Compliance
Canada's rules are stricter than America's and the penalties are real. CASL violations carry administrative monetary penalties of up to $10 million for a business.
What compliance obligations apply to lead generation in Canada?
Four main regimes. CASL governs commercial electronic messages and requires provable express consent, with penalties to $10 million for a business. PIPEDA governs the collection, use and disclosure of personal information and grants access and deletion rights. Quebec's Law 25 imposes stricter consent and French-language requirements. The DNCL restricts telemarketing calls. The Competition Act separately prohibits unsubstantiated performance claims.
What we capture on every lead
This is the record you would produce in an audit.
| Captured | Why it matters |
|---|---|
| Exact consent wording | Not a summary or a version number — the literal text shown at that moment. Wording changes over time and you must show what this person saw. |
| Checkbox state | Proof of a positive action rather than a default. |
| IP address | Ties the submission to an origin. |
| Timestamp | Establishes when consent was given, to the second. |
| Landing page URL | Shows the context in which the request was made. |
| User agent | Corroborates a real browser session. |
| Certificate URL | TrustedForm or Jornaya reference, where the supplier provides one. |
| Traffic source and sub ID | Lets you trace a problem back to the exact source that caused it. |
The regimes, and what each requires of you
| Regulation | What it requires | Maximum exposure |
|---|---|---|
| CASL | Express or implied consent for commercial electronic messages, sender identification, working unsubscribe. Burden of proof on the sender. | $10 million (business) |
| PIPEDA | Consent for collection, use and disclosure. Access and deletion rights. Breach reporting. A named Privacy Officer. | Investigation, orders, reputational harm |
| Quebec Law 25 | Explicit consent, French-language rights, privacy officer, privacy impact assessments. | Up to 4% of worldwide turnover |
| DNCL | Scrubbing against the National Do Not Call List before telemarketing. | CRTC penalties per violation |
| Competition Act | No false or unsubstantiated performance claims in advertising. | Significant administrative penalties |
| AODA (Ontario) | Web accessibility for many Ontario organizations — build to WCAG 2.0 AA. | Provincial fines |
What we require of suppliers
Every supplier warrants that they obtained express consent meeting CASL’s standard, that they disclosed their real traffic source, and that their consent wording contemplates onward disclosure to buyers. We do not accept incentivized traffic, undisclosed co-registration, or purchased lists.
This isn’t gatekeeping for its own sake. One supplier’s shortcut becomes every buyer’s liability, and a marketplace that tolerates it stops being worth belonging to.
Leadz Marketplace provides tooling, not legal advice. Have a Canadian privacy or marketing lawyer review your consent wording, your buyer agreement and your supplier agreement before you go live. Budget for it properly — in lead generation the legal review is not overhead, it is the moat.
Compliance questions
What is CASL and how does it affect lead generation?
CASL is Canada’s Anti-Spam Legislation. It governs commercial electronic messages sent to or from Canada and requires express or implied consent, clear sender identification and a working unsubscribe mechanism. For lead generation the critical point is that the burden of proving consent falls on the sender, and administrative monetary penalties reach $10 million for a business.
Is a pre-checked consent box valid under CASL?
No. Express consent requires a positive action by the consumer, which in practice means an unchecked box they actively tick. A pre-checked box, or consent bundled inseparably into terms of service, does not meet the standard.
What is Quebec Law 25 and does it apply to me?
Law 25 is Quebec’s modernized privacy legislation and it is stricter than PIPEDA. It requires explicit consent, French-language rights, a designated privacy officer and privacy impact assessments for certain projects. It applies to anyone handling the personal information of Quebec residents, regardless of where the business is located.
Where is Canadian lead data stored?
Canadian lead data is stored in Canadian data centres. Most US-based lead platforms cannot offer this, and Canadian buyers increasingly ask.
Does Leadz Marketplace provide legal advice?
No. The platform provides tooling and record-keeping. Your compliance obligations as a sender remain yours, and you should have a Canadian privacy or marketing lawyer review your consent wording and your agreements before you go live.
Let's find out if this fits.
Fifteen minutes. Tell us your vertical, your volume, and what's broken about your current setup. If we're not the right fit, we'll tell you that too.