Almost every Tamil-Canadian small business we talk to in the GTA is using regular WhatsApp Business (the green-icon app you download from the Play Store or App Store) to broadcast promotions, send weekly grocery deals, or push new tuition batches to parents. Most of them are in violation of CASL (Canada's Anti-Spam Legislation) without realising it, and many are also in breach of WhatsApp's own Business Messaging Policy.
This post walks through the practical difference between the two products, what CASL actually requires, and the minimum setup you need before your next broadcast.
What CASL actually says
CASL applies to any commercial electronic message — that includes WhatsApp messages to customers in Canada. Three things matter:
- You need consent. Either express consent (the recipient explicitly said yes) or implied consent (a recent transaction, a published business address, or an existing business relationship).
- Every message needs an identifier — who you are, how to contact you, and a way to unsubscribe.
- Unsubscribe requests must be honoured within 10 business days and must work using the same channel the message was sent through.
The fines are not theoretical — the maximum administrative monetary penalty is $10M CAD per violation for a corporation, $1M for an individual. Even the CRTC's smaller settlements in the last 3 years have averaged $200K+.
The common misconception is that CASL is just about email. It is not — CASL covers SMS, MMS, WhatsApp, Telegram, Signal, and basically any electronic messaging service used for commercial purposes.
The critical feature difference: consent and audit logs
Here is the table most Tamil-Canadian business owners need to see:
| Feature | WhatsApp Business (free app) | WhatsApp Business API | |---|---|---| | Free to use | Yes | No (applicable delivered template messages are billed per message; provider fees may also apply) | | Broadcast beyond the app's list workflow | Limited by the app's current broadcast rules | Approved templates, subject to consent, template status, account quality, and Meta messaging limits | | Opt-in audit log | Must be maintained separately | Must be implemented in your CRM, database, or provider workflow | | STOP / unsubscribe automation | Must be handled manually or through a separate process | Keyword handling can be configured, but must be implemented and tested | | Message template approval | Not applicable | Required by Meta; approval does not certify CASL compliance | | Delivery & read receipts at scale | No | Yes | | Multi-agent / team inbox | No | Yes (via BSP dashboard) | | Webhook into your CRM | No | Yes | | Cost of CRTC fine if you mess up | Same | Same |
The regular WhatsApp Business app was never designed for compliance. It is a phone you hand out to customers. It has no consent tracking, no automatic opt-out, and no audit trail for the CRTC to audit. If CRTC comes knocking with a complaint, you have nothing to produce.
The WhatsApp Business Platform (accessed directly or through a provider) supports approved templates, webhooks, and integrations, but consent logging and opt-out enforcement are not automatic compliance features. Your implementation must record each consent event and configure, test, and monitor keyword handling such as STOP, OFF, "வேண்டாம்" in Tamil, or other supported phrases.
What a CASL audit actually looks like
When a complaint lands at CRTC, here is what they ask for:
- The exact message that was sent (in the language it was sent)
- The date, time, and phone number it was sent to
- Proof the recipient consented, when, and how
- Proof the message included a working unsubscribe mechanism
- Proof you honoured the unsubscribe within 10 business days
With a correctly implemented Business Platform and CRM or provider workflow, those records can be queried and exported. The platform alone does not create that evidence: the business must design the data fields, retention, access controls, opt-out workflow, and audit export before campaigns begin.
The Tamil-Canadian context specifically
Four issues we see repeatedly in GTA Tamil business broadcasts:
1. "Implied consent" is over-claimed. Implied consent under CASL is narrower than most people think. A customer paying at your grocery store does not grant consent to receive WhatsApp broadcasts. A customer who purchased in the last 2 years does — but only for 2 years from the transaction date, and only for similar products. An existing business relationship does not automatically unlock broadcasts.
2. Temple & community lists are not safe lists. Many first-generation Tamil businesses share contact lists with temple committees, Tamil Sangam boards, and Tamil radio station VIP member lists. That is not consent transfer. The person who agreed to receive temple event updates did not consent to receive promotional messages from a separate commercial business. Sending to that list is a textbook CASL violation.
3. "Forward to 10 friends" promotions. These are almost always in breach — not only of CASL but also of WhatsApp's own anti-spam policy. They can get your number banned.
4. Tamil-only unsubscribe instructions. If you send a Tamil message, your unsubscribe mechanism must also work in Tamil. STOP in English works, but if your Tamil-speaking customer types "வேண்டாம்" or "நிறுத்து", your system must recognise it and act. This is trivial on the API side, impossible on the regular app.
The minimum compliant setup
For a Canadian small business that wants to do WhatsApp marketing legally in 2026:
- Move to the WhatsApp Business Platform through a suitable provider. Meta bills applicable delivered template messages per message, with rates varying by message category and recipient market. Check Meta's current official rate card and confirm the provider's separate fees before launch.
- Get templates approved that include your business name, address, and unsubscribe instructions. Submit Tamil + English versions separately if you serve both.
- Build an opt-in log — minimum a spreadsheet, ideally a CRM — that captures when and how each contact gave consent. "Signed up on the website form" or "verbally agreed on call at 2026-04-10 14:32" are both fine as long as they are recorded.
- Implement keyword unsubscribe handling. Configure the required keywords and language variants in the selected provider or your own webhook, persist the opt-out, suppress future marketing messages, and test the full flow yourself.
- Export a 24-hour rolling log of all sent messages and all unsubscribe actions. Keep it for 3 years.
- Cap promotional broadcasts at 1-per-week-per-contact. This is not a CASL rule, it is a survival rule — otherwise you get reported and Meta throttles your number.
"My competitor is doing it and they're fine"
Most Tamil-Canadian small businesses in the GTA have not been caught yet. That is not the same as being compliant. CRTC enforcement has ramped up in 2025–26, particularly in immigrant-community-owned businesses because those are where the most complaints land (disgruntled ex-customers, laid-off workers, competitors). The question is not "will they enforce" — it is "when is the first complaint from someone you upset".
The worst-case scenario is not the fine itself. It is a message from Meta that your WhatsApp number is permanently banned for policy violations. When that happens, you lose years of customer conversations overnight, with no appeal.
Frequently Asked Questions
Does CASL apply to messages I send from Sri Lanka to Canada? Yes. CASL applies to any message sent or routed to an electronic address accessed in Canada, regardless of where the sender is based. A company based in Jaffna or Chennai broadcasting to Canadian customers is fully bound by CASL.
What about messages I send only to existing customers? The "existing business relationship" exemption gives you 2 years of implied consent after the last transaction, and 6 months after an inquiry. After that window closes, you need express consent. The exemption is also only valid for messages about similar products or services — a grocery store cannot use it to broadcast about unrelated tuition services.
Can I use the regular WhatsApp Business app for 1-on-1 customer support? Yes — CASL does not cover direct customer-initiated conversations. If a customer messages you first and you reply, you are fine. The issue is broadcasts you initiate.
What about the 256-contact list in WhatsApp Business? Broadcast lists in the regular app can send to up to 256 contacts who have your number saved in their phonebook. Most Canadian businesses misuse this feature — they blast to any 256 phone numbers, which either fails silently or gets the number banned. Either way, there is no CASL-compliant audit log.
Is the PIPEDA angle different from CASL? Yes. PIPEDA governs how you collect, use, and disclose personal information (including phone numbers). CASL governs the act of sending a commercial message. You can violate one without the other, but in practice most WhatsApp broadcast violations breach both. You need PIPEDA-compliant collection (notice + consent at the point of collection) AND CASL-compliant sending.
Does a voice-agent call (inbound) count as consent to a WhatsApp message? Only if the caller explicitly consented during the call. If the agent says "Can I send the floor plan to your WhatsApp?" and the caller says yes, that is a recorded express consent. We stamp every such consent with the call's timestamp and the audio recording. We also ship this log with every client engagement.
Need a CASL-compliant WhatsApp setup? We do bilingual Tamil + English WhatsApp Business API installs for GTA businesses — start on /canada/.