To send a newsletter in Quebec you need two separate consents, usually collected in a single gesture: the one under the federal anti-spam law, which permits sending the commercial message, and the one under Law 25, which permits collecting and keeping the email address for that specific purpose. In practice, a compliant form shows three signs: an empty box the person ticks themselves, a sentence saying what the address is for, and a confirmation email.
The rest of this piece covers each of those points, then answers the question that stalls most SMBs: what to do with the list you have already accumulated. For the wider picture, see what Law 25 changes for your marketing. This is not legal advice.
Two laws, two different questions
That is where the confusion comes from, so let us clear it up straight away. Canada's anti-spam legislation, CASL, governs the sending: are you allowed to write a commercial message to this person? It requires consent before sending, your full identification in every email, and an unsubscribe link handled promptly.
Law 25 governs the data: are you allowed to hold this address, for how long, and for what purpose? It requires the purpose to be stated at the point of collection, consent to be requested separately for each use, and the data to be destroyed once the purpose is fulfilled. A company can therefore be perfectly compliant with CASL on its sending and in breach of Law 25 on its database. A well-built form settles both at once.
Your signup form, line by line
Four elements, and nothing else. The consent box has to be empty when the page loads: a pre-ticked box is not an active step, therefore not clear consent. The purpose statement has to be visible without clicking, and say what you will actually send — to receive our marketing tips and offers, roughly once a month beats to receive our communications. The company name has to appear, not just a logo. And the fields you ask for should be limited to what you need in order to send: the email address, possibly a first name. Asking for a phone number for a newsletter is collecting data with no stated purpose.
The commonest trap sits elsewhere: the quote form. Many SMBs automatically subscribe anybody requesting a quote to the newsletter. That is exactly what Law 25 forbids — two different purposes require two separate consents. The fix is one line: under the contact form, a separate empty box saying I also want to receive the newsletter. You will lose signups. You will gain a list whose open rates reflect real interest.
Asking for a quote is not subscribing to a newsletter. Two different intentions, two different boxes.
Double opt-in is not mandatory, but do it
Neither Law 25 nor CASL formally requires the confirmation email. What they do require is being able to prove consent — and that is where double opt-in earns its keep. It produces a timestamped record: this address, this day, this hour, clicked to confirm. If a complaint lands, that is the one document that saves you. Without it you are asserting a consent you cannot demonstrate, and the burden of proof falls on you.
It also removes typos, disposable addresses and malicious signups along the way. Your list shrinks by ten to twenty per cent, your open rates rise by as much, and your sender reputation improves. It is a rare case where the legal requirement and the commercial interest point the same way — a point we develop in our piece on the newsletter as the most profitable channel.
What to do with the list you already have
That is the real question, and the answer depends on where each contact came from. Sort your database into three piles. People who signed up themselves through a form announcing the newsletter: keep them, the purpose was clear. Active customers you have sold something to: you generally have some latitude, but it is not eternal and it does not cover every use. Contacts gathered some other way — business cards from a trade show, a partner's list, a purchased database, addresses found on company websites — never consented to anything.
For that third pile, the only clean way out is a re-consent campaign: a single send explaining where you got the address, what you send, and asking for confirmation by one click. Everybody who does not confirm comes off the list. Expect to lose most of the pile. That is the price of a defensible list, and what you are mainly deleting are addresses that were opening nothing.
Unsubscribing, retention, deletion
Three obligations that often get conflated. The unsubscribe link has to be in every send, work in one click, and be processed promptly — without requiring an account or a justification. Retention falls under Law 25: the address is kept for as long as the purpose exists. A subscriber who has opened nothing for two years no longer has an active purpose; removing them is both compliant and good for your statistics.
Watch the distinction that catches everybody: unsubscribing and deletion are not the same thing. Someone who unsubscribes has to stay on a suppression list, otherwise they will be re-added at the next import. Someone who asks for their information to be deleted is exercising a different right — you have to answer within thirty days and confirm what was done.
What it looks like in practice
An SMB that is compliant on this point has an empty-box form with a purpose statement, an automatic confirmation email, a separate box on the quote form, a source field filled in for every contact, a maintained suppression list, and an annual clear-out of inactives. That goes into place in half a day on any serious sending platform. The long part is re-consenting the old database — allow one campaign and three follow-ups.
If you do not know what state your list is in, or which end to pick it up by without losing your best contacts, that is exactly the kind of thing we untangle in fifteen minutes. Book the diagnostic call.