One Text Message, Ten Million Dollars: What CASL Actually Asks of Your Salon

Here is a sentence that should get your attention: the maximum administrative monetary penalty under Canada's Anti-Spam Legislation is $10 million per violation for a business, and $1 million for an individual. Directors and officers can be held personally liable.

Nobody is going to fine a four-chair salon in Vaughan ten million dollars. But the enforcement floor is a lot lower than the ceiling — CRTC settlements in 2025 landed in the $5,000 to $250,000 range for ordinary small and mid-sized senders, and the Commission logged over 152,000 spam complaints in a single six-month stretch. The number that should actually worry you is the small one, because it's the one that's reachable.

And most salon marketing, as it is actually practised in this country, is not compliant.

CASL isn't an email law

The first misunderstanding is scope. CASL governs commercial electronic messages — any message that encourages participation in a commercial activity. Email counts. So does SMS. So does a direct message on a social platform.

An appointment reminder is generally transactional, not commercial, and sits outside the marketing rules. “We're running 20% off colour this month” is unambiguously commercial, whatever channel it arrives on. If your salon sends promotional texts, CASL applies to your salon.

The law follows the recipient, not the sender. If the message is accessed on a device in Canada, CASL is in play regardless of where your business or your software is based.

Express, implied, and the clock

Every commercial message needs consent — either express or implied. The difference matters more than most owners realise.

Express consent is an affirmative opt-in. The client checked a box, filled in a form, confirmed a subscription. A pre-checked box does not count. Express consent doesn't expire; it stays valid until the person withdraws it. You need to record the date, the method, the exact wording the client saw, and the source.

Implied consent is a narrow exception on a timer. The two situations that matter for a salon: an existing business relationship — a client who purchased a service or product from you gives implied consent for two years from that transaction — and an inquiry, where someone who asked you about a service gives implied consent for six months.

Read that first one again, because it's the one that quietly breaks. A client who came in twice in 2023 and hasn't been back since is off your list. Not “should probably be pruned for deliverability” — off it, as a matter of law.

The practical answer is to convert implied to express before the clock runs out. Two or three months ahead of the two-year mark, send a message under your still-valid implied consent asking the client to expressly opt in. It's a good deliverability habit and it happens to be the compliance move.

The three things every message needs

Consent is necessary but not sufficient. Every commercial message must also identify you — the recipient has to be able to tell who sent it, salon name included, and if you're sending on someone's behalf, that relationship too. It must give contact information: a mailing address and a working phone, email, or web address, valid for at least 60 days after the message goes out. And it must provide a functioning unsubscribe, honoured within 10 business days, with the mechanism live for at least 60 days after sending.

Miss one and the message is non-compliant even if the other two are perfect and your consent is immaculate.

The import trap

This is the one that catches salons switching software, and it catches them at the exact moment they feel most productive.

You've moved platforms. You export 2,400 client records from the old system and import them into the new one. The new platform has a lovely campaign builder. You write a “we've moved to a new booking system!” email and hit send to all 2,400.

Several hundred of those clients last visited more than two years ago. You have no consent for them. You have just sent several hundred non-compliant commercial electronic messages, and — critically — the burden of proving consent sits with you, the sender, not with the recipient to disprove it.

A client record is not consent. A phone number is not consent. Consent is a documented event with a date attached, and if your old platform didn't capture it, importing the record doesn't manufacture it.

The right move on migration is unglamorous: segment on last-visit date, send only to clients inside the two-year window, and use that send to collect express consent from everyone else. You'll email fewer people. You'll also still have a business.

What “records” actually means

The most common failure isn't sending without consent. It's sending with consent you can't evidence. If the CRTC asks, “we're pretty sure she opted in” is not an answer.

For every contact on your marketing list you want: the consent type, the date it was given, how it was given, the wording displayed at the time, and a log of any unsubscribe. Held somewhere that survives a platform change.

This is precisely why NeonO tracks consent as a first-class field on the client record — captured at the point of booking, timestamped, with the displayed wording versioned, and exportable with the rest of your data. Consent that lives only inside a marketing tool you might leave next year isn't a record. It's a rental.

This article is general information about Canadian anti-spam rules, not legal advice. CASL obligations depend on your specific sending practices. Consult Canadian counsel for your situation, and refer to CRTC and ISED primary guidance.

Related reading: The Tip Trap · Marketing & Email · Security & privacy