Short answer
Canada’s Anti-Spam Legislation (CASL) applies to commercial emails and texts from your practice, such as newsletters and promotional recall messages. You need consent: express consent through an opt-in, which does not expire, or implied consent from an existing business relationship, which does. Every commercial message must identify your practice and include an unsubscribe mechanism, and unsubscribes must be honoured within 10 business days.
What counts as a commercial message
CASL applies to commercial electronic messages: emails, texts and similar messages that encourage participation in a commercial activity. For a dental practice, a newsletter promoting services or a message encouraging patients to book a cleaning would usually be commercial.
Some messages are treated differently. The Queen’s University Office of Legal Counsel lists messages that do not require consent but should still include identification and unsubscribe details. These include messages that facilitate, complete or confirm a commercial transaction, warranty or product safety communications, and information about ongoing purchases, subscriptions, memberships and accounts.2 A confirmation of an appointment the patient has booked is closer to that category than a general promotional message. The same source lists responses to a request, inquiry, complaint or application among messages fully exempt from CASL.2
The line between a reminder and a promotion is not always obvious. If in doubt, treat the message as commercial and make sure you have consent.
Express consent
The CRTC defines express consent as a person clearly agreeing to receive commercial messages, in writing or orally, and says express consent must be obtained through an opt-in mechanism.1 On a website, that means an unticked checkbox the patient chooses to tick, with a clear description of what they will receive. Express consent is not time-limited. It lasts until the person withdraws it.1
Keep the newsletter opt-in separate from the appointment request. A patient asking for an appointment has not agreed to a newsletter by doing so.
Implied consent
Consent can also be implied by an existing business relationship. The CRTC’s guidance describes a two-year window after a purchase or transaction and a shorter six-month window after an inquiry or application, and warns that implied consent can expire.1
For a dental practice, that could mean a patient seen within the last two years has an existing business relationship with you, while someone who only asked a question through your website has a six-month window. Track the relevant dates for each contact, or rely on express consent to avoid the tracking problem.
What every commercial message must include
The CRTC says each commercial message must provide identification information and include an unsubscribe mechanism.1 In practice:
- The name of your practice, and of anyone sending on your behalf such as an email service.
- Contact details: a mailing address and a phone number, email address or web address.
- An unsubscribe link or reply method that works and is easy to find.
Once someone unsubscribes, stop sending them commercial messages within 10 business days.1
Health information in emails
CASL is about consent to send. It does not cover what is safe to say. Recall and reminder messages should not include clinical details. In Ontario, the Information and Privacy Commissioner’s 2016 email guidance expects custodians to limit the amount and type of personal health information in email and to use encryption where feasible, according to a summary by law firm BLG.3 “Your next appointment is on Tuesday at 10 a.m.” is safer than a message that names a treatment.
Setting up your website correctly
- An optional newsletter checkbox, unticked by default, separate from the appointment request.
- Plain wording beside it, such as “Send me occasional practice news by email. I can unsubscribe at any time.”
- A record of when and how each person gave consent.
- A privacy notice that explains how email addresses are used.
- An email service that adds identification and unsubscribe links automatically.
Our appointment request forms include this set-up. This guide is general information, not legal advice. For specific questions, read the CRTC’s guidance or ask a lawyer.
Examples by message type
The table below suggests how some typical practice messages might be approached. It is a starting point for discussion with your advisor, not a ruling on any specific message.
| Message | Possible approach | What to check |
|---|---|---|
| Confirmation of an appointment the patient booked | Closer to messages that facilitate or confirm a transaction | Include identification details. Keep clinical information out. |
| Reminder that a patient is due for a regular cleaning | Encourages a new appointment, so safer to treat as commercial | Confirm express consent or a current implied consent window. |
| Practice newsletter with service news | Commercial | Use express opt-in consent and include an unsubscribe mechanism. |
| Reply to a question a person sent through your website | Listed among responses to a request or inquiry | Keep the reply to the question asked. |
| Announcement of a new treatment or offer | Commercial, and subject to your regulator’s advertising rules | Consent, identification, unsubscribe and wording that meets advertising rules. |
Text message reminders
Text reminders follow the same CASL principles as email. Keep them short, identify the practice, avoid clinical details and include a simple way to opt out, such as replying STOP, if the message is commercial. Make sure the opt-out actually works in your messaging software.
Keeping records
If a question about consent ever arises, records help. For each contact, keep the date consent was given, how it was given (for example, the website checkbox), the wording the person agreed to and, for implied consent, the date of the last transaction or inquiry. Many email services can store this information if it is collected at sign-up.
Frequently asked questions
Does CASL apply to text messages?
Yes. CASL covers commercial electronic messages, which include email and text messages sent to an electronic address. The same consent, identification and unsubscribe rules apply.
Can I add every patient to our newsletter list?
Not automatically. A newsletter that promotes services is a commercial message. You need consent, either express consent through an opt-in or implied consent within the time limits of an existing business relationship. Express opt-in consent is simpler to manage and does not expire.
How fast must I process an unsubscribe?
The CRTC says that once a recipient unsubscribes, you must stop sending them commercial electronic messages within 10 business days.
Does CASL apply to messages sent to existing patients?
It can. If a message is commercial, you need consent. For existing patients, implied consent from an existing business relationship may apply within its time limits, but express consent is simpler to manage.
Sources
- CRTC: Canada’s Anti-Spam Legislation guidance on implied consent Regulator
- Queen’s University Office of Legal Counsel: Commercial electronic messages (CEMs) Secondary source (university legal office)
- BLG: IPC releases guidance on communicating PHI by email (15 September 2016) Secondary source (law firm summary of IPC Ontario guidance)
Checked on 29 October 2026. Rules change, so confirm the current version with the regulator before you publish.
