Follow-Up Emails to Applicants: CASL, CAN-SPAM and TCPA

The consent and content rules that apply when a platform follows up with someone who started an application and stopped. A plain-language guide to the three regimes, with links to the regulators.

Read

8 min read

Published On

Oct 9, 2026

Read: 8 minutes

Last updated: October 9, 2026

In this guide

Whether a follow-up counts as a commercial message, and why that matters
The core rules in Canada (CASL), the US (CAN-SPAM) and for text messages (TCPA)
A checklist for the content and footer of every follow-up
Where to get advice, because this is general information

Not legal advice. This guide is general information for product and operations teams. It is not legal advice and it is not a complete statement of any law. Rules change and depend on your facts. Have a lawyer review your program, and check each point against the sources linked below.

A person starts an application on your platform, stops at the ID step, and you send a note asking if they need help. Is that a marketing email? The answer decides which rules apply, and the honest answer is often "it depends on what the note says." This guide walks through the three regimes that most platforms meet: CASL in Canada, CAN-SPAM in the United States and the TCPA for text messages and calls.

It covers the legal mechanics only. For what a follow-up should say, see What a Stalled-Applicant Email Should Say. For how a program that offers capital should describe it, see How Embedded Capital Works for Platforms.

First Question: Is It a Commercial Message?

All three regimes treat purely transactional messages more lightly than commercial ones. A message that only confirms an account, delivers a password reset, or completes a transaction the person asked for is usually transactional. A message that promotes an offer or encourages a commercial activity is commercial.

A follow-up to an applicant sits in between. "Your application is saved, here is the link to finish" reads as service. "You may be eligible for capital, finish today" reads as promotion. Mixed messages tend to be treated as commercial. The FTC's guidance says the transactional category is to be read narrowly and that mixing in commercial content can make the whole message commercial. The safe approach is to treat every follow-up as commercial and meet the stricter rules.

Canada: CASL

Canada's Anti-Spam Legislation (CASL) covers commercial electronic messages sent to recipients in Canada, including email and text. The regulators publish guidance at the CRTC and at the government's CASL site. Canada's anti-spam law requires consent before you send a commercial message, and the exact conditions are in that guidance. Two things matter to a follow-up.

Consent. CASL requires consent before a commercial message is sent. Consent can be express, where the person agreed, or implied in defined cases. The conditions and time limits for implied consent are narrow, so read them in the regulators' guidance and do not rely on a summary.
Identification and unsubscribe. A commercial message must identify who sent it and offer a working way to unsubscribe, and requests must be honoured promptly. The regulators' guidance sets the exact requirements.

Whether an applicant's own application supports implied consent, and for how long, is a question to settle with counsel against the regulators' guidance. It is one more reason to keep follow-ups to a short window instead of a long drip.

CASL penalties and enforcement decisions are published by the regulators. Read them on the CRTC page, not from a summary like this one.

United States: CAN-SPAM

The CAN-SPAM Act covers commercial email in the US. Unlike CASL, it works through opt-out rather than prior opt-in. The FTC's CAN-SPAM Act: A Compliance Guide for Business lists the requirements. In summary:

Do not use false or misleading header information. The From, To and routing details must be accurate and identify who sent the message.
Do not use deceptive subject lines. The subject must reflect the content.
Identify the message as an advertisement where it is one.
Include a valid physical postal address.
Tell recipients how to opt out, in a way that is clear and easy.
Honour opt-out requests within 10 business days, and keep the opt-out mechanism working for at least 30 days after sending.
Monitor what others do on your behalf. Hiring another company to send does not make the responsibility theirs alone.

The FTC says each separate email in violation can carry a penalty of up to $53,088 (the figure on its guide at the time of writing; check the page for the current one). Relationship and transactional messages are mostly exempt but must still avoid false or misleading routing information.

Text Messages: The TCPA

Texts raise the stakes. In the US, the Telephone Consumer Protection Act (TCPA) restricts certain automated calls and texts and requires consent, with stricter consent rules for marketing. The FCC explains the rules on its robocalls and texts guidance, and the rules themselves are at 47 CFR 64.1200.

Two points trip up platforms. Consent given for one purpose is not consent for another: someone who gave a phone number to verify an identity has not necessarily agreed to marketing texts. And people can revoke consent, and the rules on how are still moving, so confirm the current position with counsel.

Unless you have clear consent to text, do not text. Use email.

A Pre-Send Checklist for Every Follow-Up

Check	Why
Do we have consent or a valid implied basis for this recipient and this date?	CASL requires it; the recipient's location decides
Is the sender named and is a postal address in the footer?	CASL identification; CAN-SPAM
Is there a working unsubscribe, honoured promptly?	CASL requires prompt handling; CAN-SPAM sets 10 business days
Does the subject line match what is inside?	CAN-SPAM
Is it clear when the message is promotional?	CAN-SPAM
Do we promise or imply an approval, amount or timing?	Not a CAN-SPAM issue; a customer-trust and accuracy issue
Are we sending any text without written consent?	TCPA
Is the suppression list applied before every send, including from other tools?	All three

Practical Habits That Keep You Safe

Keep one suppression list that every sender checks, including your email tool, your CRM and any automation. Record when and how each person consented. Limit the number of follow-ups and the window in which you send them. And write copy that does not overstate: no promised approvals, amounts or timing.

If you test follow-ups, keep a holdout group that receives nothing from you. See How to Run a Holdout Test You Can Actually Read.

Where to Get Advice

Use the primary sources linked above, and talk to a lawyer who knows both Canadian and US messaging law if you send across the border. Sector rules can add to these where a message is about financing, so ask your capital partner what they require.

Common Questions

In Canada, CASL requires consent, express or implied, and the conditions are narrow. In the US, CAN-SPAM does not work through prior opt-in for email but requires accurate content and a working opt-out. Confirm the details with counsel.

Is a follow-up email a marketing email?

Often it is treated as one, especially if it promotes an offer. A narrow service message such as a saved-progress link may be transactional, but mixed messages are usually treated as commercial. Assume commercial.

How fast must we honour an unsubscribe?

The FTC's CAN-SPAM guide gives 10 business days as the outer limit. CASL also requires prompt handling; see the regulators' guidance. Do it immediately where you can.

Can we text stalled applicants?

Only with the right consent. In the US, the TCPA requires consent for texts sent with automated systems, and CASL applies to texts sent to people in Canada. If in doubt, use email.

Does using a vendor or automation tool shift the responsibility?

No. The FTC's guide says hiring another company to send your email does not transfer your legal responsibility.