CASL compliance for self-hosted email marketing starts with consent records
An organization emailing Canadians from its own newsletter platform needs to answer one question before the first campaign: can the platform prove that each recipient consented, and can it stop sending the moment someone opts out? Canada's Anti-Spam Legislation (CASL) section 6(1) prohibits sending a commercial electronic message unless the recipient has consented, expressly or impliedly, and unless the message identifies the sender, gives contact information and sets out an unsubscribe mechanism. Listmonk and Mautic can enforce those rules mechanically, but the software does not decide whether a contact was validly consented. That judgment depends on how subscribers entered each list, what they were told at the time, and whether the evidence was kept. A compliant program is a set of decisions, records and operating habits that the tools support, not a setting that the tools provide on their own.
Start with the consent record. For every list, decide which consent types you rely on, whether express consent (captured through a clear request, such as a signup form with an unticked box the subscriber must actively check) or implied consent (such as an existing business relationship with a defined time window) applies, and how each type is marked in the platform. In listmonk, the single and double opt-in list types and subscriber attributes can hold that context, and the SQL segmentation can exclude contacts whose consent source is unclear. In Mautic, contact fields, segments and the audit trail for imports and form submissions serve the same purpose. Confirm with your counsel which consent categories your forms collect, what wording was shown, and how long you keep the evidence. Those answers belong in a written consent register that the platform can reference, not in someone's memory.
Mapping CASL requirements to listmonk and Mautic settings
This table maps each CASL obligation for commercial electronic messages to what the sending function must do and where to configure it in listmonk or Mautic. Read each row as a control to confirm in your own deployment, then check the configuration against your consent records before the first send.
| Requirement | What the function must do | How to configure in listmonk | How to configure in Mautic |
|---|---|---|---|
| Consent type and proof (section 6(1)) | Send only to recipients who gave express or implied consent, and keep a record that shows the source, date and wording of that consent. | Use double opt-in lists for new sign-ups so confirmation is recorded, keep single opt-in lists for contacts with documented consent, and store consent source in subscriber attributes. | Store consent source and date in custom contact fields, keep a separate segment per consent basis, and export consent evidence from the contact record when asked. |
| Sender identification and contact information (section 6(1)) | Identify the sender and give a working contact method in every commercial message. | Put the organization name, postal address and a monitored contact address in the template footer, and use a sending domain the organization controls. | Place the same details in the email footer template or theme, and confirm the from address and reply-to address are monitored mailboxes. |
| Contact information validity (section 6(3)) | Keep sender contact details valid for at least 60 days after each message is sent. | Confirm the footer contact address and sending domain stay active for at least 60 days after send, and retain campaign archives that show the footer used. | Confirm the footer contact details and mailboxes remain live for at least 60 days, and keep sent email records with the footer version. |
| Unsubscribe mechanism (section 6(1) and 11(3)) | Provide a working unsubscribe link in each message and act on requests without delay and no later than 10 business days after sending. | Include the unsubscribe placeholder in every campaign template, and check that unsubscribe updates the list status immediately. | Enable unsubscribe in each email, and confirm the contact is marked do not contact so campaigns and segments exclude them. |
| Processing time for unsubscribe requests (section 11(3)) | Make sure a request takes effect no later than 10 business days after it is sent, with a tested process for requests received by other channels. | Confirm the unsubscribe handler runs on every SMTP path, and record manual requests from replies or phone calls in the subscriber record. | Confirm cron jobs for segment and campaign updates run on schedule so a contact removed from a segment is not emailed, and log manual opt-outs as contact actions. |
| List segmentation for consented and non-consented contacts | Prevent commercial messages from reaching contacts without consent, including imported lists with unknown consent status. | Use SQL queries on subscriber attributes to exclude unconsented contacts, and keep imported unverified contacts out of campaign lists until confirmed. | Build segments that filter on consent fields and do not-contact flags, and review segment membership before each campaign. |
How express and implied consent change the list design
Express consent is an affirmative yes from the person, usually given through a signup form, a checkbox or a verbal agreement. Under Canada's Anti-Spam Legislation, a commercial electronic message can be sent once express consent exists, and the sender should be able to show what the person agreed to and when. In listmonk or Mautic, the design goal is a list or segment that contains only people with a recorded opt-in event.
- Record the consent event: store the date, time, form or page of origin, the wording shown, and the email address used, in a field or log the platform keeps with the subscriber.
- Use double opt-in where it fits: listmonk supports single and double opt-in lists, so a confirmation step can create a clear, timestamped record before the first campaign goes out.
- Separate consent sources: keep sign-ups from different forms or events on distinct lists or tagged attributes so a withdrawal or audit can be traced to its origin.
- Honor withdrawals immediately in the list: an unsubscribe must take effect without delay and no later than 10 business days after the request, so the unsubscribe status should flow to every campaign queue.
- Keep the record after unsubscribe: retain proof of the original consent and the withdrawal, as the sender may need both if a complaint arises.
Confirm with counsel which consent wording and retention periods apply to your forms, and check the consent fields with your platform administrator before the first send.
Implied consent covers situations where a person has not expressly opted in but a relationship already exists, such as a recent purchase, a contract or an inquiry. CASL recognizes these relationships as a basis for sending commercial messages, but the categories, durations and conditions are specific and should be interpreted with counsel. The list design must therefore record the basis for each contact rather than assume that any existing customer can be mailed.
- Record the relationship type: capture the category of relationship, the date it started and the source system, such as an order record or a contract reference.
- Track the relationship end date: implied consent is not permanent, so store the date the basis is expected to lapse and build a segment that removes contacts when it does.
- Keep relationship segments separate: place implied-consent contacts in their own lists or segments in listmonk or Mautic so they are never merged into express-consent campaigns by mistake.
- Stop when the relationship ends or the person objects: any unsubscribe request ends mailing, and the sender should not convert an implied contact into an express one without a fresh consent action.
- Sync from the source system: if orders or accounts live in another system, define how changes flow into the mailing platform, since stale data is the usual cause of mailing after the basis has lapsed.
Ask counsel to confirm the relationship categories and time limits that apply to your business, and document the mapping between each category and the list it feeds.
Imported lists are the highest-risk case because the sender often does not know how each address was collected. A spreadsheet from a trade show, a partner or a former team may contain addresses with no consent record at all. Importing such a file into a newsletter platform does not create consent, so the sender must either establish a valid basis for each contact or avoid mailing them as commercial messages.
- Document provenance before import: record the file source, the person who supplied it, the collection method and the date, and keep that note with the list.
- Quarantine unknown lists: import them into a holding list that is excluded from every campaign and transactional stream until a basis is confirmed.
- Re-permission only where the basis allows: a single confirmation message can be a lawful route for some contacts, but counsel should review the wording and whether the message itself is commercial.
- Suppress without consent: addresses with no basis should be removed from mailing lists, and a suppression list should be kept so they are not re-imported later.
- Review bounces and complaints: high bounce or complaint rates on an imported list are a signal to stop, not to send more.
Before any imported list is used, confirm with counsel whether a basis exists for each source, and keep the provenance record for as long as the list is in use.
Which self-hosted platforms fit a CASL program
Both platforms can record consent, add sender identification and process unsubscribes, but they fit different teams. The choice depends on how many lists you run, how much marketing automation you need and who will operate the stack, so confirm each item below in your own environment before you commit.
listmonk for list-based consent
listmonk is a one-way newsletter and list manager licensed under AGPL v3, with PostgreSQL as its only dependency. Its single and double opt-in list types let you decide which consent model each list uses, and its SQL segmentation lets you filter subscribers by the consent status you store. Confirm which fields record consent source, date and wording in your database schema, and whether your team can export consent evidence on request.
Mautic for automated consent journeys
Mautic is marketing automation software written in PHP on Symfony and licensed under GPL-3.0. It supports campaigns, contact segments and consent-driven workflows beyond a simple newsletter, which suits teams with multi-step nurture programs. Its segment updates, campaign triggers and broadcasts depend on cron jobs and a messenger consumer, so confirm that someone owns those jobs and monitors them.
Mautic release support windows
Mautic publishes monthly patch releases, minor releases every three months and major releases every two years. Support ends on fixed dates, and an older release can lose security fixes while your CASL records still need to be kept. Check the support end date of the version you deploy against your legal retention and review plan, and confirm which release the project designates as long-term support before you plan an upgrade path.
Single sign-on and roles
listmonk supports OIDC single sign-on with granular roles, permissions and API tokens. Restricting who can create lists, edit consent-related fields and export subscriber data is a core CASL control, because unsubscribe and consent changes must be traceable to a named person. Confirm that your identity provider can pass the group claims your role mapping needs, and that API tokens are scoped and rotated.
Hosting and runtime requirements
Mautic requires PHP 8.2 to 8.5, MySQL 5.7 or higher with InnoDB or MariaDB 10.2 or higher, and a web server such as Apache or Nginx. The project advises against shared hosting and recommends a VPS or dedicated server. listmonk runs as a standalone binary with a Docker image, which usually makes its footprint smaller. Confirm the hosting model, backup scope and patch ownership before you select a platform.
Transactional and sending integration
listmonk provides a transactional API for pre-defined templates and sends through multiple SMTP servers with rate limiting. This matters for CASL because unsubscribe handling and sender identification must work on commercial messages, while transactional messages may follow different rules. Confirm which sending service you will use, how bounces and unsubscribes flow back into your consent records, and whether each stream keeps its own sender identity.
How to configure consent and unsubscribe handling step by step
This sequence sets up consent capture, sender identification and unsubscribe processing so that every commercial message to a Canadian recipient can be traced back to valid consent and a working opt-out. It ends with a tested path from unsubscribe click to suppression across every list.
Map lists to consent basis
Before any platform is configured, the marketing owner and legal counsel assign each list a consent basis: express consent captured through a clear opt-in, or implied consent that the organization can justify under the relationship categories in CASL. Each list is given a name that states its purpose and its consent basis, so that a campaign sent to a list can be traced to a documented permission. The step is done when a written list register exists, signed off by legal, and every list in the platform matches a row in it.
Configure double opt-in on public lists
The platform team turns on double opt-in for every public subscription form in listmonk, so that a new address is held as unconfirmed until the subscriber clicks a confirmation link. Subscription forms should record the time, the form used and the request source with the subscriber record, which gives you proof of how consent was obtained. The step is complete when a test signup stays unconfirmed until the link is used, and the stored record shows the confirmation time and form.
Build the footer and sender identity template
Marketing operations creates a shared template footer that carries the sender's legal name, a valid postal address or other contact information, and a working unsubscribe link, and make it mandatory for all campaign templates. Under CASL, sender contact details must remain valid for at least 60 days after sending, so the mailbox and address used must be monitored and kept active. The step is done when every template in the platform inherits this footer and a rendered preview shows all three elements.
Test unsubscribe links on every template
The QA owner sends test campaigns through each template and each sending path, then clicks the unsubscribe link from a test inbox. The test confirms that the link loads without login, that the subscriber is marked as unsubscribed, and that the confirmation page is shown. Repeat the check for transactional or service messages that carry a marketing element, if any exist. The step is done when the test log lists each template, the date and the observed result, with no failures left open.
Propagate suppression across all lists
The platform owner confirms that an unsubscribe from one list stops delivery from every list that shares the same subscriber, or that the platform applies a global suppression status to that address. Lists used by other systems, such as CRM syncs or exports, must also receive the suppression so that a removed address is not re-added. The step is complete when a test address unsubscribed from one list is confirmed as blocked from all other lists and from any sync job, and the result is written into the test log.
Schedule and monitor Mautic cron jobs
If Mautic is the platform, the operations team must schedule its cron jobs for segment updates, campaign updates and campaign triggers, staggered as the Mautic documentation recommends, and confirm that the broadcasts command and the messenger consumer run when emails are queued. Unsubscribe changes are applied through these processes, so an unsubscribe may not take effect until the relevant job runs. Monitoring should alert the operator when a job fails or stops. The step is done when the job logs show successful runs and an unsubscribe test takes effect within the expected cycle.
Test the 10-business-day processing path
The compliance owner records a documented test in which an unsubscribe request is submitted, timed, and checked against the expected result: the address must stop receiving email without delay and no later than 10 business days after the request is sent. The test should be repeated after any change to the scheduler, the sending service or the list structure. The step is complete when a signed test record shows the request time, the suppression time and the result, and the record is stored with the compliance file.
Retain consent and unsubscribe records
The data owner defines which records are kept for each subscriber, including the consent source, the time of consent, the list, the confirmation time, the unsubscribe time and the campaign that triggered the request. These records should be exported or backed up on a schedule that the legal team approves, and kept in a location the organization controls. The step is done when a sample record can be produced for any subscriber within a short internal review, and the retention period has been set in writing by counsel.
Evidence auditors and regulators ask for, and what produces it
This table maps each record a CASL review is likely to request to the component that produces it and the retention decision the organization must make. Read it as a checklist for the platform design: if a row has no owner or no retention rule, the evidence will be hard to produce when a complaint or inquiry arrives.
| Evidence | Produced by | Retention decision |
|---|---|---|
| Consent records with timestamp and source | listmonk subscriber and list tables in PostgreSQL, plus the opt-in confirmation log; Mautic contact records and consent fields | Decide how long proof of express or implied consent is kept after a subscriber leaves, and whether to keep the sign-up form version and IP at capture |
| Unsubscribe request logs and processing times | listmonk subscriber status changes and application logs; Mautic do-not-contact entries with their timestamps | Keep the request time and the time the suppression took effect to show processing within 10 business days; confirm how long application logs are retained |
| Sender identification by template version | Template version history in listmonk or Mautic email assets, combined with sent-campaign records that link each send to its template | Retain each template version used in a campaign, including sender name, postal or contact details and unsubscribe mechanism, for the period you must show contact details stayed valid |
| Suppression list exports | Scheduled exports of unsubscribed and bounced addresses from the platform database, stored separately from active lists | Keep suppression data even after an individual record is erased where law allows, so that sending to that address is not repeated |
| List and segment change history | Campaign and list audit trail where enabled; database backups and migration records for list structure changes | Confirm whether the platform records who changed a list or segment and when; set the retention period for backups that hold earlier states |
| Access logs for the platform | Web server and reverse proxy logs, administrator login records from OIDC single sign-on, and API token activity | Decide who reviews these logs, how often, and how long they are kept, aligned with your security logging policy |
| Sending relay logs | SMTP relay or sending service logs showing accepted, deferred and bounced messages per recipient | Confirm the relay's retention period with the provider, since it may be shorter than the period you need for a complaint review |
What the penalty exposure means for an operator
CASL sets administrative monetary penalties per violation, and the exposure reaches beyond the platform itself. The cards below separate the penalty ceiling, the people accountable for it, the difference between a configuration fault and a process fault, and the consent evidence an operator needs when a complaint arrives.
Per-violation penalty ceilings
Section 20(4) of CASL sets the maximum administrative monetary penalty per violation at $1,000,000 for an individual and $10,000,000 for any other person. Because the cap applies per violation, a single campaign sent to many recipients without consent or without a working unsubscribe link can multiply the exposure. Check which legal entity sends the messages, since that entity is the one named in the penalty. Confirm with counsel how your organization counts violations across a campaign, a list and a sending period.
Director and officer accountability
CASL extends liability beyond the sending entity in some circumstances, including to directors and officers who direct, authorize or acquiesce in a violation. For self-hosted email, that means the people who approve list imports, campaign templates and sending policies are part of the risk picture, not only the engineers who deployed the platform. Document who owns consent standards, who signs off on new lists, and who can pause a campaign. Ask counsel to confirm how the officer provisions apply to your governance structure.
Platform misconfiguration versus process failure
A misconfiguration is a platform setting that does not match policy, such as a list with no unsubscribe link in the template, a missing sender identification block, or a default list that accepts subscribers without a consent record. A process failure is a gap in how people use the platform, such as importing a purchased list, reusing an old list for a new purpose, or ignoring unsubscribe requests received by email. Fix configuration once in the template and list settings, and fix process through written procedures and periodic checks of what was actually sent.
Unsubscribe processing as a control
Section 11(3) requires an unsubscribe request to take effect without delay and no later than 10 business days after it is sent. In a self-hosted platform, that window depends on how quickly suppression lists update across every sending path, including scheduled campaigns and any transactional or API-triggered messages that might reach the same address. Test that a request made through the link, and one forwarded to a support inbox, removes the subscriber from all relevant lists. Record the date each request was received and actioned.
Consent records as evidence
When a complaint or inquiry arrives, the operator must show that a recipient gave express or implied consent, and the platform's current subscriber status alone rarely answers that question. Keep the sign-up source, the date and time, the consent wording shown, the list the person joined, and any confirmation step. Records of withdrawn consent and unsubscribe actions also matter. Export these from the database on a schedule and store them in a form that the compliance team can retrieve without an engineer.
Retention of sender identification
Section 6(3) requires sender contact information in a commercial electronic message to remain valid for at least 60 days after the message is sent. Self-hosted platforms often rotate mail servers, retire domains, or change reply addresses during migrations, and any of these can break the contact information in older messages. Set a retention rule for sender details in the template library, and verify that a reply address and postal details remain working for at least that period after each send.
CASL email compliance questions buyers ask before hiring help
How much effort does a CASL configuration take and what drives it up?
The effort depends on how many lists you run, how consent was originally collected and how many sending sources feed your platform. Effort rises when consent records are spread across spreadsheets, CRM exports and old forms, when lists mix express and implied consent without a clear origin, and when several teams send from separate templates. Work also grows with the number of sender identities, unsubscribe paths and integrations that write subscriber status back into listmonk or Mautic. Ask any provider to break the quote into discovery, list and template configuration, consent data mapping, testing and handover so you can see which line items your own data would change.
Can our internal team configure CASL compliance without outside help?
Yes, a capable team can configure the platform settings if it has access to the platform administrator role, a clear consent policy and the time to test. The harder part is usually the evidence: deciding which consent facts to keep, where they live and how long they are retained. Internal teams often underestimate testing the unsubscribe flow end to end, including how an opt-out propagates to every list and to any connected sending service. Consider outside help if no one on staff has run both the platform and a regulatory review before, or if the existing lists are large and poorly documented.
What does the CASL work need from legal and marketing teams?
Legal needs to confirm the consent basis for each list, the sender identification wording, the contact details that must remain valid, and the retention period for consent records. Marketing needs to supply list purposes, sign-up forms, historical campaign data and any purchased or shared lists that may carry uncertain consent. Both teams should approve the unsubscribe wording and the footer text before the platform goes live. Agree in writing who signs off each decision, because an implementation partner can configure what has been decided but cannot replace the legal determination of whether consent is valid.
How long does a fixed-scope CASL configuration and evidence pack take?
The timeline is set in the written scope and depends on the number of lists, the state of existing consent records and the review cycles agreed with legal. DeployOpen does not publish a standard duration, so ask for a timeline tied to specific deliverables, such as list configuration, template review, unsubscribe testing and the evidence pack contents. Confirm which items are dependencies on your side, including access to the platform, sign-off dates and the availability of consent data. Ask how changes requested after the scope is agreed are priced and scheduled.
Does DeployOpen certify that our email program complies with CASL?
No. DeployOpen does not issue compliance certifications, audit reports or attestations. Its work is to configure the self-hosted platform, document the settings and prepare evidence that your legal and compliance teams can review. Compliance determinations remain with your organization and, where relevant, with the regulator or counsel you engage. Ask any partner to state this boundary in writing and to explain which artifacts it will deliver, such as configuration records, consent field definitions and test results for the unsubscribe process.
How should we review existing lists before moving them into a CASL-ready platform?
Start by classifying each list by how its subscribers joined, whether through express consent, implied consent based on an existing relationship, or an unknown source. Check that each record carries a date, a source and a consent type, and flag any subscriber whose origin cannot be shown. The Justice Laws Website sets out the consent and unsubscribe rules in section 6 and section 11 of the Act, which is the natural starting point for legal review. Lists with unclear provenance should be paused or re-permissioned before the first campaign. Record the review outcome so the decision trail survives the migration.
What penalties apply if a CASL configuration misses a requirement?
The Act sets administrative monetary penalties of up to $1,000,000 per violation for an individual and up to $10,000,000 per violation for any other person, under section 20(4). Exposure therefore grows with the number of violating messages and with the number of lists affected by a single misconfiguration. Unsubscribe requests must take effect no later than 10 business days after they are sent, so a delayed sync between the platform and a sending service can create violations even when the original list was lawful. Ask any partner to test this path explicitly and to show how opt-out status is written, checked and retained.
How DeployOpen scopes and delivers a CASL-ready email platform
DeployOpen is a Chainscore Labs company that plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure. For CASL, we turn consent, sender identification and unsubscribe requirements into configured list settings, tested sending flows and records you can hand to your compliance team, while the legal interpretation stays with your counsel.
How we scope
- We confirm which sender types you run, such as newsletters, promotions and transactional messages, and which Canadian recipients they reach.
- The written scope lists the consent categories, list structures and sender identification fields that will be configured in listmonk or Mautic.
- We agree in writing which consent record fields, retention periods and unsubscribe test cases are included before work starts.
How we build
- We configure list types, opt-in flows and subscriber attributes so consent source and date are stored with every subscriber record.
- We set sender name, postal address and contact details in campaign and template settings so every commercial message carries them.
- We build and test unsubscribe handling end to end, including timing checks against the 10 business day requirement in the written scope.
How we hand over
- You receive documentation of configured settings, consent record fields, unsubscribe processing steps and test results for CASL review.
- We provide runbooks for importing legacy consent evidence and for handling suppression requests across lists and backups.
- Handover covers administrator training so your team can operate lists, templates and reports without relying on us day to day.
How we support
- Engagements are fixed-scope, and ongoing support, upgrades and continuous testing are available as a retainer.
- Upgrades to listmonk or Mautic are planned and tested against the compliance settings before they reach production.
- Your compliance team or external counsel decides how CASL applies to your organization, and we prepare the evidence they request.
