Is Cold Email Legal in Canada, Australia and New Zealand?
· 5 min read
This is general information, not legal advice. The laws change, and a regulator or a lawyer decides how they apply to your case. Check the text of each law before you send.
In the United States, the rules for commercial email are about how you send: honest headers, a postal address, a working way to opt out. Our CAN-SPAM checklist covers it. Canada, Australia and New Zealand work the other way round. Each has a law that asks for consent before you send a commercial message, and then makes exceptions. The exceptions are what matter for someone who writes to local businesses.
The common idea
All three laws say roughly the same thing:
- A commercial electronic message needs the recipient's consent: express (they asked), or implied or inferred (the law lets you assume it in certain situations).
- The message must say who you are and how to reach you.
- It must have a working way to opt out, and you must act on it quickly.
- One situation gives you room: a work address that the business has published, when your message is relevant to the person's role, and the publication does not say that they do not want such messages.
Everything turns on point 4, and on being able to prove it.
Canada: CASL
Canada's Anti-Spam Legislation applies to commercial electronic messages sent to or from Canada. The regulator, the CRTC, explains the rules in its guidance on implied consent.
- Conspicuous publication. You may rely on implied consent when the person (or their business) has published the address conspicuously, the publication carries no statement that they do not want unsolicited messages, and your message is relevant to their business, role, functions or duties.
- The burden is on you. The sender has to be able to show consent, so keep records: where you found the address, when, whether any no-solicitation notice was there, and why the message fits the role.
- Publication alone is not enough. A public address does not make every message acceptable. The CRTC has treated a listed address as no basis for mass marketing unrelated to the person's role.
- Identify yourself and let people opt out. An unsubscribe mechanism has to work and be acted on promptly.
- The penalties are large. For organisations, the maximum for a violation is up to CAD 10 million.
Australia: the Spam Act 2003
The Spam Act covers commercial electronic messages with an Australian link. Its regulator is the ACMA.
- Publication does not, by itself, give consent. The Act says consent cannot be inferred merely because an address has been published.
- The exception. Consent can be inferred when a work-related address is conspicuously published, the message is relevant to the work of the person it is addressed to, and the publication has no statement that unsolicited messages are not wanted.
- Identify the sender and include a working unsubscribe. A request to opt out should be honoured within five working days.
New Zealand: the Unsolicited Electronic Messages Act 2007
New Zealand's Act is enforced by the Department of Internal Affairs.
- Three kinds of consent. Express, inferred from the relationship, and deemed, which includes a work-related address that the person has conspicuously published.
- The same conditions. The message must be relevant to the person's business role, and the publication must not say that they do not want such messages.
- Identify yourself and include an unsubscribe. An opt-out should take effect within five working days.
Put side by side
| Canada (CASL) | Australia (Spam Act) | New Zealand (UEMA) | |
|---|---|---|---|
| Consent needed first | Yes | Yes | Yes |
| Published work address can be enough | Yes, if relevant to role and no "no solicitation" notice | Yes, same conditions | Yes, same conditions |
| Sender identity and contact | Required | Required | Required |
| Working opt-out | Required | Required, five working days | Required, five working days |
| Who must prove consent | The sender (CRTC guidance) | Keep the proof anyway | Keep the proof anyway |
What to record for each lead
For every business you write to, keep five things:
- The address, and the page where you found it.
- The date you found it.
- Whether the page said they do not want unsolicited messages.
- Why your message fits their role (a web designer writing to a business that has no site).
- Whether they asked to stop, and when you did.
Read the page before you copy an address from it; a footer notice such as "no unsolicited offers" ends the exception.
What this means for how you write
- Stay on topic. A message about websites to a business with no website is relevant. A general newsletter is not.
- Write to the business's own address, not a personal one you found elsewhere.
- Name yourself and give a way to reply or opt out, in every message.
- Act on a "stop" at once, and keep a list: how to handle STOP and not interested replies.
- Do not guess addresses. How to find a business owner's email address shows where to look.
For the UK and the EU, see GDPR and PECR rules for B2B cold email.
How AyePin helps
AyePin keeps the source of each address it finds, adds an opt-out line to every message, and puts every sender's STOP on a do-not-contact list that is checked again before each send. Every draft waits in the Outbox for your approval, so the question "is this message relevant to this person?" stays with you. It does not decide what the law requires in your case.