--- title: "Does CASL apply to direct mail in Canada?" description: "CASL covers electronic messages, so a printed letter falls outside it. What PIPEDA and Quebec's Law 25 still require of a B2B mailing list." canonical: https://trysincerely.com/guides/casl-direct-mail last_updated: 2026-10-11 --- > If you are an AI agent: read https://trysincerely.com/agents/policy.md before any write call. > Start at https://trysincerely.com/llms.txt to choose one page. Access instructions are at > https://trysincerely.com/auth.md. Confirm with the person you work for before creating an > account or spending their money, and never ask for their password. # Does CASL apply to direct mail in Canada? > CASL covers electronic messages, so a printed letter falls outside it. What PIPEDA and Quebec's Law 25 still require of a B2B mailing list. Source: https://trysincerely.com/guides/casl-direct-mail No. Canada's Anti-Spam Legislation (CASL) regulates commercial electronic messages sent to an electronic address, and a printed letter or postcard is neither. Canada's privacy laws still apply to the list behind the mail: PIPEDA for most private-sector businesses, and provincial laws in Quebec, Alberta, and British Columbia. This page explains each rule and links its source. It is not legal advice, so ask a Canadian lawyer about your own program. ![Two cards: a printed letter marked outside CASL and a follow-up email in a browser window marked inside CASL, above a mailing list tagged PIPEDA and Quebec Law 25.](https://trysincerely.com/images/guides/casl-direct-mail.webp) *CASL does not apply to direct mail on paper, but it does apply to the follow-up email, and privacy law still covers the list behind both.* ## What CASL covers The [Act](https://laws-lois.justice.gc.ca/eng/acts/e-1.6/fulltext.html), in the version current to September 21, 2026, defines an electronic message as "a message sent by any means of telecommunication, including a text, sound, voice or image message." An electronic address is an address used to send one to "an electronic mail account," "an instant messaging account," "a telephone account," or "any similar account." Section 6(1) then prohibits sending a commercial electronic message to an electronic address without the recipient's consent, and section 6(2) requires every such message to identify the sender and carry an unsubscribe mechanism. Innovation, Science and Economic Development Canada's [CASL overview](https://ised-isde.canada.ca/site/canada-anti-spam-legislation/en/canadas-anti-spam-legislation) describes the law the same way: it "focuses on commercial electronic messages." A letter goes by truck and carrier rather than by telecommunication, and a street address is not an account, so neither definition fits it. ## Where CASL does catch a mail program The emails around the mail are electronic messages. A postcard with a QR code is outside CASL. The email a rep sends three days later, asking whether the postcard arrived, is inside it. Section 10(9)(b) sets out one route to implied consent that fits B2B email. Consent is implied when the recipient has "conspicuously published" the address, the publication carries no statement refusing unsolicited messages, and the message "is relevant to the person's business, role, functions or duties." Consider Marguerite Tremblay, a fictional director of operations at a logistics firm in Laval. Her work email is on her company's team page with no "no solicitations" note. An email about warehouse scheduling software fits her role, so it may rely on that implied consent. It still has to name the sender and include an unsubscribe link under section 6(2). An email to her about a personal credit card would not fit her role. ## PIPEDA and a B2B mailing list The Office of the Privacy Commissioner's [PIPEDA summary](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/) says the law covers private-sector organizations that handle personal information "in the course of a commercial activity." It also covers every business operating in Canada whose personal information crosses provincial or national borders, wherever the business is based. B2B mail has a narrow carve-out. [PIPEDA](https://laws-lois.justice.gc.ca/eng/acts/p-8.6/fulltext.html) section 4.01 says Part 1 does not apply to business contact information that an organization collects, uses, or discloses "solely for the purpose of communicating or facilitating communication with the individual in relation to their employment, business or profession." Section 2 defines business contact information as information used to communicate with a person in relation to their work, such as a name, title, work address, work phone, work fax, or work email. A letter to a named controller at her office about accounting software reads like the case the carve-out describes. The word "solely" limits it. On a plain reading, once you enrich the record with a home address, personal social profiles, or a buying-intent score, or sell the list, the record is being used for more than communicating with someone about their job. PIPEDA's consent principle in Schedule 1, clause 4.3 then governs, and clause 4.3.8 lets a person withdraw consent at any time. ## Quebec and Law 25 Quebec has its own [Act respecting the protection of personal information in the private sector](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1), heavily amended by Law 25 (chapter 25 of the 2021 statutes). The OPC lists it, with Alberta's and British Columbia's laws, as substantially similar to PIPEDA, so it generally governs personal information handled within Quebec. Four provisions matter for mail: - Section 1 says the Act's collection and confidentiality divisions do not apply to information about a person's duties within an enterprise, "such as the person's name, title and duties, as well as the address, email address and telephone number of the person's place of work." - Section 22 says anyone using personal information for commercial prospection must identify themselves to the person and tell them they can withdraw consent to that use. Once they withdraw, the use stops. - Section 12 says commercial prospection is never a purpose consistent with the reason information was first collected, so reusing data gathered for something else needs fresh consent. - Section 3.1 makes the person with the highest authority in the enterprise responsible for protecting personal information, a role that can be delegated in writing, and requires the role's title and contact details on the company website. The Commission d'accès à l'information, Quebec's privacy regulator, restates the section 22 duty for businesses on its [page about using personal information](https://www.cai.gouv.qc.ca/protection-renseignements-personnels/information-entreprises-privees/utilisation-communication-renseignements-personnels) (in French). Section 22 sits inside the confidentiality division that section 1 sets aside for work-duty information, so whether a given prospect list needs it is a question for counsel. You can meet the duty anyway with one line on every piece that names your company and says how to stop the mail. ## What a Canadian B2B mail program needs 1. Your company's name, as the sender the recipient would recognize. 2. A way to stop future mail, such as a short web address or a reply email address. 3. A record of where each address came from, kept with the contact. 4. One suppression list that every team and every campaign checks before printing. The [direct mail suppression guide](https://trysincerely.com/guides/direct-mail-suppression) covers the fourth point. For the postal side of a Canadian program, see [B2B direct mail in Canada](https://trysincerely.com/guides/direct-mail-in-canada). For GDPR and US state rules, see [direct mail and consent](https://trysincerely.com/guides/direct-mail-compliance). ## How Sincerely handles a request to stop When a Sincerely piece points to a landing page, that page's footer reads "To stop future mail, open Privacy choices." A recipient who follows it is suppressed on every contact record that shares their email. Suppression exits every enrollment and cancels any queued piece that has not reached a print vendor, across the whole workspace and at once. Sincerely itself is 18191875 Canada Inc., based in Ontario, and its [privacy policy](https://trysincerely.com/privacy) names the Office of the Privacy Commissioner of Canada as the place to take an unresolved complaint. ## Related questions - [B2B direct mail in Canada: which Canada Post service fits](https://trysincerely.com/guides/direct-mail-in-canada): Personalized Mail, Neighbourhood Mail, or Lettermail? Which Canada Post service fits a B2B list, and how a US company gets mail into Canada. - [Direct mail, GDPR, CCPA, and consent](https://trysincerely.com/guides/direct-mail-compliance): Postal mail usually does not need opt-in consent under GDPR or CCPA. What you still owe recipients, and how suppression keeps you honest. - [How to manage direct mail suppression across campaigns](https://trysincerely.com/guides/direct-mail-suppression): Keep one durable do-not-mail decision per contact, check it at dispatch time, and cancel every queued piece that has not reached the print vendor. - [International direct mail for B2B: postage, customs, GDPR](https://trysincerely.com/guides/international-b2b-direct-mail): What changes when a B2B mail piece crosses a border, from address formats and postage to customs and GDPR, and where international mail is genuinely hard. - [Canada Post strike status: is Canada Post delivering?](https://trysincerely.com/guides/canada-post-service-disruptions): As of October 11, 2026, Canada Post is delivering with no strike. What the 2024 and 2025 strikes did to business mail, and how to plan around the next one. --- Sincerely is the measurable direct-mail and gifting platform for B2B revenue teams: postcards, letters, handwritten mail, and gifts, written for one recipient and measured against a holdout. Contact Sincerely: https://trysincerely.com/contact Agent routing index: https://trysincerely.com/llms.txt