Is Instagram DM automation legal in Canada?

What CASL is, and when a DM counts

This article is general legal information about Canada's Anti-Spam Legislation as of September 2026, not legal advice; how CASL applies to your messages depends on your specific facts, so consult a qualified Canadian lawyer before relying on it.

CASL regulates commercial electronic messages. Under section 1(2) of the Act, a message is commercial if it is reasonable to conclude that one of its purposes is "to encourage participation in a commercial activity". A DM that links to a product, a discount or a paid offer fits that description.

The message also has to go to an electronic address. Section 1(1) defines that term to include "an instant messaging account" and "any similar account".

The CRTC's CASL FAQ addresses social media directly. Messages sent through a "closed two-way direct messaging system" would qualify as sending messages to "electronic addresses". A one-way public broadcast, such as a wall post, isn't covered, and anything in between is decided on a "case-by-case basis". For Instagram, that means a promotional DM can be covered and a public comment reply generally isn't.

What CASL asks of a commercial message

Section 6 of the Act sets the basic rule: you need the recipient's consent, and the message has to meet the form requirements in section 6(2). In practice that comes down to the three requirements below.

• Consent. Either express consent, which doesn't expire but can be withdrawn, or implied consent, which is time-limited (CRTC guidance).
• Identification. The message must identify the sender and anyone it's sent on behalf of, with contact details that stay valid for at least 60 days. The CRTC's regulations (SOR/2012-36, s.2) list the details: business name, mailing address, and a phone number, email address or web address. If putting them in the message isn't practical, they can sit on a web page the message links to.
• Unsubscribe. Section 11 requires a free mechanism, through the same electronic means the message used or another means if that isn't practical, with a link or address that works for at least 60 days. Requests must be honoured "without delay, and in any event no later than 10 business days". CRTC Bulletin 2012-548 says the mechanism should be "simple, quick, and easy for the consumer to use".

Why a comment-triggered DM is different from cold outreach

The key provision isn't in the Act. It's in the Electronic Commerce Protection Regulations (SOR/2013-221), made by Innovation, Science and Economic Development Canada. Section 3(b) says section 6 of the Act does not apply to a commercial electronic message "that is sent in response to a request, inquiry or complaint or is otherwise solicited". Because it removes all of section 6, a qualifying reply is outside the consent, identification and unsubscribe rules together.

Section 6(6) of the Act is a different provision. It lists messages that don't need consent, such as a quote or estimate the recipient asked for, but those messages still have to identify the sender and include an unsubscribe mechanism.

The government's explanation of the regulation, the Regulatory Impact Analysis Statement published in the Canada Gazette on December 18, 2013, adds two limits. The reply has to relate to the inquiry, and extra material, such as a price list or a website link, is fine only if the customer "could reasonably expect to receive" it.

Cold DMs are a different matter. A promotional DM to someone who never asked for anything needs consent. The Act has an exemption for messages between people with a personal relationship, in section 6(5)(a), but the CRTC says clicking like or follow "will generally be insufficient" to create one.

Implied consent from an inquiry is narrow. Section 10(9)(a) covers an existing business relationship, and section 10(10)(e) says that relationship can arise from an "inquiry or application, within the six-month period immediately before the day on which the message was sent", where the inquiry is about a purchase or lease, a business opportunity or bartering. Asking for a free guide may not meet that test. Where it does, the consent only covers messages sent within six months of the inquiry, and those messages still need identification and an unsubscribe mechanism.

The open question: is a keyword comment a request?

The CRTC's FAQ doesn't say whether commenting a keyword on a post counts as a "request" under SOR/2013-221 s.3(b), and no regulator has ruled on it. Treating "comment GUIDE and I'll DM it to you" as a request is our reading, not something the CRTC has said.

We think it's a reasonable reading. The post invites a specific action, the person takes it, and the DM delivers the thing they asked for. That is close to the plain meaning of a solicited message.

The reading stops at the thing asked for. A DM that delivers the guide relates to the request. A later DM about a sale, a new product or a different offer doesn't, and it would need consent, identification and an unsubscribe mechanism like any other commercial message.

Identification and unsubscribe inside a DM

If a DM falls under the inquiry exclusion, identification and an unsubscribe line may not be strictly required. They take a line or two, and they protect you if a regulator reads the exclusion more narrowly than we do. For any DM that promotes something beyond what was asked for, they are required.

In ReelDrop, any reply from the person cancels a pending timed follow-up, so a STOP reply stops the reminder without you doing anything. After that, ReelDrop only sends that person another DM if they trigger an automation again, for example by commenting a keyword on a later post.

• Name the sender: your business name, or your creator name and handle.
• Link to a contact page that shows a mailing address and a phone number, email address or web address.
• Add an opt-out line such as "Reply STOP and we won't message you again."
• Keep the message on what the person asked for.
• Honour a STOP right away, and no later than 10 business days. Don't send that person promotional messages afterwards.

How ReelDrop's comment-to-DM maps to CASL

ReelDrop is software. You write the message and choose the trigger, and under CASL you're the sender. ReelDrop runs on the official Instagram API as a Meta Tech Provider and is not affiliated with Instagram or Meta. Meta's own messaging rules also limit business tools to messaging people who contacted the account first, so ReelDrop has no cold-DM or broadcast feature.

Our reading of CASL as of September 2026. General information, not legal advice.

Penalties, and who enforces CASL

Section 20(4) of the Act sets the maximum administrative monetary penalty per violation at "$1,000,000 in the case of an individual, and $10,000,000 in the case of any other person" (Canadian dollars). These are ceilings the CRTC can impose, not typical fines.

The CRTC investigates CASL contraventions. The Competition Bureau handles misleading representations, and the Office of the Privacy Commissioner covers address harvesting and privacy under PIPEDA (Canada's federal private-sector privacy law). The OPC's guidance defines electronic marketing to include "email, instant messaging, social media or other similar accounts".

Individuals can't sue under CASL. The private right of action in sections 47 to 51 was repealed before it came into force.