How Much Can You Be Fined Under Canada's CASL for a Single Violation?

Up to $10 million CAD per violation for a business, and up to $1 million CAD for an individual, according to the Government of Canada's own Fight Spam guidance on CASL enforcement. The actual amount the CRTC imposes in any given case depends on factors like the nature and duration of the violation, whether the sender has prior violations, and the organization's ability to pay.

What Counts as a CASL Violation

CASL covers any commercial electronic message — email, SMS, or social media direct message — sent to a Canadian recipient without valid consent, regardless of where the sender is located. Each non-compliant message or action can be treated as a separate violation, which is why the per-violation structure matters more than a single flat penalty figure would.

Real Enforcement Numbers Run Well Below the Ceiling

The CRTC's own enforcement history shows fines consistently landing far under the $10 million cap. In the Compu-Finder matter, the CRTC initially issued a $1.1 million notice of violation in 2015, which a 2017 decision reduced to $200,000. A separate 2017 decision against an individual resulted in a $15,000 penalty. The statutory ceiling represents worst-case exposure for the most serious, repeated, or financially significant violations, not a typical outcome.

Consent Still Has to Be Explicit Opt-In

CASL's consent standard requires a clear, positive action from the recipient — a pre-checked consent box doesn't satisfy it. Consent requests also can't be bundled into acceptance of a terms-of-service or privacy policy; the request for consent to receive commercial messages has to stand on its own.

The Private Right of Action Remains Suspended

CASL originally included a provision letting individuals and organizations sue senders directly for violations, with statutory damages per message. That private right of action was indefinitely suspended before it ever came into force, meaning CRTC enforcement — not private lawsuits — remains the operative penalty mechanism as of this writing.

CASL Applies Regardless of Where the Sender Is Located

Because CASL's trigger is the recipient's location, not the sender's, a US or international company emailing Canadian contacts is just as exposed to these penalties as a Canada-based business. Marketers running cross-border campaigns often assume their home country's rules are the only ones that apply, which is exactly the gap that leads to unintentional violations when a list includes Canadian addresses collected without CASL-compliant consent. A US company that never set out to target Canada can still trigger CASL simply by having Canadian subscribers mixed into an otherwise domestic list.

Bottom Line

Before sending any commercial message to a Canadian address, confirm consent was collected as an unambiguous opt-in, not a pre-checked box or a bundled terms-of-service acceptance — the $10 million ceiling applies per violation, and while actual CRTC fines have run far lower in practice, each non-compliant message sent at scale compounds the exposure. Audit your list for Canadian domains and recipient data before your next send if you've never checked for CASL exposure specifically.

Sources: Government of Canada, Fight Spam, "Penalties" (fightspam.gc.ca/eic/site/030.nsf/eng/00013.html); CRTC Compu-Finder enforcement decisions (2015, 2017).