Pizza Hut Canada Pays CA$500,000 to Settle CASL Spam Case

Pizza Hut's Canadian operator has agreed to pay CA$500,000 to settle alleged breaches of Canada's Anti-Spam Legislation (CASL). PH Canada Company, which does business as Pizza Hut in Canada, signed an undertaking with the Canadian Radio-television and Telecommunications Commission (CRTC) dated 1 October 2026, covering commercial emails sent between January 2025 and February 2026.

The three issues the CRTC cited are the basics of any marketing program: sending without consent, sending without a working unsubscribe link, and not acting on unsubscribe requests. Any brand that mails Canadian addresses, directly or through an agency, runs the same risks.

What the CRTC alleged

The investigation looked at commercial electronic messages (CEMs) that PH Canada sent over roughly thirteen and a half months, from 1 January 2025 to 12 February 2026. According to the undertaking, as summarised by industry observers who reviewed it, the CRTC raised three concerns:

• Messages sent without consent. CASL requires express or implied consent before a commercial email is sent to an electronic address. Sending to people who never opted in, or whose implied consent had expired, is the most common CASL breach.
• Messages without an unsubscribe mechanism. Every CEM sent under CASL must include a way for the recipient to withdraw consent, and that mechanism must be easy to use.
• Unsubscribe requests not honoured. CASL gives senders 10 business days to give effect to an unsubscribe request. Messages sent after that window are treated as sent without consent.

An undertaking is a negotiated resolution with the regulator. It closes the investigation in exchange for a payment and compliance commitments, and is not a court ruling.

What Pizza Hut Canada committed to

On top of the CA$500,000 payment to the Receiver General for Canada, PH Canada agreed to two compliance measures:

• review its internal CASL compliance program and strengthen it where needed;
• make sure that any third party authorised to send commercial emails on its behalf complies with CASL and its regulations.

The second point matters well beyond pizza. Large franchise and retail brands often rely on agencies, franchisees, loyalty vendors and ESP integrations to send mail. CASL covers anyone who sends, causes or permits a commercial message to be sent, so a brand does not escape responsibility because a partner pressed the send button.

A large amount by CASL standards

CASL undertakings published by the CRTC usually carry five or low six-figure payments. In June 2024, for example, Hudson's Bay Company agreed to pay CA$120,000 in its own CASL undertaking. Industry commentators who track CRTC enforcement have described the PH Canada payment as one of the largest tied to a CASL undertaking so far.

It also follows a busy period for anti-spam enforcement elsewhere. This week, Australian telco SpinTel paid an A$653,400 penalty to the Australian regulator for emailing former customers, a case we covered in SpinTel pays A$653,400 spam penalty. Regulators on both sides of the Pacific are focusing on the same failures: consent that has lapsed and unsubscribes that do not stick.

Why these three failures keep coming back

None of the alleged issues involves exotic technology. They usually come from process gaps:

Consent that expires quietly

Under CASL, implied consent based on an existing business relationship is time-limited: it generally runs for two years after a purchase and six months after an inquiry. Lists that treat every past customer as a permanent subscriber drift out of compliance without anyone noticing. Our double opt-in guide covers how to collect and record express consent that does not expire.

Templates without a footer

Transactional-looking messages that carry a promotion, one-off templates built by a franchisee, or emails sent from a new tool often skip the standard footer. If the message is commercial, it needs the unsubscribe mechanism and the sender identification CASL requires. See how to add an unsubscribe link for the setup on the main platforms.

Suppression lists that do not sync

An unsubscribe recorded in one platform is useless if the loyalty system, the CRM or the agency's sending tool keeps its own list. When several systems send to the same audience, the 10 business day deadline applies to all of them.

Action checklist

• Map every system that sends commercial email in your name: ESP, CRM, loyalty platform, agencies and franchisees.
• Record the consent basis of each Canadian contact, with the date, source and type (express or implied).
• Expire implied consent on schedule, and run a re-permission campaign before it lapses rather than after.
• Audit every template for a working unsubscribe link and sender identification, including one-off and franchisee templates.
• Test the unsubscribe path end to end and check that the address stops receiving mail from every system well within 10 business days.
• Centralise suppression so that a single opt-out reaches all senders, and put that requirement in your contracts with third parties.

Sources

1. CRTC: Undertaking, PH Canada Company, 1 October 2026 (primary source)
2. Justice Laws Website: Canada's Anti-Spam Legislation (S.C. 2010, c. 23)
3. CRTC: Enforcement actions
4. EmailKarma: Two CASL compliance cases, $700,000 in payments, 5 October 2026

Related on SMTPedia

• SpinTel pays A$653,400 spam penalty for emailing former customers
• Double opt-in: compliance, implementation and deliverability impact
• How to add an unsubscribe link: the complete guide