What CASL consent rules require of Canadian dental email newsletters?

What to take away

• CASL dental email marketing needs consent before the first send: express consent, or an implied consent that has not expired.
• Implied consent from an existing patient relationship lasts two years from the last purchase or service, and inquiries last six months.
• Every message needs a working unsubscribe, honoured within ten business days, plus sender identification.
• Consent records are the defence. Missing records carry record-keeping penalties on their own.
• PIPEDA applies alongside CASL to the personal information behind the list, and provincial health privacy laws may add more.
• A short checklist, run twice a year, catches most of what regulators look for.

What CASL requires of Canadian dental email newsletters

The Canadian Anti-Spam Legislation sets the rules for commercial electronic messages sent from Canada, including appointment reminders with a marketing angle, recall campaigns, treatment promotions and practice newsletters. It applies to a two-chair practice in Sudbury the same way it applies to a multi-site group in Ontario, British Columbia, Quebec, Alberta, the Prairies, Atlantic Canada or the territories.

The statutory basis sits in An Act to promote the efficiency and adaptability of the Canadian economy (CASL). That is where the consent definitions, the unsubscribe duty and the penalty provisions all live.

Three obligations apply to every commercial email a dental practice sends. You need consent, express or implied. You need to identify the sender and provide contact information. You need an unsubscribe mechanism that works and is honoured on time. Miss any one of the three and the message is non-compliant, regardless of how many patients opened it.

A dental newsletter is rarely a single-purpose message. A recall reminder that also promotes whitening, a new patient welcome email that mentions financing, a hygiene reminder with a smile makeover banner: each carries a commercial element and each falls under the same consent rules.

The practical answer is to treat every bulk patient email as commercial, then design the consent and unsubscribe around that assumption.

Provincial dental regulatory colleges, including the Royal College of Dental Surgeons of Ontario and the College of Dental Surgeons of British Columbia, add advertising and record obligations of their own. CASL does not replace them.

A newsletter that satisfies the federal rules can still draw a college complaint over a claim about outcomes or a testimonial. The Canadian Dental Association publishes guidance worth reading alongside the statute.

Quebec practices have an extra layer. Bill 96 and the Office québécois de la langue française require French-language treatment of commercial communications in most cases, which affects the newsletter itself, the subscribe form and the unsubscribe page. A bilingual list is not optional marketing polish in that province; it is a compliance question.

Costs sit outside this too. Marketing spend is a business expense for Canada Revenue Agency purposes, and GST/HST treatment depends on how the service is billed. None of that changes the consent rules, but it does mean the practice owner, not just the marketing coordinator, has a stake in how the list is built.

Express consent versus implied consent for dental lists

Express consent is the strongest position. The patient, or the person receiving the email, has actively agreed to receive commercial messages from the practice.

A checkbox on a new patient form, a sign-up at the front desk, or a web form with a clear statement about what will be sent all qualify if the record shows what was agreed to.

Pre-checked boxes do not qualify. Neither does a line buried in a treatment consent form that mentions email in general terms. The consent has to be positive, and it has to be about commercial messages specifically. A patient agreeing to email appointment confirmations has not, by that act alone, agreed to a monthly newsletter with promotions.

An express consent dental email record should capture the date, the method, the exact wording the patient saw, and the email address it applies to. If the practice uses a tablet at reception, the wording on that screen is part of the record.

If the practice uses a website form, the form text and the submission log matter. Consent does not expire under CASL, but it can be withdrawn, and a stale record with no wording attached is hard to defend.

Implied consent CASL dental situations cover two common cases. The first is an existing business relationship: a patient who has purchased or been served within the previous two years. The second is a business inquiry: someone who asked about services within the previous six months.

A new patient who booked and attended a cleaning creates an existing business relationship. Someone who emailed asking about Invisalign pricing creates an inquiry, and that implied consent runs six months from the inquiry.

The two-year clock runs from the last transaction or service, not from the first visit. A patient who has not been in the chair since 2023 has no implied consent left in 2026. That is the most common gap in dental lists: a large block of patients who were once active, now past the window, still receiving the newsletter.

A published business address also creates implied consent in narrow circumstances, and so does a conspicuously published email address where the message is relevant to the person's role. For a dental practice, these apply mainly to business-to-business messages, such as a supplier or a referring physician, not to patient marketing.

Referrals need care. A patient who says a friend is looking for a dentist has not given consent on the friend's behalf. The friend can be contacted once, in a way that answers the inquiry, and only then if the message fits the referral context. Adding the friend to the newsletter requires the friend's own consent.

Consent type	How it arises in a dental practice	How long it lasts
Express	Signed form, tablet checkbox, website sign-up with clear wording	Until withdrawn
Implied, existing business relationship	Patient attended or purchased	Two years from the last activity
Implied, business inquiry	Someone asked about services	Six months from the inquiry
Implied, published address	Conspicuously published business contact	Tied to relevance of the message

A practice that has never separated its list by consent type is not in a hopeless position. It is in a position where the next send is a risk. Sorting the list by last visit date, then by sign-up source, is the first repair.

What the cost of dental marketing in Canada often overlooks is a consent record attached to each address, not just a name and an email.

Unsubscribe duties and the ten-business-day rule

Every commercial electronic message must carry a working unsubscribe mechanism. In practice that means a clear link in the footer. It should be easy for a patient to find and take them to a page or a one-click action where they can opt out of all or some messages.

The unsubscribe must be honoured within ten business days, and the statute means ten business days, not ten calendar days. A request that arrives on a Friday before a long weekend has more room than it looks, but the practice should not treat the window as a target.

The safest operating standard is immediate suppression, with the ten-day period as the legal backstop.

Unsubscribe requests can arrive by any means. A patient who tells the front desk, replies to the email with the word stop, or calls the practice has withdrawn consent, even if the link was never used. Those requests need to reach whoever manages the list, which means the front desk needs a simple way to log them.

After a patient unsubscribes, the practice can still send messages that are not commercial. Appointment confirmations, recall notices tied to a booked treatment, and clinical follow-up generally fall outside the commercial message definition. A newsletter with a promotion does not.

The distinction matters because practices often stop all contact after an unsubscribe, then miss a recall that was clinically appropriate.

Suppression lists need to survive platform changes. If the practice moves from one email provider to another, or from a practice management system's built-in tool to a dedicated platform, the unsubscribe list has to move with it. A patient who unsubscribed in 2024 and receives a newsletter in 2026 after a migration has a complaint that writes itself.

The unsubscribe page itself is a compliance document. It should confirm the request, state when it takes effect, and not require the patient to log in, call the office or explain a reason. Any friction there is a risk, and a dental marketing strategy that tests the link from a real patient inbox catches most of it.

Record-keeping and penalties under CASL

Consent records are not paperwork for its own sake. Under CASL, a practice that cannot produce evidence of consent is treated as though it did not have consent. The record-keeping penalties apply separately from the consent violation itself, which means a messy list can produce two problems from one send.

The records to keep are straightforward: the email address, the consent type, the date, the source, and the wording the patient saw. For implied consent, the record is the underlying relationship, such as the last appointment date or the inquiry. For express consent, it is the form or the sign-up log.

Keeping these in the email platform, not in a spreadsheet on one computer, is the practical standard.

Penalties under CASL reach significant figures for businesses, and the exposure scales with the number of messages and the number of affected recipients. A single newsletter to several thousand patients with no consent records is a different order of risk than one misdirected email.

The Justice Laws Website is the place to read the current penalty provisions rather than relying on summaries. The Consolidated Acts index is the fastest route to the current text of the statute.

Enforcement has focused on large senders, but the private right of action framework and the complaints route mean a single irritated patient can start a process. Dental practices are not a priority target, which is exactly why the ones that get caught are usually caught through a complaint rather than an audit.

Records also matter for the practice's own defence in a college complaint or a privacy inquiry. A patient who says they never agreed to marketing emails is answered by a dated record showing the form they signed. Without it, the practice is arguing from memory.

Retention is the other half. Consent records should be kept for as long as the practice relies on them, and longer if a provincial health privacy law requires it.

Deleting a sign-up log during a platform migration, which happens more often than anyone admits, is the kind of unplanned cost a dental practice marketing budget should account for, and it only surfaces when someone complains.

How CASL interacts with PIPEDA consent for dental marketing

CASL governs the message. PIPEDA governs the personal information behind it. The two apply at the same time, and a practice that satisfies one can still fail the other.

PIPEDA requires meaningful consent for the collection, use and disclosure of personal information in the course of commercial activity. A patient email address, a date of birth, a treatment history and a postal code are all personal information.

Collecting them for marketing, even for a newsletter the patient wants, is a use that needs a lawful basis and a stated purpose.

The Office of the Privacy Commissioner of Canada publishes guidance on what meaningful consent looks like, and the Privacy for businesses - Office of the Privacy Commissioner of Canada pages set out the expectations for organizations collecting personal information for marketing.

The short version: tell people what you are collecting, why, and who will see it, in language they can understand, at the time you collect it.

CASL consent and PIPEDA consent are not the same test. A patient can give valid CASL consent to receive email while the practice still fails PIPEDA because the privacy policy is vague about how the address is used or shared with an email platform.

The reverse is also possible: a thorough privacy notice does not create CASL consent for commercial messages.

Provincial health privacy laws add a third layer. Ontario's PHIPA and Alberta's PIPA, among others, govern health information with rules that are stricter than PIPEDA in some respects. A dental newsletter that references treatment details, such as a reminder about a specific procedure, may be handling health information and not just contact data.

The Office of the Privacy Commissioner's Publications - Office of the Privacy Commissioner of Canada collection is a reasonable starting point for consent guidance that applies across these regimes.

In practice, the cleanest approach is one consent moment that does both jobs. A new patient form can state that the practice will send appointment reminders and occasional practice news.

The same form can explain that the email platform processes the address on the practice's behalf, then offer a clear opt-in for marketing messages. That wording satisfies CASL and gives PIPEDA something to stand on. The Justice Laws Website carries the current text of both statutes when the wording needs checking.

Platform choice is part of this. A Canadian email provider or a provider with a Canadian data region simplifies the cross-border disclosure question, though it does not remove the need to disclose where data goes. A practice that stores its list on a server in another country should say so in the privacy policy.

A CASL checklist for dental email newsletters

This is the working version, meant to be run before a campaign and again when the list changes hands. Dental email marketing in Canada rewards a boring, repeatable process more than a clever one.

• Every address on the list has a recorded consent type and date
• Express consent records include the wording the patient actually saw
• Implied consent addresses are checked against the two-year and six-month windows
• The newsletter footer identifies the practice and gives a physical mailing address
• The unsubscribe link works from a real patient inbox, on a phone
• Unsubscribe requests are suppressed immediately and logged with the date
• The suppression list moved with the last platform migration
• The privacy policy explains what is collected and who processes it
• Quebec sends and sign-up forms are available in French
• The list is re-checked against the consent windows twice a year

Running the checklist is a two-hour job the first time and much less afterwards. The hard part is the first pass, when the practice discovers how much of the list has no record attached. That discovery is the point.

Numbered steps for a practice starting from a messy list:

1. Export every address with its last appointment date and sign-up source.
2. Mark each address as express, implied with an expiry date, or unknown.
3. Remove unknown addresses from the marketing list and keep them for transactional messages only.
4. Re-permission the implied group with a single clear email that states what they will receive and how to opt in.
5. Move the surviving list into a platform that stores consent fields, then test the unsubscribe path end to end.

Step four is the one practices skip. A re-permission email is itself a commercial message, so it needs a basis for sending. The usual basis is the existing business relationship, which is why the re-permission should go out before the implied window closes, not after.

What the numbers look like afterwards is worth tracking. Open rates on a re-permissioned list behave differently from a purchased or inherited one, and a dental website marketing review should treat the benchmarks that matter as the ones from a consenting list, not from a blast to old records.

A smaller, documented list is a better asset than a large one nobody can defend.

For practices that want the broader operational picture, Dental email marketing covers list building, cadence and content alongside the compliance layer. CASL is the floor, not the strategy.

Common questions

Does a patient appointment reminder need consent under CASL? A reminder that only confirms or reschedules a booked appointment is generally not a commercial electronic message, so it sits outside the consent requirement. Add a promotion or a treatment upsell and it becomes commercial, which brings consent and unsubscribe duties back into play.

How long does implied consent last for a dental patient? Two years from the last purchase or service under the existing business relationship category. An inquiry about services gives six months. The clock runs from the most recent activity, not the first visit.

Can a practice email a patient who gave a verbal yes at the front desk? Yes, if the practice records the date, the person who took the consent and the wording used. A verbal consent with no record is difficult to rely on later, which is why a tablet or form is the safer route.

What happens if a patient unsubscribes but still needs recall reminders? Non-commercial messages, such as a recall tied to clinical care, can generally continue. Marketing messages cannot. Keeping the two streams separate in the email platform is what makes that distinction workable.

Do the CASL penalties apply to a small dental practice? They can. The exposure scales with the number of messages and recipients, and record-keeping violations are separate from consent violations. Most small practices encounter the rules through a patient complaint rather than an audit.

Does PIPEDA consent cover CASL consent for a newsletter? No. They are separate tests. A privacy notice that satisfies PIPEDA does not create permission to send commercial email, and a CASL-compliant sign-up does not by itself satisfy PIPEDA's requirements for handling personal information.