Compliance: CASL for your database

Most agents inherit their database problem: years of open-house sheets, imports, referrals, and purchased lists merged into one blob with no memory of who agreed to what. CASL does not care how the blob formed — every commercial message you send needs a live consent basis, the required identification, and a working unsubscribe. This lesson is the audit that turns the blob into a database you can lawfully use. The sending rules themselves live at can I email leads under CASL; the daily capture workflow is the CRM playbook consent lesson. This is the compliance-track view: the one-time clean-up and the message obligations.

Step 1: sort every contact into a basis

Go segment by segment and assign what you can actually evidence: express (a standalone, unbundled yes), implied (an inquiry or a business relationship, each with an expiry clock), or unknown. Be ruthless about the third bucket — a contact you merely possess is unknown, and unknown means no commercial email. Purchased and scraped lists land here almost by definition. This sort is the audit; every later step just acts on it.

Step 2: date the implied bucket

Implied consent expires — roughly six months from an inquiry, roughly two years from a client relationship. So implied without a date is a time bomb: record the event and the date that started each clock, and flag every contact whose window is already closed or closing. Expired implied consent moves to unknown, however warm the relationship felt.

Step 3: fix the message, not just the list

CASL regulates the message too, and this is the half agents forget. Every commercial send must identify who it is from with real contact information and carry an unsubscribe that works immediately and gets honoured promptly. Check your newsletter template and your CRM’s sending defaults once — on a properly built system the footer identification and one-click unsubscribe are structural, and suppression is enforced ahead of any consent you hold. The same requirements chase every channel, including text messages.

Step 4: run re-permission on the closing windows

For implied contacts still inside their window, send a plain, honest ask: do you want to keep hearing from me? A confirmation click records express consent with evidence attached, which never expires until revoked. Send it while the clock is still running — after expiry the email lane is closed and you are down to the phone and the doorstep.

Step 5: quarantine, do not delete

Unknowns and expired contacts should be unmailable, not erased — privacy law gives them their own lifecycle, covered in the privacy lesson. Park them in a suppressed segment. If they inquire again someday, a fresh clock starts honestly.

What done looks like

Every contact carries a basis and a date. Nothing unknown is mailable. Templates identify you and unsubscribe cleanly. And the audit never needs repeating, because capture now records consent at the moment it happens.

The mistake that costs the most

Sending one last broadcast to everyone before the clean-up — usually framed as a re-introduction email. That send is itself a commercial message to hundreds of people you hold no basis for, and it turns a quiet compliance debt into an active violation with complaints attached. Sort first, ask permission second, send third.