Last reviewed: October 14, 2026
Your campaign workflow probably treats push, email, and SMS as one program. The rules treat them as three. Each channel needs its own answers on message purpose, consent, sender identity, and withdrawal, and a gap in one can undercut the work you did on the others.
Canada’s Anti-Spam Legislation, or CASL, sets rules for commercial electronic messages and for installing computer programs, and it prohibits altering transmission data without authorization. It applies to individuals, businesses, and not-for-profits that send electronic messages for commercial purposes, and penalties can reach $10 million per violation for an organization, according to the CRTC’s CASL FAQ.
CASL defines a commercial electronic message as one that encourages participation in commercial activity, such as an advertisement or information about a promotion, offer, business opportunity, or event. Email, SMS, instant messages, and social-network messages all count as electronic messages.
Push notifications call for a content-based assessment. Delivery method alone doesn’t place a push inside or outside CASL. Look at what the message says and what it asks the recipient to do, then have Canadian counsel review product updates, mixed-purpose messages, and anything else you can’t classify with confidence.
This guide compares CASL, the U.S. Telephone Consumer Protection Act (TCPA), and the EU’s General Data Protection Regulation (GDPR) at a practical level. It isn’t legal advice. Get legal review for jurisdictional edge cases, message classification, consent language, and carrier or app-platform requirements.
CASL, TCPA, and GDPR requirements by channel
Which rules apply depends on where the recipient is and what the message is for, and you answer for both your own country’s laws and your recipient’s. Many jurisdictions, including the EU under GDPR and Canada under CASL, require consent before marketing email, and CASL allows implied consent only in limited cases (the checklist below covers them).
OneSignal’s email compliance documentation lists the major regions.
Promotional SMS needs an affirmative opt-in. Transactional messages and one-time passcodes carry a lower consent bar when they relate directly to why you collected the phone number. Consent is also scoped to purpose: someone who agreed to shipping updates hasn’t agreed to promotions, so collect each separately.
Purchased, rented, or shared contact lists don’t meet the SMS consent standard in any jurisdiction OneSignal supports. Build every list through a direct, recorded interaction with the subscriber.
Use the matrix below as a planning aid. U.S. marketing email falls under CAN-SPAM rather than the TCPA, which centers on calls and texts. A dash means this guide doesn’t establish a verified rule for that cell, so check current official U.S. and EU guidance and talk to counsel before treating any row as settled.
A CASL checklist for Canadian app marketers
Run this checklist before you build or approve a campaign for recipients in Canada. CASL compliance Canada takes coordination across marketing, product, engineering, CRM, and legal, because both the message content and your operational controls affect your risk.
Determine whether the message is commercial
- Read the message’s text, destination, offer, and call to action.
- Decide whether it encourages the recipient to take part in commercial activity.
- Write down your classification and why.
- Follow the whole user journey when a neutral-looking notification opens promotional content.
- Send uncertain push notifications, in-app messages, product updates, and mixed-purpose messages to legal.
Calling something a “service message” doesn’t settle its classification, so judge it by what it communicates and the action it encourages.
Collect and prove valid consent
Express consent means the recipient actively gave permission. Implied consent applies only in specific situations: a purchase from you in the last two years, an inquiry about your products in the last six months, or an email address the recipient published conspicuously, without restriction, where your message relates to their business role (see the CRTC’s implied consent guidance). The CRTC has flagged cart abandonment as a gray area, so have counsel confirm your facts support implied consent before you rely on it.
A request for express consent should:
- Say plainly what you’re asking consent for.
- Name who is asking.
- Name any other party on whose behalf you’re asking.
- Include a mailing address plus a phone number, email address, or web address.
- State that the recipient can unsubscribe.
You carry the burden of proving consent. Keep timestamped evidence of opt-ins and opt-outs from form submissions, keyword replies, and API events, and tie each event to its channel, stated purpose, user, disclosure, and collection source.
Keep purposes separate. Someone who asked for account alerts hasn’t agreed to discounts or product promotions.
CASL’s software rules matter to app teams, too. Apps a person installs from an app store fall outside them, but an update that installs in the background without telling the person can fall inside them. Under the CRTC’s guidance on installing computer programs, ask for consent to future updates at install.
Include required sender information and unsubscribe options
Every commercial electronic message must identify the sender and, if different, the party it’s sent on behalf of. It must also carry a mailing address plus a phone number, email address, or web address, and a no-cost unsubscribe mechanism that’s easy to use. CASL gives you up to 10 business days to act on an unsubscribe request, and the CRTC says your contact details and unsubscribe mechanism should stay valid for at least 60 days after you send (see the CRTC FAQ).
Test your unsubscribe route as a recipient would. Confirm that the link, reply, form, or preference control works and that the suppression reaches every connected campaign system. The CRTC treats a multi-step process, such as one that requires a login, as too hard to complete, and BLG’s CASL reminder for the mobile-app industry calls for a mechanism that is effective and promptly implemented. Ten business days is the legal outer limit. OneSignal’s own SMS guidance says to process opt-outs as fast as you can, ideally immediately.
Complete this pre-send review:
- Message classification confirmed
- Audience jurisdiction checked
- Consent evidence available
- Sender identity complete
- Unsubscribe path tested
- Suppression lists applied
- Sender resource approved for the use case
- Exceptions reviewed by counsel
These controls are a practical way to apply Canadian Anti Spam Legislation rules. They don’t replace a legal assessment of your campaign.
Build a consent lifecycle across push, email, and SMS
Consent management spans collection, storage, use, withdrawal, and suppression. Map each stage to an operational control, then test how consent changes travel between your app, website, customer database, and messaging provider.
Platform settings can support your CASL, TCPA, and GDPR processes, but they can’t tell you whether a particular message or audience is lawful.
Push notification permission and withdrawal
Push involves two separate controls:
- User-level data consent: permission to collect or send data through the messaging SDK.
- Channel-level message permission: a subscription permission to receive push notifications on a particular device or channel.
Consent gating lets you hold back SDK data collection until a user explicitly agrees. Enable the consent requirement before you initialize the SDK. Until consent is granted, the SDK collects and sends nothing and ignores any calls made beforehand, and the saved state persists across sessions.
OneSignal’s handling personal data documentation covers the methods.
Revoking data-collection consent doesn’t automatically remove a push permission the user already granted. If someone wants notifications to stop, call the documented opt-out method before you revoke data consent. They can also turn off notifications in device settings or uninstall the app.
Keep this sequence separate from legal message classification. A device that can receive push may still lack the consent you need for a commercial campaign.
Email subscription and unsubscribe management
Every marketing email needs a visible, working unsubscribe link, labeled clearly as an unsubscribe or subscription-management option. Don’t make people log in or click through extra steps first.
Route unsubscribe events into one central suppression process, so a later audience import, segment update, or automated journey can’t put an address back into a marketing campaign without fresh, valid consent.
GDPR and similar laws expect opt-outs to be honored immediately or without undue delay. CAN-SPAM and CASL both allow up to 10 business days, but don’t plan around the maximum. Build the fastest suppression process you can instead of waiting on a scheduled database update.
Keep transactional email tied to the service purpose that justified collecting the address. Review cross-sell modules, promotional banners, and other commercial additions before they land inside a transactional template.
SMS opt-in, STOP handling, and suppression
Promotional SMS needs an affirmative action: an unchecked checkbox, a keyword reply, or a form submission with clear disclosure. Pre-checked boxes, bundled consent, and consent inferred from silence fail OneSignal’s documented standard in every jurisdiction it supports.
Every SMS has to identify who’s sending it. Put your brand name in the message body, even when you send from an alphanumeric sender ID, since some devices don’t display the sender ID prominently.
Sender resources that can receive replies should include STOP instructions. An alphanumeric sender ID can’t receive replies, so include an unsubscribe link instead. Honor opt-outs promptly, ideally the moment your system receives them.
Apply suppression across scheduled messages, active automations, imported audiences, and API-triggered campaigns. Keep transactional and promotional permissions separate so an opt-out gets the right operational treatment after legal review.
Consent evidence and audit readiness
A useful consent record preserves:
- The channel
- The specific purpose
- The disclosure or form version
- The collection method
- The event timestamp
- The user or subscription identifier
- The originating page, keyword, or API workflow
- The opt-out event, where available
Treat these fields as a recommended audit practice, not a statutory checklist. They let your team reconstruct what the subscriber saw, what they did, and how your downstream systems responded.
Sending email addresses, phone numbers, names, or other personal attributes to a messaging provider requires appropriate consent from you as the sender. Send only what a campaign needs, and restrict who can see consent records.
Use messaging-platform controls to support compliance operations
OneSignal provides controls that can support consent collection, audience management, suppression, and auditing across push, email, and SMS. You remain responsible for identifying which laws apply, configuring each control correctly, and maintaining valid consent.
A journey that ran successfully tells you the workflow executed. You still need separate evidence that each recipient entered it lawfully.
Separate consent data from audience targeting
Store consent as its own record, and don’t treat segment membership as proof of permission. Custom user metadata can hold preferences, behaviors, and properties, and dynamic segments can then target by behavior, location, tags, and subscription status.
OneSignal’s API documentation also covers automating messages, managing users, and tracking delivery, so you can build auditable consent-record workflows and sync suppression events.
If you collect an email tracking preference, you can record it in a data tag, such as a true or false value. For campaigns where tracking should stay off, a secondary sending subdomain without a CNAME tracking record avoids logging open or click events. Keep in mind that omitting the tracking CNAME turns off open and click data for every email sent through that sender.
A no-code journey can coordinate onboarding, retention, and re-engagement messages across channels. Before anyone enters, check channel permission, message purpose, jurisdiction, and suppression status as separate conditions.
Control timing and approved SMS use cases
A journey time window can use the recipient’s local time zone, when available, to limit sends to selected periods. OneSignal has no built-in quiet-hours feature for SMS, so you’ll need to configure workflows that respect local restrictions yourself.
Send promotional SMS only during appropriate local hours. OneSignal’s documented SMS recommendation for Canada is 9 AM to 9 PM local time. Treat that as operational guidance, since it isn’t a full statement of Canadian law.
Use each sender resource only for its approved purpose. Promotions sent from a resource approved for transactional traffic can lead to campaign suspension or revocation of the sender resource.
Document the approved uses beside each sender resource: countries, message categories, owning team, escalation contact, and permitted workflow types.
Monitor opt-outs and maintain suppression
Send channel opt-outs into a shared suppression layer, and keep the reason and scope of each request. Someone can withdraw promotional SMS consent and still keep account-alert email, subject to your legal analysis.
Watch for failures between inbound replies, unsubscribe pages, your customer database, and active journeys, and reconcile source systems regularly so a stale audience can’t reintroduce a suppressed contact.
Set alerts for slow opt-out processing, failing unsubscribe endpoints, and campaigns that target records without the required consent status. Restrict manual overrides and log who made each change.
p12 certificates are push authentication, not marketing consent
Apple requires an authenticated connection before you can send push to iOS. In OneSignal you can authenticate with a token-based .p8 key or a certificate-based .p12 file, and you only need one. The .p8 key is the recommended option because it doesn’t expire and works across all apps under your Apple Developer account, while a .p12 certificate is app-specific and expires after one year.
Neither credential is a consent mechanism. Authentication tells Apple you’re allowed to send, and it says nothing about whether a user granted channel permission or agreed to a particular promotional message. Don’t treat a .p12 certificate or a .p8 key as a CASL, TCPA, GDPR, or marketing-consent mechanism.
If you’re setting up or renewing iOS push, follow OneSignal’s current setup guidance and Apple’s developer documentation, since requirements and terminology can change. If you still use a .p12 certificate, put its annual renewal on your calendar, because a lapsed certificate puts delivery at risk.
Once push delivery works, apply the consent lifecycle above. You still need controls for channel permission, audience selection, withdrawal, suppression, and legal message classification.
Keep the compliance program current
Compliance needs ongoing legal and technical review. Regulations, enforcement guidance, carrier policies, consent interfaces, and platform APIs all change.
Use this governance checklist:
- Review consent language before changing forms, disclosures, or campaign purposes.
- Test unsubscribe routes and suppression behavior across every connected system.
- Confirm that sender resources remain aligned with their approved use cases.
- Audit consent records for missing purposes, timestamps, or disclosure versions.
- Reassess applicable jurisdictions whenever audience targeting expands.
- Review SDK, API, email, and SMS configuration changes with technical owners.
- Escalate uncertain classifications and exceptions to qualified counsel.
OneSignal’s SMS guidance lists CTIA guidelines in the U.S., CASL in Canada, GDPR and PECR in the UK and EU, and the Spam Act in Australia as country-specific frameworks. Add the TCPA to that list for U.S. texting, since it’s federal law and not an industry guideline. These regimes share core principles like consent, identification, and opt-out handling, and those shared principles don’t remove local requirements.
Before relying on any rule in a live program, check current guidance from the CRTC and the Government of Canada, the FCC for the TCPA, and the European Commission or your supervisory authority for GDPR. U.S. rules are moving, too: the FCC adopted amendments to its TCPA consent-revocation rules on September 30, 2026, as law firm alerts describe. Confirm the final text and effective date before you change how you handle opt-outs.
Set a recurring legal and technical review. Record the review date, the reviewer, the jurisdictions affected, and any control changes you require.
Conclusion
A sound compliance process starts by classifying each message and identifying the recipient’s jurisdiction. From there, collect consent for a specific purpose, give clear sender information, keep an opt-out path that works, and retain evidence of both consent and withdrawal.
Push, email, and SMS share these principles but need different controls to carry them out. A messaging platform can support those controls, while you and your counsel remain responsible for jurisdiction-specific decisions under the CASL anti spam law Canada, TCPA, GDPR, and other applicable requirements.
