PusharooCASL and web push notifications
Canada’s Anti-Spam Legislation (CASL) governs “commercial electronic messages”. It clearly covers email and text messages; how it applies to browser push is less settled. The safe approach is to meet CASL’s requirements anyway — which, with web push, is mostly what good practice already looks like.
- CASL prohibits sending commercial electronic messages to an electronic address without consent.
- “Electronic address” covers email, instant messaging, telephone and “any similar account” — whether a push endpoint qualifies isn’t clearly settled.
- Browser permission is an explicit opt-in; make your prompt identify you and the kind of messages.
- Unsubscribing must be easy — with push, the browser always provides it; still offer your own option.
What CASL covers
CASL prohibits sending a commercial electronic message (CEM) — one that encourages participation in a commercial activity, such as an offer or promotion — to an electronic address unless the recipient has consented, and requires each CEM to identify the sender and include an unsubscribe mechanism. The Act defines an electronic address as an address used for an email account, an instant messaging account, a telephone account or any similar account. Penalties can be significant: administrative monetary penalties of up to $10 million per violation for organizations.
Does it apply to web push?
A web push subscription isn’t an email or phone number, and we’re not aware of specific CRTC guidance on browser push. Some argue a push endpoint is a “similar account”; others that it isn’t an account the person holds at all. Because the downside of being wrong is large and the cost of compliance is small, the sensible approach for Canadian senders — or anyone sending to Canadians — is to treat promotional push notifications as if CASL applies.
This is a practical overview, not legal advice. Laws and their interpretation change; check with a qualified lawyer for your situation.
Consent
- Express consent: the browser permission is an explicit, active opt-in. Strengthen it with a soft prompt that says who you are and what you’ll send — “Get deal alerts from Maple & Co.? 1–2 a week.”
- Keep records: note when and where each subscription was created (Pusharoo records subscription time and site).
- Don’t trick people: fake “click Allow to continue” pages undermine any claim of valid consent.
Identification and unsubscribe
| CASL requirement | How web push handles it |
|---|---|
| Identify the sender | Notifications show your site’s name/domain and your icon; your landing page should show business contact details |
| Unsubscribe mechanism | Browsers let users block a site’s notifications any time; add your own “Turn off notifications” button too |
| Honour within 10 business days | Browser blocks are immediate; process your own opt-out at once |
| Mechanism valid for 60 days | The browser setting is always available |
Transactional messages
CASL exempts or partly exempts certain messages, such as those that complete a transaction the person agreed to or provide warranty or safety information. “Your order has shipped” is very different from “20% off this weekend”. Keep the two clearly separate: transactional notices via the REST API to the customer’s subscription, promotions to people who opted in for them.
A cautious checklist
- Soft prompt names your business and the type of messages.
- Promotional sends only to people who subscribed for them (segments by tag help).
- A visible way to turn notifications off on your site.
- Business contact information on landing pages.
- Records of when and where subscriptions were collected.
For EU audiences see GDPR; for California, CCPA.
Questions
Does CASL apply to push notifications?
It clearly covers email and texts; for browser push it isn’t settled. The safe approach is to follow CASL’s consent, identification and unsubscribe rules for promotional push.
Is the browser’s Allow button enough consent under CASL?
It’s an explicit opt-in, but a soft prompt that identifies you and describes the messages makes consent much clearer.
What are CASL penalties?
Administrative monetary penalties can reach $10 million per violation for organizations.
Does CASL apply to non-Canadian websites?
CASL can apply when commercial messages are sent to or accessed from computers in Canada, regardless of where the sender is based. Get advice if Canada is a key market.
Is a browser permission prompt express consent under CASL?
It’s an affirmative action, but CASL expects clear identification and purpose. Your soft prompt should name your business and what you’ll send.
Keep reading
Web push notifications and GDPR
What a subscription is, consent, privacy notices, minimisation, rights requests and processors — at a practical level.
CCPA, CPRA and web push notifications
Whether push subscriptions are personal information under CCPA/CPRA, notices, requests, sale/share and vendors.
The push opt-in prompt, done right
Two-step soft prompts, timing rules, copy that converts, and what never to do on page load.
Push notifications for small and local businesses
What restaurants, cafés, salons, gyms and shops can send, when, and how to win subscribers in person.
Free for life. No limits.
Unlimited subscribers, campaigns and automations. No badges. About five minutes to install.