CASL and the Solo Founder: $10M in Penalties You Can Avoid
You send a promotional email to 200 Canadian prospects you met at a networking event. No one unsubscribed. No one complained. CASL still applies. Canada's Anti-Spam Legislation carries penalties up to $10 million per violation for individuals. The first violation does not need to be intentional. Sending a commercial electronic message without express consent, missing an unsubscribe mechanism, or omitting your sender identity — any of those triggers enforcement.
CASL applies to any commercial electronic message sent to an electronic address — email, SMS, social media direct message — where the message encourages participation in a commercial activity. A solo founder sending a newsletter with a link to book a strategy session is sending a CEM. A follow-up email with a pricing sheet is a CEM. A LinkedIn message offering a free consultation call is a CEM.
The core requirements are three. First, express consent. The recipient must have opted in — checked a box, signed a form, or explicitly agreed to receive commercial messages from you. Implied consent exists for existing business relationships (client within the past two years), but it is weaker and expires. If a recipient has not bought from you or inquired, you need express consent before sending anything promotional.
Second, sender identification. Every message must include your name, business name, mailing address, phone number or email, and a clear statement identifying the message as a commercial communication. A solo founder operating as a sole proprietor uses their legal name and business address. An incorporated founder uses the corporation's name and registered address. Place this information in the email footer.
Third, an unsubscribe mechanism. Every message must include a functioning unsubscribe link or reply-to address that processes the request within 10 business days. No login required. No additional steps. The mechanism must remain active for 60 days after the message is sent. Failing to honor an unsubscribe within 10 days is a separate violation.
The penalties are not theoretical. CRTC issued a $200,000 penalty to a Quebec-based company in 2020 for sending commercial emails without consent. While enforcement against individual solopreneurs is less common, the CRTC's compliance bulletin from 2023 confirms 67 investigations and 12 notices of violation across small and medium businesses in the prior three years. The risk scales with list size, but the requirement applies at list size one.
The practical workflow for a solo founder: use a reputable email service provider that handles CASL compliance in its platform — Mailchimp, ConvertKit, ActiveCampaign, and Flodesk all include mandatory unsubscribe links, sender identity fields, and consent tracking. A solo founder sending emails from their personal Gmail or Outlook account is the highest-risk setup. No unsubscribe mechanism, no sender identity block, and no consent record. Switch to a platform before your list hits 50 contacts.
Consent records must be kept for three years from the date consent is given. A simple spreadsheet with the date, method (web form, in-person sign-up, email request), and the specific consent language meets the documentation requirement. The CRTC can request these records during an investigation. Not having them is treated as evidence that consent was not obtained.
The existing business relationship exception covers messages sent within two years of the recipient's last purchase or six months after an inquiry. A client who paid you for a strategy session in June 2025 can receive commercial emails until June 2027. After that, express consent is required. A prospect who emailed you asking about services in January 2025 can receive messages until July 2025. The clock starts from the last interaction, not the first.
The referral exception is narrow. If a friend gives you their friend's email and says "contact them about your services," you cannot send a commercial message under CASL unless the friend is the recipient's representative. The correct approach: ask the friend to introduce you via email, which gives the recipient the opportunity to consent. No introduction, no message.
Scelvara Lounge includes a CASL compliance audit in every Solo Strategy Canvas session where the founder uses email marketing. We check three things: consent collection method (opt-in checkbox or implied only?), sender identification in email footer (complete or missing elements?), and unsubscribe mechanism (active and processing within 10 days?). The audit takes fifteen minutes. The non-compliance risk addressed: $10 million. The takeaway: CASL enforcement targets the message, not the sender size. A solo founder with a list of 200 needs the same compliance as a corporation with 200,000.