Is it legal to let AI email your customers?
Short answer: yes, with consent — and you are the sender, not your software. That is the part most vendors skip, so here is exactly what Leadmend enforces for you, and what stays yours.
Written by the person who built it, not a marketing team. It is not legal advice — if your situation is unusual, ask a lawyer.
What the software enforces, and how
“Fully compliant” is a claim anyone can make. These name the mechanism, so you can judge whether it would actually hold.
An unsubscribe is honoured immediately on everything we send out
Outreach — campaigns, review requests, quote follow-ups, automated messages — goes through one function, and the suppression check is inside it rather than at the call sites, so a new feature cannot forget it. A direct reply to somebody who has just written in goes through a different function and is deliberately not suppressed: CASL s.6(6)(a) exempts a reply to a request, and answering a question with silence is not what an unsubscribe asks for.
Every commercial message carries an unsubscribe link and a mailing address
Appended automatically, so both are present whether the wording came from the AI, from an automation, or from you. CASL s.6(2) requires them on commercial messages; s.6(6) exempts the transactional kind, and the two go out through different functions so the exemption cannot be claimed by accident.
Someone who opts out stays opted out, even if the business closes its account
The database enforces it. Deleting an account used to erase its opt-out records by cascade; the foreign key now detaches them instead, so one party's erasure cannot undo another party's withdrawal of consent.
Automated emails to your customers carry RFC 8058 one-click unsubscribe
So Gmail and Outlook can offer Unsubscribe in their own interface, rather than the recipient reaching for Report Spam — which is what actually protects your sending reputation. Transactional mail does not carry it, because s.6(6) exempts it.
Your customer is told they are talking to an AI, before they type
The notice sits above the send button on every published site, not in a disclaimer after the fact. The reply itself also says an AI wrote it and that a person will confirm details.
The AI will not quote a price or promise a time
Hard rules in the reply engine, tested against adversarial messages 30 times per rule on every audit run — because a rule that holds 29 times out of 30 is not a rule.
What is still yours
Any vendor telling you they absorb your CASL obligation is telling you something false, and you would discover it at the worst possible moment. The obligation follows the sender, and the sender is you.
- Having consent before a message goes out. Under CASL you are the sender; we are the tool. Someone who filled in your contact form has given implied consent to a reply — a list you bought has not.
- Not importing lists of people who never asked to hear from you.
- The content of anything you write yourself, as opposed to what the AI drafts under its rules.
- Telling us if you are subject to rules that need a formal written data-processing agreement, so we can sign one.
Common questions
- Is it legal to have AI email my customers in Canada?
- Yes, with consent. CASL governs commercial electronic messages regardless of whether a human or software composed them, and it treats you — the business — as the sender. Someone who submits an enquiry through your website has given implied consent to a reply about that enquiry. A purchased list has not. Leadmend enforces the mechanical parts in code: the unsubscribe check runs inside the send function so no feature can skip it, an unsubscribe link and mailing address are attached to every commercial email, and opt-out records survive even the deletion of the account that created them.
- Does using an AI assistant put my CASL obligations onto the vendor?
- No, and be wary of any vendor who says it does. Under CASL the sender is the business on whose behalf the message goes out. Software can make compliance the default — enforced opt-outs, automatic identification, retained consent records — but it cannot take on your legal obligation. Leadmend's terms say this plainly rather than burying it.
- Do my customers have to be told they are talking to an AI?
- There is no Canadian statute that requires it in these words today, but misleading someone about who they are dealing with creates exposure under general misrepresentation rules, and it costs you trust the moment they work it out. Leadmend tells them before they type: the notice sits above the send button on every published site, and the AI is instructed never to claim to be a person.
- Where is my customers' data stored, and does PIPEDA allow that?
- Several of our processors hold data outside Canada, principally in the United States — the database, hosting, the AI model and email delivery. PIPEDA permits transferring personal information across borders for processing, provided the organisation remains accountable for it and tells people it happens. Our privacy policy names every processor and what each one handles. Anyone can ask for a copy of their data or have it erased, and an account owner can delete everything themselves from Settings — immediately, not within thirty days.
- What happens to opt-outs if I close my Leadmend account?
- They are kept. Everything else goes — your business details, your website, every enquiry your customers sent you — but records of people who asked to stop receiving messages are retained, because erasing one party's data cannot undo another party's withdrawal of consent. This is enforced by the database rather than by policy: the foreign key detaches those rows instead of deleting them.
The detail lives in our Privacy Policy — which names every processor and what each one handles — and in the Terms, where section 7 commits to telling you within 72 hours if we are ever breached in a way that puts you or your customers at real risk.
The questions underneath this
Longer answers, each one citing the regulator rather than us.
- Is an automated reply a commercial electronic message?
Somebody writes in. Software answers in ten seconds. Whether that reply is a commercial electronic message is the question worth getting right before you switch anything on.
- What CASL asks you to keep, and for how long
Consent you cannot demonstrate is, for practical purposes, consent you do not have. The records are the compliance.
- PIPEDA and the enquiries your business stores
The moment somebody types their name and email into your form, you are holding personal information. That is a smaller deal than it sounds, and a bigger one than most businesses treat it as.
Put your AI to work today.
Create your account and describe your business in a chat — your AI starts answering enquiries in minutes, in your words. Your own website and a custom agent come with Growth, when you want them.