Plain-language summary, not legal advice. We wrote this to be read. If anything here is unclear, ask us.
Last updated: October 31, 2026
The short version
- Contact businesses about things that are relevant to them, and identify yourself.
- Follow Canada's Anti-Spam Legislation (CASL) — that's your responsibility, not ours.
- Never use the data to find, track or profile a person.
- Don't resell or republish the data without a data licence.
No spam: CASL is your responsibility
CASL applies to commercial electronic messages — email, text and instant messages — sent to or from Canada. Phone calls and in-person visits aren't commercial electronic messages under CASL (telemarketing rules may still apply). Here are the basics. They aren't legal advice; if you send at volume, get advice for your situation.
1. Have consent before you send
- Express consent is a clear yes, given in response to a request that says who's asking and why, and that the person can withdraw consent. It doesn't expire until it's withdrawn. A pre-ticked box doesn't count.
- Implied consent exists in narrower cases. The one most relevant to new businesses is conspicuous publication: the business has published its email address (for example, on its website or a public record) without saying it doesn't want unsolicited messages, and your message is relevant to its business role. Others include an existing business relationship (for example, a purchase in the last two years) and an enquiry in the last six months.
- A business licence record on its own usually doesn't include an email address, so it rarely gives you implied consent to email. Calling the published business phone number, then asking for consent to follow up by email, is a sound approach.
2. Identify yourself
Every commercial electronic message must name you (and anyone you're sending for) and include a mailing address plus a phone number, email or web address.
3. Make it easy to unsubscribe
Include an unsubscribe mechanism that works at no cost, and honour requests within 10 business days. Keep records of consent and unsubscribes.
Read more in the CRTC's guidance on CASL.
What you must not do
- Send bulk unsolicited email or texts, or any message that breaches CASL, the National Do Not Call List rules or similar laws.
- Harass, threaten, mislead or pressure anyone, or contact a business again after it has asked you to stop.
- Use the data to locate, identify, track or profile individuals — including owners, licence holders or employees — or to visit anyone at home.
- Try to re-identify residential or suppressed records, for example by combining FileSignal data with other sources to recover home addresses or personal names we removed.
- Resell, sublicense, publish or redistribute FileSignal data, or use it to build a competing dataset or train models offered to others, except under a signed data licence.
- Imply that a municipality or government endorses you or your message, or present FileSignal data as an official record.
- Share accounts or API keys outside your organisation, exceed or work around plan limits, or scrape the website or app.
- Probe, overload or attack the service, or use it to send malware or phishing.
- Use the data for decisions about individuals' eligibility for credit, employment, insurance or housing.
Professional rules still apply
If you're a lawyer, insurance broker, accountant or other regulated professional, your regulator's rules on advertising and solicitation apply on top of this policy.
Enforcement
If we see or are told about misuse, we may ask for information, restrict features, suspend or close the account, and report illegal activity. Report misuse of FileSignal data through our contact form.