Can I email purchased leads under CASL?

Usually not, and never by default. CASL consent attaches to the party it was given to: a person who filled in a lead company’s form consented, at most, to hear from that company — not from whichever agent later bought the contact. CRTC guidance places the burden of proving consent, express or implied, on the sender of the message, so “the vendor said it was opt-in” is not a defence you can stand on. There is a compliant way to work purchased leads, but it runs through responding to the person’s actual inquiry and earning your own consent, not through adding a bought list to an email campaign. (General information, not legal advice; primary sources are the CRTC and ISED CASL guidance, accessed 2026-07-27.)

Why consent doesn’t ride along with the lead

Two mechanics in the legislation do the work. First, a request for consent must identify who is asking and on whose behalf — consent gathered for unnamed future third parties only functions under narrow conditions, including that the eventual sender can be identified and that unsubscribes propagate back through the chain. A typical lead-capture form names nobody but the lead company, which is why the consent stops there. Second, the onus of proving consent sits with whoever claims it: CRTC guidance says plainly that a sender using a third-party list “must still be able to prove that consent” meets CASL’s requirements, with records of the address, the date, and the method of consent. If the seller cannot hand you those records per contact, you cannot carry that burden, and the safe assumption is that you have no consent at all.

What you may actually have: the inquiry, not the list

The realistic footing for a purchased lead is your own, not the vendor’s. A person who asked to see homes, requested a valuation, or asked to be connected with an agent has made an inquiry, and answering that inquiry individually — a call, a text, a personal email that responds to what they asked — is a different act from broadcasting marketing at them. Where the introduction genuinely names you, an implied-consent argument on the inquiry becomes possible, and the CRTC’s implied-consent categories give an inquiry roughly a six-month life. Treat that as a window to convert the contact into your consented lead: respond fast, be useful, and capture express consent on your own form with your own unchecked checkbox. From that moment the contact’s consent history starts with you, provably — which is the position the general rules on emailing leads under CASL require anyway.

Aged lists: the clocks have already run out

“Aged” inventory fails twice. The implied-consent clocks are short — about six months from an inquiry, about two years from a genuine business relationship — so by the time a list is old enough to be discounted, whatever implied consent once existed has typically expired even against the original collector, let alone against you. And express consent, the kind that does not expire, is precisely the kind a resold spreadsheet cannot evidence for a sender it never named. Add ordinary decay — dead numbers, changed addresses, moved-on intent — and an aged list is a consent liability wrapped around a data-quality problem. Where aged contacts come from and why they exist at all is covered in where do lead companies get their leads.

Before you send anything: what to demand from the seller

Four artifacts, in writing: the exact consent language and form the person saw at capture; per-contact records of address, date, and capture method (the record set CRTC guidance expects a sender to hold); confirmation of whether and how you were identified at capture; and the mechanism by which an unsubscribe at either end suppresses the contact everywhere. Notice what is not on the list: an indemnity. CASL’s administrative monetary penalties land on the sender, and a vendor’s promise to reimburse you is not a compliance position. These questions belong in due diligence before purchase, alongside the rest of the pre-purchase checklist.

The compliant playbook, condensed

Respond to purchased leads individually and promptly, as answers to their inquiry. Do not enrol a bought list in automated email or SMS campaigns. Capture your own express consent early, with clear language and an unchecked box, and record it. Suppress the contacts who never respond instead of mailing them harder. And run it all on a system that does the bookkeeping — consent history per contact, expiry tracking on implied consent, a send gate that checks before any automated message leaves — which is the job a CASL-compliant CRM exists to do. Whether the leads were worth buying in the first place is its own question, priced honestly on buy real estate leads in Canada.