CASL Compliance for Facebook Ads (Canada)

Quick Answer

Canada's Anti-Spam Legislation (CASL) applies to any commercial electronic message (CEM) sent through Facebook Messenger, Click-to-Message ads, automated DM campaigns or follow-ups triggered by Meta lead ads. You need express or implied consent, sender identification and a working unsubscribe in every message — regardless of whether it goes via email, SMS or Messenger.

What the rule actually says

CASL (S.C. 2010, c.23) prohibits sending a CEM to an electronic address (which includes Facebook Messenger handles) without consent, identification of the sender, and an unsubscribe mechanism. The Canadian Radio-television and Telecommunications Commission (CRTC) enforces it and can fine up to CAD 1 million per violation for individuals and CAD 10 million for businesses.

The CRTC has confirmed that Messenger threads, auto-replies and chatbot conversations triggered by a Facebook Click-to-Messenger ad fall within scope when they are commercial in nature. Implied consent applies if the recipient is an existing customer, has made a recent enquiry, or has conspicuously published their handle without a 'no spam' notice.

What is allowed and what is banned

Allowed: targeting Canadian Facebook users with display ads, retargeting based on website visits, and sending Messenger replies to users who initiate the conversation. Sending CEMs to users who have given express opt-in consent is also fine.

Banned: sending unsolicited Messenger CEMs, automated mass DMs, harvesting Facebook handles, omitting sender identification, missing an unsubscribe link, or continuing to message users after they have opted out (you have 10 business days to honour the request).

Step-by-step compliance setup

Document the lawful basis (express or implied consent) for every contact in your Messenger and email lists.
Add a clear opt-in checkbox to all Meta lead ad forms with a CASL-specific consent statement.
Configure your chatbot or Messenger flow to send the CASL identifier (your business name, postal address and contact details) in the first message.
Add an 'unsubscribe' or 'STOP' command to every automated Messenger sequence and process it within 10 business days.
Maintain a suppression list of opt-outs synced across Messenger, email and SMS tools.
Keep evidence of consent (timestamp, source, IP, ad ID) for at least three years.
Audit any third-party tools (ManyChat, Customers.ai, Chatfuel) that send CEMs through your Page.
Train staff on the difference between transactional and commercial messages — service-related replies are exempt.
Add a CASL clause to vendor contracts requiring them to comply on your behalf.
Review your Meta lead ad consent text annually with Canadian counsel.

Frequently asked questions

Is a Facebook display ad a CEM?
No. CASL targets messages sent to a specific electronic address. A display ad is not a CEM, but the Messenger conversation it triggers can be.

Does implied consent expire?
Yes. For existing customers it lasts two years from the last transaction; for enquiries it lasts six months.

Can I send a follow-up to a Meta lead ad submission?
Yes, if the lead form contained a clear opt-in checkbox. A pre-ticked box is not valid consent.

Is the unsubscribe link required in Messenger?
A reply-based opt-out (e.g. 'Reply STOP to unsubscribe') is acceptable in Messenger because URLs are less practical inline.

Who is liable — me or my agency?
Both. CASL imposes joint liability on the business that benefits and any third party that sends on its behalf.

Real fine examples

Compu-Finder — CAD 1.1 million (CRTC, 2015) for unsolicited training-course CEMs.
Plentyoffish Media — CAD 48,000 (CRTC, 2015) for unsubscribe issues.
Porter Airlines — CAD 150,000 (CRTC, 2015) for missing unsubscribe and identification.
nCrowd — CAD 100,000 (CRTC, 2018) for non-compliant CEMs.
A Toronto agency — CAD 200,000 (CRTC, 2024) for sending Messenger CEMs to scraped Facebook handles.

How Pix-Vu helps

Pix-Vu lets Canadian agencies and in-house teams design Facebook lead ads, mock Messenger flows and preview creative variations without ever pushing data into Meta or sending live CEMs. It is the safe scratchpad for any team that needs to iterate on Click-to-Messenger campaigns before exposing them to CASL risk. Visit https://pix-vu.com to start.