CASL Text Messaging Rules for Canadian Dealerships
TLDR: CASL applies to every text message a dealership sends, not just email marketing blasts.
- Implied consent to text a customer expires 24 months after a completed purchase, lease, or service transaction, or 6 months after an inquiry that didn’t convert – and consent is channel-specific, so an email opt-in does not cover SMS
- Maximum administrative penalties reach $10 million per violation for an organization and $1 million for an individual; the CRTC settled with Hudson’s Bay Company for $120,000 in 2024 over commercial messages sent without a working unsubscribe mechanism
- Not every text needs consent: appointment reminders, vehicle-ready notifications, and recall or warranty notices are transactional messages, exempt from CASL’s core consent rules – but only as long as they stay purely informational
- Director and officer liability applies, so a dealer principal or GM can be named personally in a CASL investigation regardless of dealership size
- Dealerships that text customers for service status updates see materially higher CSI scores, so the answer isn’t to text less – it’s to text correctly
Somewhere in your dealership’s customer records right now is a list of phone numbers your BDC or service department has texted in the last 24 months. Almost none of those contacts have a documented consent date, source, or type attached to them, because dealership texting is generally treated as an operational habit, not as an activity governed by Canada’s Anti-Spam Legislation. That gap is not a theoretical risk. In 2024 the CRTC settled with Hudson’s Bay Company for $120,000 over commercial messages sent without a functioning unsubscribe mechanism – the kind of gap that shows up the moment a regulator or a disgruntled customer asks how consent was obtained.
Why a Text Counts as a Commercial Electronic Message
CASL treats SMS the same way it treats email: both are “commercial electronic messages” (CEMs) if their purpose is to encourage a commercial transaction – a service reminder tied to an upsell offer, a sales follow-up, an event invitation, a “we miss you” campaign. Every CEM needs three things: consent to send it, clear identification of who’s sending it, and a working way to unsubscribe that the dealership honours within 10 business days.
Where dealers get tripped up is assuming that because a message is short, or sent from a personal-feeling number, or “just a reminder,” it falls outside the law. It doesn’t. The Canadian dealership compliance guide covered CASL’s basic shape alongside PIPEDA and Quebec’s Law 25 – this piece goes deeper into the part that trips up texting specifically: what actually needs consent, what doesn’t, and what it costs a dealership to get wrong.
Not every text is a CEM. Guidance on business texting distinguishes between messages that promote something and messages that only relay information about an existing transaction or relationship – a password reset code, a shipping notification, an appointment reminder, a recall or warranty notice. A text that says “your vehicle is ready for pickup” is transactional. A text that says “your vehicle is ready for pickup – and by the way, we have a service special this month” is not. The moment a promotional element enters the message, it becomes a CEM subject to the full consent regime, even if 90% of the text is legitimate status information. Dealerships that bundle upsell language into status texts to save a second message are the ones most likely to convert an exempt message into a compliance problem.
The Consent Clock: How Long You Can Actually Text Someone
CASL recognizes two paths to sending a CEM: express consent (the customer affirmatively opted in) and implied consent, which applies automatically under specific conditions. For dealerships, implied consent runs on two clocks:
- Existing business relationship: 24 months from a completed purchase, lease, or service transaction. Each new transaction resets the clock, so an active service customer effectively stays “opted in” indefinitely as long as they keep coming back.
- Inquiry without a transaction: 6 months from the date a prospect submitted contact information without buying or booking anything – a trade appraisal request, a “check availability” form, a test drive inquiry that didn’t close.
Once either window closes, sending a CEM requires express consent obtained beforehand. And critically, consent is channel-specific: a customer who checked a box to receive service reminder emails has not thereby consented to receive text messages. Text and email require separate consent records – a dealership that only tracks a single “opted in” flag per customer, rather than per channel with a timestamp and source, cannot actually demonstrate which channel that consent covers if asked.
When Enforcement Gets Real
The CRTC’s Hudson’s Bay Company undertaking, effective June 10, 2024, is instructive because it wasn’t about consent at all – it was about messages sent between January 2022 and November 2023 without a functional, easy-to-use unsubscribe mechanism, violating CASL’s identification and unsubscribe provisions. HBC agreed to pay $120,000 and to overhaul its CASL compliance program, including staff training, complaint tracking, and ongoing auditing. No allegation of malicious intent was required – an unsubscribe link that didn’t work reliably was enough to trigger a six-figure settlement with a major national retailer.
The statutory ceiling is far higher than what HBC paid: administrative monetary penalties can reach $10 million per violation for an organization and $1 million for an individual, and CASL’s director and officer liability provisions mean penalties aren’t limited to the corporate entity. A dealer principal or general manager whose name is on the compliance program can be named personally in an investigation. The CRTC calibrates actual penalties to the scale and nature of the violation – a single-rooftop dealer sending a few thousand texts a year is not going to draw an HBC-sized settlement – but “we didn’t know our unsubscribe link was broken” is not a defence, and the investigation itself, regardless of outcome, costs time, legal fees, and reputational standing with customers.
Vendor contracts matter here too. If a third-party texting platform sends the message on the dealership’s behalf, the dealership is still on the hook – CASL’s liability follows who benefited from the message, not just who clicked send. A vague answer from a texting vendor about how it handles consent or unsubscribes becomes the dealership’s problem during an investigation, not the vendor’s.
What This Means for Your Dealership
The instinct after reading all of this might be to text less. That would be the wrong lesson. Dealerships that use text messaging for service status updates see 50 to 80 points higher CSI scores, and automatic status notifications more broadly increase customer satisfaction by up to 30% and make customers 80% more likely to return for future service and purchases. Texting works. The fix is being able to prove compliance when asked, not sending fewer messages.
Start with an audit, not a policy document. Pull your current SMS-eligible customer list and check what consent actually exists behind it – if the honest answer is “we just text whoever gave us a number,” that’s the gap to close first, and it should happen before the next marketing text campaign goes out, not after a complaint arrives.
Concretely:
- Separate your transactional texting (service reminders, ready-for-pickup alerts, delivery status) from promotional texting (specials, event invites, win-back campaigns), so a status update never accidentally carries an upsell line that turns it into a CEM.
- Document consent for every SMS opt-in going forward – the date, the source, and which channel it covers, since an email opt-in does not cover text.
- Track the 24-month (transaction) and 6-month (inquiry) implied-consent windows so a contact doesn’t stay on the eligible-to-text list after the legal window has closed.
- Test your unsubscribe process the way a customer would – reply STOP from a real phone and confirm suppression happens within days, not whenever someone checks a report.
- Put consent handling and opt-out response times in writing with every texting vendor before the next contract renewal; the dealership carries the liability regardless of which platform sent the message.
None of this requires texting less. It requires being able to show, if asked, exactly when and how a customer agreed to hear from you – which is a lower bar than most dealerships assume, and a far cheaper one to clear now than after a complaint reaches the CRTC’s desk.