CASL vs CAN-SPAM for B2B email: how to run one demand generation program across Canada and the US

Canadian companies selling into the US, and US companies selling into Canada, usually run one marketing automation platform and one CRM. If the email rules are set for one country, the program is either too cautious for the US or non-compliant in Canada. Our existing guide to CASL for B2B email covers the Canadian law on its own. This article is about running both.

The facts below come from the CRTC's CASL FAQ and the FTC's CAN-SPAM compliance guide.

The CRTC says CASL generally applies when a message is sent through a computer system in Canada, and that messages sent to Canadian recipients from abroad must also comply. Its FAQ recommends that all commercial messages sent from Canada, even to recipients abroad, meet CASL's requirements. CAN-SPAM covers commercial email to US recipients regardless of whether they are businesses.

In practice that means a Canadian company emailing US prospects should plan for both: CASL because the message is sent from Canada, and CAN-SPAM because the recipient is in the US. A US company emailing Canadian prospects needs CASL consent. Confirm the details for your setup with counsel.

CAN-SPAM governs the email itself. US privacy law governs the data behind it, and it is changing quickly. California's employee and B2B exemptions under the CCPA expired on January 1, 2023, so the personal information of California business contacts is in scope, including notices, access and deletion requests and rules on sharing data with vendors. The IAPP's state privacy legislation tracker, updated in September 2026, describes state-level momentum for comprehensive privacy bills as at an all-time high.

For demand generation teams, the practical step is to treat US contact data with the same discipline as Canadian data: documented sources, a privacy notice that covers B2B contacts, and vendor contracts that restrict how data providers and agencies use it. Confirm the state laws that apply to your buyers with counsel.

These are the fields and rules our RevOps team builds. They work in HubSpot and Salesforce.

1. Record country on every contact and account, from form fields and enrichment, and treat unknown as Canada for email eligibility.
2. Store consent type (express, implied by purchase, implied by inquiry, conspicuous publication, none), source, date and the wording shown.
3. Calculate implied consent expiry dates automatically: two years from purchase, six months from inquiry.
4. Build email eligibility as a single field that combines country, consent status and opt-out, and use it in every send.
5. Use one footer for all sends: sender identity, physical postal address, working unsubscribe, which satisfies both laws' identification rules.
6. Process unsubscribes immediately across all tools, well inside the 10 business day limit.

Our CASL, Law 25 and first-party data guide covers Quebec's consent rules for tracking, which sit on top of CASL for Quebec contacts.

Most problems come from lists and tools, not from the law itself.

• Purchased or enriched US contact lists loaded into the same nurture as Canadian contacts, so Canadians receive email without consent.
• Implied consent from an event or inquiry kept forever, instead of expiring after the CASL window.
• Sales sequences sent from a separate tool that does not read the marketing unsubscribe list.
• Country missing on half the database, so nobody can tell which rules apply.
• Footers without a physical postal address on sales emails, which CAN-SPAM requires for commercial messages.

The fix is usually a short project: backfill country, classify consent, connect every sending tool to one suppression list, and add a single eligibility field. After that, campaigns can be planned by market without a legal review for every send.

Events are where cross-border programs collect most new contacts, and where consent is most often lost. For Canadian attendees, ask for express consent on the registration form with clear wording, and record it. Scanning a badge at a booth is an inquiry at best, which gives six months of implied consent under the CRTC's guidance, not permanent permission.

For US attendees, registration does not need consent under CAN-SPAM, but the same form can collect it. We use one form for both countries with a consent checkbox, which keeps the Canadian standard and gives you a cleaner US list.

For US accounts, sales outbound email is legal without prior consent under CAN-SPAM if it meets the identification and opt-out rules, though state privacy laws and your own standards still apply. For Canadian accounts, cold email needs a consent basis such as conspicuous publication relevant to the role, or it should not be sent. We often shift Canadian ABM toward LinkedIn, events and content that earns express consent, and keep outbound email for contacts with a valid basis.

Measure deliverability and opt-out rates by country. A rising unsubscribe rate in one market usually signals a list or targeting problem, not a law problem.

Our RevOps team builds consent fields, eligibility rules and reporting in HubSpot and Salesforce for companies running programs in Canada and the US.

Our guide to expanding a Canadian B2B company into the US covers the wider plan, from account selection to budgets and reporting.

To review your setup, talk to our team.