing consent and CASL status so you can segment and send with proof behind every name. Set up your CASL consent records here.