The CRTC has received 4.1 million complaints about spam since 2014, so why has it only taken action 34 times?

When you think of spam, your first thought might be of someone posing as a foreign dignitary in need of financial assistance. Or maybe you’re a business owner receiving suspect emails containing vague promises to redesign your website. Perhaps you’re concerned about more sophisticated scammers who impersonate your telecommunications service provider, your bank, or the Canada Revenue Agency. But spam isn’t just emails from bad actors attempting to swindle you out of your life savings — at least, not according to the Government of Canada. In 2010, the federal government passed Canada’s Anti-Spam Legislation, or CASL, which came into effect on July 1, 2014. CASL defines spam as any unsolicited commercial electronic message (CEMs), no matter how well-known the brand, or how legitimate the intentions of the sender. Aside from some narrow exemptions, CASL’s CEM requirements apply to text messages, social media messages, and nearly any electronic communication aside from an old-fashioned phone call. Also considered spam under CASL is the unauthorized alteration or transmission of data, the installation of any computer programs without consent, false or misleading electronic representations (including websites), electronic address harvesting, and the collection of personal information by accessing an electronic device illegally. CASL is widely considered to be one of, if not the, strictest anti-spam laws in the world. Yet, a quick look at the law’s enforcement over the last 12 years tells a more lenient story. Between July 2014 and June 2026, the CRTC’s spam reporting centre received roughly 4.1 million complaints, which have resulted in only 34 enforcement actions under the legislation. If you filter out procedural disputes, only 25 of the enforcement actions involve penalties or requirements imposed on violating parties. Canadian litigator and internet lawyer Maanit Zemel theorizes the low enforcement actions can be largely attributed to a lack of resources. Zemel pointed out how much the CRTC has on its plate. On top of CASL, it enforces Do Not Call rules, the Voter Contact Registry, and the Online News Act, as well as regulating telecommunications and broadcasting writ large. “It’s just a matter of practicality,” Zemel said in an interview earlier this year. “They don’t have enough resources to actually investigate and prosecute the millions of complaints .” A senior CRTC official told The Wire Report the number of reported complaints can be inflated, since it includes repeat submissions, complaints of criminal activity that get re-directed to law enforcement, complaints that are not actually spam, and complaints that come under the purview of the privacy commissioner or the Competition Bureau. The official, who asked to remain anonymous in order to discuss the regulator’s enforcement, added that much of the CRTC’s work is preventative, and happens behind the scenes through educational initiatives and stakeholder engagement to ensure compliance. Those consistent efforts, they said, aren’t reflected in the enforcement actions published online. “I have the resources that are allocated to me, and I’m trying to be as efficient as I can with this,” the official said. “The reality is, I probably can get the entire CRTC working on this, and we still would have plenty of work for everyone.” CASL applies to any entity communicating with Canadians, whether or not they are based in the country. According to David Elder, a privacy lawyer at the Toronto firm Stikeman Elliot, the commission’s limited ability to crack-down on foreign spammers is another hurdle for enforcement. Elder told The Wire Report there have been a number of CASL cases involving the cooperation of foreign jurisdictions. Without that partnership, he said, the commission’s hands are essentially tied. “CASL gives the commission a pretty good toolbox for investigation and enforcement, but those powers are limited to Canada to organizations that are in Canada,” Elder said. Elder also said malicious spammers will deliberately locate themselves in jurisdictions “blind” to their criminal actions, making it difficult to procure enforcement cooperation. When asked whether there is a way to make CASL more effective, Elder said, “I don’t know how you get around the jurisdictional issue.” “I suppose they could issue a notice of violation in absentia, but what does that do?,” he said. “You publish it, there’s a fine sitting there, they can’t collect it.” Enforcement decline a result of shifting focus, says Elder The early years of CASL enforcement were notably busier and, until 2018, enforcement actions per year were between three and seven. From 2019 onward, the CRTC took only one or two enforcement actions each year, with the exception of 2022, which saw five. At the time of writing, there have been no enforcement actions in 2026. “I’m not sure that’s a bad thing,” Elder said of the decline. Elder said several well-known companies were "very publicly penalized” immediately following CASL’s introduction for violating requirements on electronic messages. Between 2015 and 2016, the CRTC went after Porter Airlines Inc., Rogers Communications Inc.’s sports and media branch, and Kellogg Canada. “In many cases, they were kind of inadvertent or . . . maybe negligent cases, but they weren’t bad actors,” Elder said of the companies. The companies were accused of sending commercial electronic messages without consent, having faulty unsubscribe mechanisms, or not fulfilling an unsubscribe request within 10 business days. For their alleged infractions, Porter agreed to pay $150,000, Rogers was fined $200,000, and Kellogg paid $60,000, along with each company implementing a CASL compliance program. While lack of resources and foreign enforcement power may pose challenges for the rate of enforcement overall, Elder attributes the drop in actions over the years to a shift in focus. He suspects the CRTC has chosen to allocate more attention to fighting the most dangerous and deceptive types of spam. “That makes a lot of sense to me. I think that’s good use of the tools and resources that the commission has available. I care less about getting an email that I don’t want from a known brand than I do about malware and botnets and the dark web,” he said. “These are not legitimate businesses. We’re talking about organized crime.” Penalties determined on a case-by-case basis Part of what makes CASL so severe is the size of the administrative monetary penalties (AMPs) the CRTC can impose. The maximum amount per violation is $1 million for an individual, and $10 million for a business. But the largest AMP the CRTC has brought forward on one individual is $100,000. As for businesses, the Quebec-based corporate training firm Compu.Finder was issued an AMP of $1.1 million for three violations of the act in 2015. The owners of what Zemel called a “mom and pop shop” fought back on the crack-down, saying they would be forced to sell their house in order to pay the fine and, in 2017, the CRTC Tribunal reduced the damages to $200,000. “So, I think they learned their lesson,” Zemel said of the commission. The CRTC official said the goal of an AMP is not meant to be punitive, but rather to promote compliance. “If you start your own business tomorrow, and you don’t know the rules, it would be unfair if the CRTC comes back with a . . . $10 million dollar AMP for your first infraction,” he said. Zemel said there are many factors that inform the course of action against each party, but there doesn’t seem to be any linear criteria from case to case, and the CRTC can pull any number it wants out of a hat. Sometimes, she said, fines are negotiated between the CRTC and the accused party, and the commission will also consider the level of cooperation with the investigation. The CRTC also looks at financial statements from the companies to determine ability to pay. Fines in recent years are low because many of the accused are individuals and small businesses, Zemel said. The commission official said while there are designated criteria the CRTC examines in order to determine how to proceed with enforcement, it’s also a case-by-case basis. For some companies, he said, all it takes is one intervention from the commission for them to never violate the law again. Other companies, he said, won’t learn their lesson no matter how much the commission fines them. In those cases, he said, the commission has to take an alternative approach. “Sometimes the name and shaming is enough for them to ensure compliance.” Asked what it would take for a company to be fined the maximum amount, the official wouldn’t say, but said AMPs are “the last resort when we know that compliance would not be achieved in any other way.” “Out of date” legislation deals with a 2008 problem When CASL was first introduced, Zemel found herself talking about the legislation on a near daily basis. These days, she may only advise clients on the legislation a couple of times a year, as evolving technology has made it easy and cost-effective for companies to comply, making the law much less of a concern in the e-marketing world. When the law came into force, Zemel felt it was dealing with a 2008 problem. That sentiment hasn’t changed, and she said the legislation feels “out of date.” Between improved spam filters and changing marketing strategies, she said, most people might not even notice the spam they get. She said the legislation will likely have to be updated to reflect any forthcoming AI regulations, but otherwise, she’s unsure of how the law could be changed to give it more weight. For Elder, he would like to see the feds clean up CASL’s confusing and contradicting provisions. In December 2017, the House industry committee published a report including 13 recommendations for the feds concerning CASL. Among the recommendations, the committee suggested clarifying various definitions, clarifying provisions relating to terms of consent, and clarifying the application of the act to charities and non-profits. In its response, the government agreed with several recommendations, and said it would work with stakeholders to improve certain areas of the legislation flagged by the committee. But according to Elder, who said it was “unique” for the government to agree with committee recommendations, the report went nowhere, and the changes were never made. “I think part of the problem is it’s not a winner in the court of public opinion,” he said. “No government, I think, has wanted to see itself on the front pages as ‘X government waters down anti-spam protections for consumers’ or something like that, which is probably that way it would play.” mcollins@thewirereport.ca

The CRTC has received 4.1 million complaints about spam since 2014, so why has it only taken action 34 times?

Regulatory |
By Maria Collins
|July 9, 2026

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

The CRTC has received 4.1 million complaints about spam since 2014, so why has it only taken action 34 times?

Regulatory | By Maria Collins |July 9, 2026

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Telus asks CRTC to restore device-locking capabilities for all Canadian providers

AI data centres have taken Canada’s city councils by storm, but where is Ottawa?

CRTC shuts down B.C. startup’s attempt to offer MVNO service through Telus

Related Stories

Telus asks CRTC to restore device-locking capabilities for all Canadian providers

CRTC shuts down B.C. startup’s attempt to offer MVNO service through Telus

CRTC launches consultation in response to Big Three issuing prohibited fees

Northern Quebec fibre project budget balloons as CRTC approves additional $17M in funding

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Regulatory |
By Maria Collins
|July 9, 2026