$500,000. The Biggest CASL Cheque Yet. Will You Write the Next One?
On October 1, 2026, the CRTC announced the largest payment ever made under Canada’s Anti-Spam Legislation (CASL). PH Canada Company, which does business as Pizza Hut, agreed to pay $500,000.
This was not a small technical slip. The CRTC alleged three things over 13 months, from January 2025 to February 2026:
- Messages were sent to people who had never given permission.
- People who unsubscribed were not removed within the required 10 business days.
- Some messages had no unsubscribe link at all.
These rules aren’t hard. They’re the basics. No permission. No email. Make it easy to say no. And when someone says no, STOP.
The old record was $200,000
When I wrote CASL Compliance: A Marketer’s Guide to Email Marketing to Canadians, the early cases were teaching moments. Porter Airlines paid $150,000. Rogers Media paid $200,000. Compu-Finder was hit with $1.1 million, which was later cut to $200,000. Since then, many marketers have decided CASL is a paper tiger. The thinking goes: “Enforcement is slow, the fines are small, and nobody is watching.”
The new payment is two and a half times the old record, and the conduct behind it ended only months before the deal was signed. The CRTC is watching.
A word to those who know better
Some organizations break CASL by mistake. The CRTC has always made room for them. A documented compliance program, trained staff and good records go a long way toward a due diligence defence.
This article isn’t for them. It’s for organizations that know their lists are dirty and their unsubscribe process is broken, and have decided the odds are in their favour.
Fact is, every Canadian who gets your unwanted email can report it to the Spam Reporting Centre in about 30 seconds. Every report goes into a file. As I wrote years ago, the enforcing bodies are collecting data, and when they have enough, they come knocking. You won’t know how thick your file is until the knock comes.
Keep in mind that a penalty under CASL can reach $10 million per violation for an organization. A $500,000 undertaking with full cooperation is the good outcome.
The agreement also has teeth beyond the cheque. The company has to review and strengthen its compliance program, and it has to make sure any third party sending messages on its behalf follows the law too. Your email vendor’s mistakes are your mistakes.
What to do Monday morning
- Audit your lists. Can you prove how and when every person gave you permission?
- Test your unsubscribe. Click it yourself. Then check whether you’re really removed within 10 business days.
- Check every template. Every message needs your name, contact details and a working unsubscribe.
- Talk to your vendors. Get their compliance commitments in writing.
Organizations will comply, or they won’t. The ones who won’t have just seen what that costs.
Derek Lackey is the founder of Newport Thomson and author of CASL Compliance: A Marketer’s Guide to Email Marketing to Canadians.
