The short answer: yes, texting customers is legal in Canada, but Canada's Anti-Spam Legislation covers text messages the same way it covers email, and it works on opt-in rather than opt-out. The distinction that decides almost every case for a local business is purpose. An automated reply to someone who just called you, an appointment reminder, or a "the tech is on his way" text is carrying out a transaction the customer started. A promotional blast to a list of past customers is a commercial electronic message, and it needs consent, sender identification, and a working unsubscribe. Implied consent lasts 24 months after a purchase and 6 months after an enquiry.
Almost every automation I set up for a local business sends a text at some point. The missed-call reply, the booking confirmation, the review request, the quote follow-up. So the question comes up on nearly every project, usually phrased as "wait, am I allowed to do this?"
You are. But the rules are worth ten minutes of your attention, because the penalties attached to CASL are large enough to be alarming and the compliance work is small enough to be annoying that anyone skips it.
This is not legal advice. It is the practical version I give clients before we turn anything on. Anything unusual, ask a lawyer.
What CASL actually covers
Canada's Anti-Spam Legislation applies to commercial electronic messages — and that includes text messages, instant messages and social messages, not just email. People consistently assume it is an email law. It is not.
The other thing people get backwards: CASL is opt-in. The American CAN-SPAM regime lets you message people until they opt out. Canada does not. You need consent before the message goes out.
A commercial electronic message is one whose purpose — or one of whose purposes — is to encourage participation in commercial activity. That definition is doing all the work, and it is where the useful line sits.
The line that matters: transactional or promotional
| Message | What it really is | Practical read |
|---|---|---|
| "Sorry I missed your call, I'm on a job — what do you need?" | A reply to an enquiry the customer started | The customer initiated contact; you are answering |
| "Your appointment is confirmed for Thursday at 2pm" | Carrying out a service they booked | Transactional |
| "Ryan is on his way, ETA 20 minutes" | Service delivery | Transactional |
| "Your invoice is ready, here's the link" | Completing the transaction | Transactional |
| "Thanks for the work — mind leaving a review?" | Grey area, leans promotional | Send under consent, add an opt-out |
| "Spring furnace tune-up special, $99 this month" | Marketing | Clearly a commercial electronic message |
The pattern: the customer started it and you are finishing it versus you started it and you want them to buy something. The first is the substance of a missed-call text-back or a booking system. The second is a marketing list, and marketing lists are what CASL was written about.
Most owners worry about the wrong half. They fret about the automated reply, which is a response to a customer who literally just dialled their number, and think nothing of the "hey everyone, we do gutters now" blast that goes to 400 old numbers.
The two kinds of consent
Express consent is someone actively agreeing to receive your messages — ticking a box that is not pre-ticked, texting a keyword to join, telling you in person and having it noted. It does not expire, and it can be withdrawn at any time.
Implied consent comes from an existing business relationship, and it has a clock:
- 24 months from the customer's most recent purchase, contract, or accepted business deal
- 6 months from an enquiry about a contemplated purchase
So a customer whose furnace you replaced last spring is inside the window. Someone who asked for a quote fourteen months ago and never booked is not. A list you have been adding to since 2019 has a lot of expired implied consent in it, and no way to tell which rows without checking.
That is the actual risk for a local business: not the automation, the old list.
What every promotional message needs
Three things, and none of them are hard:
- Identify yourself. Your business name, and the name of anyone the message is sent on behalf of. Not just a phone number the recipient does not recognise.
- Give contact details that stay valid for at least 60 days. A mailing address plus a phone number, email, or web address.
- Include a working unsubscribe. It must be easy to use, and requests must be honoured without delay — in any event within 10 business days.
On SMS the practical version is short: "Reply STOP to opt out" on promotional messages, your business name in the message, and a system that actually removes people when they reply STOP. Check that last part rather than assuming — I have seen platforms where the opt-out logs the reply and does nothing else.
The penalties, in perspective
CASL's maximum administrative monetary penalties are $10 million per violation for a business and $1 million for an individual. That figure gets quoted a lot, usually by companies selling compliance software.
Real outcomes look different. CRTC actions against ordinary businesses have generally landed in the thousands to low hundreds of thousands, through undertakings rather than maximum penalties. Enforcement is complaint-driven — someone has to be annoyed enough to report you.
That is not a reason to ignore it. It is a reason to be calm about it. The exposure for a Kamloops trades business texting its own customers responsibly is low. The exposure for one that buys a list and blasts it is real.
How to set this up so it stays legal
Four decisions, made once:
- Split transactional from promotional in your system. Booking confirmations, on-the-way texts and replies to enquiries run on one path. Anything that promotes something runs on another, with consent tracking attached. Most automation platforms support this; almost nobody configures it.
- Start capturing express consent now. One unticked checkbox on your booking form and quote form: "Text me occasional offers and service reminders." From then on, the promotional list is clean and you stop having to reason about implied-consent clocks.
- Date your list. If you cannot tell when someone last bought from you, you cannot tell whether implied consent has expired. Your CRM or booking tool already knows this; use it to filter.
- Put your name and an opt-out on anything promotional. It costs eleven characters and removes the entire category of problem.
That is the whole compliance job for a typical local business. It takes an afternoon, once.
Where this leaves your automation
Nothing in CASL argues against the automations that make a local business money. Missed-call text-back responds to someone who just called you. Quote follow-up continues a conversation about a job the customer asked you to price. Booking confirmations and reminders are the service itself.
Review requests sit closest to the line, which is why I set them up to go to recent customers with an opt-out line rather than to everyone who has ever paid an invoice. Asking for reviews properly works better that way regardless of the law — a request to someone who remembers you gets a much better response rate than one to a stranger from three years ago.
CASL governs the message. A separate question governs the messenger: whether you have to tell the customer that an AI wrote it or answered the phone. The short version is that no Canadian law requires it yet, and the rules that do bind a BC business are about the impression rather than the technology.
If you want the number that justifies setting any of this up in the first place, the missed-call calculator shows what unanswered enquiries cost you in a year. When I build AI automation for a Kamloops business, the consent structure is part of the setup rather than something to sort out later.
Common questions
Does CASL apply to text messages? Yes. CASL covers commercial electronic messages sent by email, SMS, instant message and social messaging. It is not an email-only law, and the same consent, identification and unsubscribe rules apply to a promotional text.
Do I need consent to reply to a customer who called me? Replying to someone who just contacted you is answering an enquiry they started, not sending a marketing blast. The compliance question attaches to promotional messages you initiate. Automated missed-call replies, booking confirmations and on-the-way texts are transactional in substance.
How long does implied consent last under CASL? 24 months from the customer's most recent purchase, contract or accepted business deal, and 6 months from an enquiry about a contemplated purchase. Express consent has no expiry but can be withdrawn at any time.
What has to be in a promotional text? Your business name, contact details that remain valid for at least 60 days, and a working unsubscribe that is honoured without delay and in any event within 10 business days. On SMS that usually means your name plus "Reply STOP to opt out".
What are the penalties for breaking CASL? Maximum administrative monetary penalties are $10 million per violation for a business and $1 million for an individual. Actual CRTC outcomes against ordinary businesses are typically far smaller and usually arrive as undertakings, and enforcement is complaint-driven.
The honest summary
Text your customers. Answer their calls automatically, confirm their bookings, tell them when you are on the way. That is service, and it is the part of automation that makes you money. Keep promotional messages on a separate list built from people who said yes, put your name and an opt-out on them, and stop texting the 2019 spreadsheet. That is the whole thing.
Written by Jagatjeet — Jagatjeet (jagatjeet.com) is a web design, local SEO and AI automation studio in Kamloops, British Columbia, serving the Thompson-Okanagan and BC Interior. Published 13 August 2026. Last updated 13 August 2026. General information about Canadian anti-spam rules, current at the date of publication — not legal advice.