CASL rules for hair salon email and text marketing in Canada

Canada's anti-spam law does not have a small-business exception. The same statute that was written with industrial spammers in mind applies, word for word, to a three-chair salon in Moncton sending a January colour promotion to forty clients. Most of what circulates about it online is either panic ("million-dollar fines!") or shrug ("nobody checks small businesses"), and both miss the practical point: CASL is entirely manageable for a hair salon, but only if you understand three mechanisms that almost no vendor blog explains properly. The consent clocks, which put an expiry date on your right to email each client. The records, because the legal onus of proving consent sits on you, not on the client complaining. And the unsubscribe mechanics, which apply even to messages that need no consent at all.

This guide covers those three mechanisms, plus the penalties and the separate rulebook for phone calls, verified against the text of the Act itself in October 2026. One disclosure before we start: this blog belongs to ViteUneCoupe, a free online booking system for hair salons with 0% commission, and ViteUneCoupe has no marketing blast tool and sends no text messages, so we have no newsletter product to sell you at the end. What follows is orientation, not legal advice, and if your salon is in Québec, provincial language and privacy rules add a layer this Canada-wide guide does not cover: see our French guide, Rappel de rendez-vous par texto ou courriel au Québec.

The dividing line: appointment messages versus marketing messages

Everything in CASL hangs on one classification. A commercial electronic message (CEM) is any email or text whose purpose, or one of whose purposes, is to encourage participation in a commercial activity. A promotion, a newsletter with offers, a "we miss you" win-back, a "book your grad updo now" blast: all CEMs, all subject to the consent rules below.

Appointment communications live on the other side of the line. Section 6(6) of the Act lifts the consent requirement from messages that solely facilitate, complete or confirm a transaction the recipient already agreed to, or that provide factual information about an ongoing purchase or service. Your booking confirmation, your appointment reminder, your "the salon is closed tomorrow because of the storm" notice, your post-visit aftercare note: none of these need marketing consent, because the client created the relationship when she booked. How to time and word those messages is its own craft, covered in our guide to appointment reminders for Canadian hair salons; this article stays on the marketing side of the line.

Two details about that exemption are routinely missed:

• "Solely" is load-bearing. The exemption covers messages that solely confirm or facilitate the transaction. Append "and ask about 20% off our new gloss treatment" to a reminder and you have written a CEM, consent rules and all. Keep the two message types in separate streams: factual appointment messages to everyone with a booking, promotions only to the consented list.
• The exemption waives consent, nothing else. Section 6(6) switches off paragraph 6(1)(a), the consent requirement. Subsection 6(2) still applies: even an exempt reminder must identify your salon, give working contact information, and carry an unsubscribe mechanism. A reminder from a bare "noreply" address with no salon name and no way out is non-compliant even though it needed no consent.

A borderline case worth naming: a "please leave us a Google review" email. Asking for a review promotes your commercial activity, so the cautious reading treats it as a CEM and sends it only within a valid consent window. Since you will usually send it within days of a paid visit, the implied-consent window below covers it comfortably; just include the identification and unsubscribe anyway.

The consent clocks: how long you may email each client

CASL recognizes two kinds of consent, and they age very differently.

Express consent never expires. A client who actively agreed to receive your news (a box she ticked herself, a card she signed at the counter) stays on your list until she withdraws. This is the asset worth building.

Implied consent runs on a clock. Under subsections 10(9) and 10(10) of the Act, an "existing business relationship" implies consent, and the relationship is defined by recency:

The clocks restart with each qualifying event. Every paid visit resets the two-year window, so your active regulars are permanently covered without ever ticking a box. The clock problem is entirely about lapsed clients: the day a client's last purchase turns two years old, your implied consent evaporates, and the win-back email you finally get around to sending is a violation. Someone who messaged you in March asking about balayage prices but never booked is tighter still: six months, then she is off-limits.

Three practical readings of that table:

1. Win-back campaigns have a legal deadline, not just a commercial one. The monthly lapsed-client scan, and the reason to run it monthly rather than annually, is laid out in our playbook on client retention and rebooking for Canadian salons. This article's job is the part that playbook points back to: knowing which names are still inside the window, and proving it.
2. A gift card buyer is a purchaser. Someone who bought a gift card in December has made a purchase: the two-year window opens even if she has never sat in your chair. The recipient of the card, on the other hand, bought nothing from you until she redeems it.
3. Express consent is the escape from clock management. One optional checkbox at booking, and everyone who ticks it never ages out. Collecting it well is the next section.

Express consent that actually holds up

Not every "yes" counts. Section 10(1) of the Act requires a request for consent to state, clearly and simply, the purposes for which consent is sought and who is asking, and the CRTC's regulations add the sender's mailing address, a second contact channel, and a statement that consent can be withdrawn at any time. The CRTC's guidance on the regulations (Compliance and Enforcement Information Bulletin CRTC 2012-548, checked in October 2026) adds that consent for marketing must be sought separately, not buried inside general terms and conditions the client accepts to book.

The companion bulletin on express consent (CRTC 2012-549) kills the most common shortcut: a pre-checked box is not express consent. Consent presumed from the client's inaction is exactly what the law was written against; the client must tick the box herself. An unchecked, clearly worded, optional checkbox on your booking flow or client intake is the gold standard:

"Yes, send me occasional news and offers from [Salon name] by email. You can unsubscribe at any time. [Salon name], [address], [phone]."

Oral consent is legal too: "want me to add you to the birthday-offer list?" at the counter counts, if the client says yes. The catch is the next section: a verbal yes with no record is a yes you cannot prove. If you collect consent orally, write it down on the spot (who, what, when, who asked) in the client's record.

One more trap for salons that grew a list informally: having a client's email address is not consent. Addresses collected over the years "for the file", imported from a phone, or harvested from Instagram DMs carry no consent at all unless a purchase inside the two-year window implies it. Before the first campaign to an old list, sort it honestly: express consents, live implied windows, and everyone else, who gets nothing until they opt in.

Records: the onus of proof is on your salon

Here is the sentence from the Act that should shape your filing habits. Section 13: "A person who alleges that they have consent to do an act that would otherwise be prohibited under any of sections 6 to 8 has the onus of proving it." Not the complainant, not the CRTC: you. If a client complains to the Spam Reporting Centre and the CRTC asks your salon about one email, "she has always been fine with it" is not evidence.

What a usable consent record contains, drawing on the record-keeping guidance in Bulletin 2012-548:

• Who: the client, and the address or mobile number the consent attaches to.
• When: the date of the consent, or of the purchase or inquiry that starts an implied window.
• How: ticked the booking-form checkbox, signed the counter card, said yes verbally to a named staff member.
• What they saw: keep a copy of the checkbox wording and consent text you used, with the dates each version was in service.
• Exits: every unsubscribe, with its date, kept permanently on a suppression list.

For implied consent, your appointment history is the record: a dated visit log showing a paid service eighteen months ago proves the window was open. This is a quiet but decisive argument for keeping client records digital and dated rather than in a paper book; what you may store, and the privacy law that applies to the file itself, is covered in our guide to client records and privacy for Canadian hair salons. And if you ever buy or sell a salon, the consent records are part of the deal: the CRTC's own guidance uses exactly that scenario, a business acquired with its mailing list, to show that the buyer must still be able to prove each address's consent or live business relationship.

Unsubscribe mechanics: the ten-day rule and the sixty-day link

Section 11 of the Act is specific in ways that generic advice glosses over. Every CEM must offer an unsubscribe that:

• costs the client nothing (standard data or text rates aside);
• works through the same channel or a web link: an unsubscribe link in email, a reply such as STOP for a text;
• stays functional for at least 60 days after the message was sent, so a client clearing her inbox two months later can still use the link;
• takes effect "without delay", and at the latest within 10 business days, with no fee, no login wall, and no "tell us why you are leaving" obstacle course.

And remember the asymmetry from the first section: the unsubscribe requirement applies to your exempt appointment messages too, via section 6(2). In practice that creates a question worth deciding once: a client who unsubscribes from your promotions has not cancelled her appointment reminders, which ride on a different legal basis. Run two lists, label them in plain words ("unsubscribe from salon news" versus the reminder settings on her booking), and never let a marketing opt-out silently kill the reminder that protects her Tuesday colour slot. If you send texts and emails, honour an opt-out across both unless the client clearly limited it.

An unsubscribe honoured on day eleven is a violation with a perfect paper trail pointing at you, so this is the one mechanism to automate or calendar rather than trust to memory. If your list lives in a spreadsheet and your "campaigns" are BCC emails from the salon's mailbox, the ten-day rule is still yours to meet: process the opt-out the day it arrives.

Texts and phone calls: two different rulebooks

A text message is a CEM: everything above applies to SMS exactly as to email, including the consent clocks and the STOP reply. A voice call, including a voicemail, is not covered by CASL at all. Calls fall under the CRTC's Unsolicited Telecommunications Rules and the National Do Not Call List, and the windows do not match CASL's:

The National DNCL's published exemptions (lnnte-dncl.gc.ca, checked in October 2026) let a business call consumers who bought from it within the last eighteen months, or inquired within six, even if their number is on the DNCL. Outside that relationship, you may not solicit by phone without checking the list first, and even inside it, a client who says "stop calling me" goes on your own internal do-not-call list within 14 days and stays there for three years.

For a salon the practical reading is short. Calling a regular to offer a cancelled slot tomorrow is service, not solicitation, and is nothing to worry about. Calling through old client files to announce a promotion is telemarketing, with an 18-month window that is six months shorter than the one you have by email. If a lapsed client is 20 months past her last visit, you may still email her under CASL and may no longer solicit her by phone. The two clocks genuinely diverge, and the email one is the generous one.

Penalties, and what enforcement actually looks like

The numbers that headline every CASL article are real: section 20(4) sets maximum administrative monetary penalties of 1 million dollars per violation for an individual and 10 million for a business. Three facts sit underneath them and matter more to a salon owner:

• Directors are personally on the hook. Under section 31, an officer or director who directed, authorized or acquiesced in the violation is liable personally, incorporated salon or not.
• Due diligence is a full defence. Section 33 says a person is not liable if they exercised due diligence to prevent the violation. For a salon, due diligence looks exactly like this article: a consent checkbox with compliant wording, a dated record of consents and visits, a suppression list honoured within ten business days, and staff who know a reminder must stay factual. The records section above is not bureaucracy, it is your defence file.
• There is no private right of action. CASL originally contained a private lawsuit mechanism (sections 47 to 51), its entry into force was suspended in 2017, and the provisions were ultimately repealed before ever coming into force: the statutory notes on the Act confirm it, checked in October 2026. Clients cannot sue your salon under CASL; enforcement belongs to the CRTC. If a consultant warns you about CASL class actions, they are reading a 2017 blog post.

Real CRTC enforcement has concentrated on large senders and deliberate spammers, resolved by investigations, penalties and negotiated undertakings. That is context, not permission: complaints to the Spam Reporting Centre are the trigger, any annoyed recipient can file one in a minute, and the business that cannot produce a consent record is the one with no story to tell. The goal is not to fear the maximum penalty, it is to be the salon whose fifteen-minute compliance setup makes the question boring.

The one-afternoon CASL setup for a hair salon

Everything above compresses into six moves:

1. Add an unchecked opt-in box to your booking flow or intake, with the purpose, your salon's name, mailing address, a second contact, and "unsubscribe anytime" in the wording.
2. Sort the existing list once: express consents, clients with a visit inside two years, inquiries inside six months, everyone else out until they opt in.
3. Start the consent log: date, method, wording version, plus a permanent suppression list for every opt-out.
4. Separate the streams: appointment confirmations and reminders stay purely factual and go to everyone with a booking; promotions go only to the consented list. Both carry your identity, contact details and an opt-out.
5. Calendar the clocks: a monthly lapsed-client pass keeps win-backs inside the window instead of past it.
6. Decide the phone policy: service calls freely; promotional calls only inside the 18-month DNCL window, with stop-requests logged within 14 days.

On tooling, our cards on the table. ViteUneCoupe's free plan gives your hair salon unlimited online bookings with 0% commission, permanently, plus a client database where every booking lands with its date, which is precisely the dated visit history that proves an implied-consent window. The Standard plan, at 29 € excluding tax per month with no commitment (ViteUneCoupe is a European service billed in euros), sends the confirmation, reminder and thank-you emails automatically, by email only, no texts on any plan. There is no campaign or newsletter tool: your promotional emails are yours to send from your own mailbox or a dedicated email tool, which is exactly why the consent log above belongs to you and not to any software, ours included.

Frequently asked questions

Do CASL rules apply to a small hair salon with a few dozen clients?

Yes, fully. The Act has no small-business threshold: a promotional email or text from a solo stylist is a commercial electronic message under the same rules as a bank's newsletter. The workload scales down, though. A consent checkbox, a dated visit history and a promptly honoured unsubscribe put a small salon in compliance in an afternoon.

How long can I email past clients under CASL?

With express consent, indefinitely, until they unsubscribe. Without it, implied consent from an existing business relationship lasts two years from the client's last purchase and six months from a mere inquiry, and each new purchase restarts the clock. After the window closes you may not send promotional messages, which is why the win-back email belongs months after the last visit, not years.

Do appointment reminders need marketing consent?

No. Messages that solely confirm or facilitate a transaction the client agreed to, confirmations, reminders, aftercare notes, are exempt from CASL's consent requirement under section 6(6). They must still identify your salon, include contact information and carry an unsubscribe. Add any promotion to a reminder and it becomes a full commercial message needing consent.

What records does CASL require a salon to keep?

The Act puts the onus of proving consent on the sender, so keep whatever proves each address's status: the date and method of every express consent with the wording used, dated purchase history for implied consent, and a permanent list of unsubscribes with dates. A booking system's dated visit log covers the implied side on its own.

Can clients sue my salon over a marketing email?

Not under CASL. The private right of action written into the original law was never brought into force and has since been repealed, so enforcement rests with the CRTC, which can impose administrative penalties of up to 10 million dollars per violation on a business. A documented due-diligence setup, consent records, clean message streams and fast opt-outs, is a full statutory defence.

Are text messages and phone calls treated the same way?

No. Texts are commercial electronic messages under CASL, with the two-year purchase window and a STOP opt-out honoured within 10 business days. Voice calls, voicemail included, fall under the CRTC's telemarketing rules and the National Do Not Call List instead, where the existing-business-relationship window is only 18 months and a stop-request goes on your internal do-not-call list within 14 days.