Black Friday falls on November 27. That is the week plenty of Quebec online stores switch on their abandoned-cart flow: someone types their email at checkout, closes the tab, and a few hours later gets a "You left something behind". The platform sets it up in two clicks. The legal question takes longer: this person bought nothing and never said yes to your emails.
The CRTC has answered in its FAQ on Canada's Anti-Spam Legislation (CASL), without settling it: it describes the reading merchants rely on, then advises them not to. Here is why the door is narrow. Then what Quebec's Law 25 adds, and what your store has to record for a follow-up to still hold up a year from now.
The short answer, for the busy
An abandoned-cart email is a commercial electronic message under CASL: it needs consent, sender identification and an unsubscribe mechanism. The transactional exemption does not apply, because it covers a transaction the recipient previously agreed to enter into, and an abandoned cart is precisely a transaction they did not agree to. The CRTC states that an abandoned cart is not a purchase and does not trigger the two-year implied consent period. Some merchants treat it as an inquiry, which would give six months of implied consent; the CRTC warns that this reading could expose them to complaints and recommends getting express consent at checkout, through an unchecked box the person ticks themselves. In Quebec, Law 25 rules out commercial prospection as a consistent purpose for personal information. The burden of proving consent, express or implied, sits with the merchant.
The cart reminder is a commercial message
CASL defines a commercial electronic message by its purpose. It covers any message that, given its content and links, "it would be reasonable to conclude has as its purpose, or one of its purposes, to encourage participation in a commercial activity" (s. 1(2)). An email that brings someone back to their cart with a "Complete my order" button has that purpose, with or without a discount. So section 6 applies: express or implied consent, sender identification, an unsubscribe mechanism.
That leaves the transactional exemption. Section 6(6)(b) exempts from the consent requirement a message that solely "facilitates, completes or confirms a commercial transaction that the person to whom the message is sent previously agreed to enter into". Your order confirmation qualifies. On our reading, the cart reminder does not: the person did not agree to the transaction, they walked away from it. The word "solely" also shuts out mixed messages: a reminder carrying a 10% code is no longer just a service message.
That leaves consent. Express, if the person ticked a box. Otherwise implied, and that is where the whole question sits.
Two years for a purchase, six months for an inquiry
The implied consent that matters here is the existing business relationship (s. 10(10)). It arises from a purchase "within the two-year period immediately before the day on which the message was sent" (paragraph (a)), or from "an inquiry or application, within the six-month period immediately before the day on which the message was sent", about something the person could buy (paragraph (e)).
On the purchase, the CRTC is categorical: "An abandoned online shopping cart is not a purchase and does not trigger the two-year implied consent period". On the inquiry, it does not rule. It reports a reading some merchants might adopt: depending on the checkout process, the steps taken and information provided "could be similar to an inquiry or an application related to a purchase", which would open the six-month window.
That reading has arguments. The person picked a product, entered their address, saw the final price. If a phone call asking about a price creates six months of relationship, a checkout that was started says at least as much.
So does the other reading. Abandoning checkout is an act, and the more natural way to read it is as a no; the address was given to receive a confirmation and an invoice. That is the CRTC's point: potential customers might consider that no business relationship was formed, and question the use of their personal information "if they initially provided it only for the purpose of billing and delivery of items, which were ultimately not purchased". Its conclusion: "It is best not to assume implied consent: if you are unsure, ask for express consent."
A store that sells to businesses has a third, narrower door. Section 10(9)(c) implies consent when the person disclosed their address without saying they do not want commercial messages, if the message is relevant to their business, role or functions. On our reading, a buyer who enters a work address to order supplies for their trade may qualify. A consumer buying shoes does not.
What Law 25 adds: the address given for delivery
On the Quebec side, the Act respecting the protection of personal information in the private sector cares less about the send than about the address itself, a piece of personal information collected for a stated reason. Its section 12 limits use to the purposes for which information was collected, unless the person consents or the purpose is consistent, and adds: "commercial or philanthropic prospection may not be considered a consistent purpose." An email pushing someone to finish a purchase looks a lot like commercial prospection.
Timing matters too. Shopify treats a checkout as abandoned if it stays incomplete for more than ten minutes after the customer has provided their email. The address is collected well before any order. Section 8 requires informing the person of the purposes "when the information is collected", and section 8.3 provides that someone who supplies their information after that notice consents to its use for those purposes. If you plan a reminder, say so next to the email field, not in a policy nobody opens. Our article on Law 25, cookies and website forms covers the form itself.
A Law 25 notice is not consent under CASL, and the reverse is also true (CASL's general rules are in our newsletter article).
What makes a follow-up defensible
The solid route is the one the CRTC recommends: a consent box at checkout. It must start unchecked. In the CRTC's words, "You cannot use a pre-checked box to request consent from a consumer as it assumes consent." It must be separate from the terms of sale: in Information Bulletin CRTC 2012-548, the Commission writes that "persons must be able to grant their consent to the terms and conditions of use or sale while, for instance, refusing to grant their consent for receiving CEMs." And the request must name the business, give its mailing address and a way to reach it, and state that consent can be withdrawn (CRTC regulations, s. 4).
Shopify lets you choose the regions where the email marketing consent box is pre-checked, and notes that its own recommendations "don't constitute legal advice". For Canadian customers, the box should arrive empty. Its abandoned-checkout automation also lets you pick which customer group it writes to: check which one.
Without a ticked box, you are betting on the "inquiry" reading, which the CRTC warns could draw complaints. If you make that bet, shrink it: one plain reminder within days, nothing after six months. The law draws no line between a plain reminder and a discount offer. But three emails with escalating discounts multiply the messages resting on a contested reading, and in our view that kind of sequence is what feeds complaints.
Either way, each message carries the business name, a mailing address and contact details valid for at least 60 days, and an unsubscribe link honoured no later than 10 business days after the request (ss. 6(3) and 11(3)). And a reminder that lands in spam does nothing (see our article on SPF, DKIM and DMARC).
The proof has to outlive the cart
Section 13 of CASL puts the burden of proving consent on whoever claims it. The CRTC gives an example of acceptable written consent: a checked box on a web page, where "a record of the date, time, purpose, and manner of that consent is stored in a database".
This is where the standard store falls short. Shopify automatically deletes abandoned checkouts older than three months from the admin. Yet the "inquiry" window runs six months, and proceedings for a violation can begin up to three years after the matter became known to a person designated by the CRTC (s. 23(1)). Send a reminder in month four on the strength of the inquiry, and the trace of that inquiry is already gone from your own tool.
The fix is the same as for strikethrough price history: a log you append to and never rewrite. For each address, the consent basis (ticked box, purchase, inquiry), the date and time, the page and checkout step it came from, the exact wording shown next to the box, then every unsubscribe. At send time, the store recalculates eligibility: an inquiry expires at six months, a purchase at two years, express consent never, unless withdrawn. People who tick the box then join your list, and the newsletter takes over.
We plan for that log in the stores we build (to start from scratch, see our guide to starting an online store in Quebec).
Where to start before November 27
Go through your checkout as a customer, from Quebec. If the consent box arrives pre-checked, choose the pre-checked regions yourself in your settings and leave Canada off the list. If there is no box, add one: unchecked, separate from the terms of sale, with a clear sentence next to the email field. Check who your reminder writes to. Finally, ask whether your store can answer, for any given address, "on what basis did we write to them, and since when?". If it can't, that is what to wire up before Black Friday.
→ Let's talk about your store before Black Friday
This article explains legal rules to help a small business ask the right questions. It is not legal advice: whether an abandoned cart counts as an inquiry has not been settled, and the analysis depends on your checkout process and your messages. Check your situation with a lawyer. The text of Canada's Anti-Spam Legislation, its regulations and Quebec's Act respecting the protection of personal information in the private sector prevails.
Written byXavier Peich