What is “implied consent” and when is it acceptable?

Implied consent refers to consent that is not explicitly given through a direct opt-in action but is instead inferred from an existing relationship, behavior, or context. The classic example is a customer who purchases a product-their consent to receive related commercial communications is "implied" by the transaction, even without a separate opt-in. Implied consent is distinct from express consent, where the individual explicitly indicates agreement (like checking a subscription box). The acceptability of implied consent varies significantly by jurisdiction and depends on the nature of the relationship and the type of communication.

Under CASL, implied consent is explicitly recognized for existing business relationships (purchase within the last two years, active contract, membership) and existing non-business relationships (donations, volunteer work). However, implied consent under CASL has time limits-typically two years from the last purchase or interaction-after which you must obtain express consent to continue sending. Under GDPR, consent as a legal basis must be explicit, making implied consent insufficient; however, you might rely on "legitimate interest" as an alternative legal basis for certain customer communications, which involves a similar but distinct legal analysis.

In the United States, CAN-SPAM doesn't require prior consent at all (only honoring opt-outs), so the implied consent concept is less relevant. You ucan email commercially without any opt-in, provided you include required disclosures and honor unsubscribes. The UK's PECR allows a form of implied consent called "soft opt-in" for existing customers under specific conditions. When relying on implied consent, always understand the specific rules of each applicable jurisdiction, document the relationship that gives rise to the implication, and provide easy opt-out mechanisms. Implied consent is a narrow exception, not a loophole-use it carefully and within its defined boundaries.