Casino App Notifications: Where the Line to Spam Actually Sits

A push notification that reminds a player their bonus spins are waiting reads, on a plain application of Canada’s anti-spam law, as a commercial electronic message that needs consent, identification, and a working unsubscribe path. In Ontario, a second rulebook stacks on top. AGCO’s Registrar’s Standards bar marketing to self-excluded players and require separate consent for inducement offers. The line between legitimate re-engagement and spam is drawn by those two instruments. How often the phone buzzes has little to do with it.

This desk reads terms and regulator documents for a living, and the notification channel is where the gap between what an operator’s marketing team treats as “engagement” and what a regulator treats as “commercial message” is widest. What follows decomposes the underlying mechanics into each regulatory requirement.

What counts as a commercial electronic message under CASL?

Canada’s Anti-Spam Legislation, administered by the CRTC, governs “commercial electronic messages”, and the definition is deliberately broad. Per the CRTC’s published FAQ, a message is caught if it encourages participation in a commercial activity, regardless of whether money changes hands. A push notification saying “your 50 free spins expire tonight” encourages a commercial activity. So does “deposit $20, get a $40 bonus.” So does a VIP nudge offering a personal host.

The channel matters less than most players assume. Per the CRTC’s FAQ, CASL’s core provisions apply to a commercial electronic message sent by any means of telecommunication. A push alert, an in-app message, an SMS, and an email are all forms of telecommunication, so this desk reads that definition as a plain-language basis for covering each of them the same way. That reading is this desk’s own application of the rule. No specific CRTC ruling naming push notifications has been published in the sources reviewed here. A push alert is not exempt simply because it lives inside an app the player installed. Installing the app is not, by itself, consent to receive marketing through it.

There is a narrow functional exception. Messages that facilitate, complete, or confirm a commercial transaction the recipient already agreed to (a payout confirmation, a KYC document request, a password reset) sit outside the marketing consent requirement. That distinction becomes the spine of the player-side question later. Not all notifications are the same category, and the rulebooks treat them differently.

For the operator, the practical consequence is that every bonus reminder, every “we miss you” re-engagement ping, and every VIP upgrade offer is a commercial electronic message that must satisfy three separate mechanics. Fail any one and the message is non-compliant, even if the other two are perfect.

The three CASL mechanics, decomposed

CASL compliance is not a single test. It is three requirements that operate independently, and the CRTC’s FAQ sets out each with specific numbers.

Consent: express or implied, and never pre-checked

Consent must be either express or implied, and the burden of proving it sits with the sender. Express consent requires a positive act by the recipient, such as a box the player actively ticks or a button they press. A pre-checked box does not qualify, because the CRTC’s guidance is explicit that silence or inaction cannot constitute consent. An operator that ships a sign-up form with “yes, send me offers” already ticked has not obtained express consent for that stream.

Implied consent is narrower and time-limited. The CRTC’s FAQ recognises implied consent where there is an existing business relationship, for example a player who has made a purchase or transacted with the operator within the preceding two years. That two-year window is the outer bound; it does not renew itself because the player opened the app. A player who deposited once in 2023 and has not transacted since is now outside the implied-consent window for that relationship, and marketing pings to that device need express consent to continue.

The consent record itself is an operational obligation. The sender must be able to produce evidence of when and how consent was obtained. For a terms desk, the relevant clause in an operator’s privacy or marketing terms should go further than “we may send you marketing” and describe how consent is actually captured and retained.

Identification: the message must say who sent it

Every commercial electronic message must identify the sender (the person or organisation on whose behalf it is sent) and include contact information that lets the recipient reach them. For a push notification, that means the operator’s identity has to be discoverable from the message or the app context, and a mailing address or equivalent contact route must be available. A generic “your casino” push with no identifiable sender and no contact path fails this mechanic even if consent was properly obtained.

This is the requirement most often lost in the push channel specifically, because push notifications are short by design. The CRTC’s framework does not exempt short messages; the identification obligation travels with the message.

Unsubscribe: 10 business days to act, 60 days the opt-out path must keep working

The unsubscribe mechanic has two numbers that matter. First, the recipient must be able to unsubscribe using the same or a lower-cost method as the original message, either in-app or in-message as an opt-out path. Second, the sender must give effect to the unsubscribe request within ten business days, per the CRTC’s FAQ.

The sixty-day figure is the one operators and players both misread. It is not a grace period during which marketing can continue after an unsubscribe. Per the CRTC’s FAQ, it describes how long the unsubscribe mechanism itself, the in-app or in-message opt-out path, must remain usable after any given message is sent. The two numbers do different jobs. Ten business days is the deadline to stop sending once a recipient opts out. Sixty days is how long that opt-out path has to keep working. Conflating the two is how an operator might argue a continued send fell within some grace period, when no such grace period exists under either number.

A player who unsubscribes from bonus reminders and continues to receive them past ten business days has a concrete, dated compliance question. It is not merely a vague feeling of being spammed.

What’s actually at stake: the penalty numbers

CASL’s administrative monetary penalties are set out in the legislation and the CRTC’s enforcement framework. Per the CRTC’s own enforcement guidance, the maximum penalty for a violation by a business is $10 million. That figure is the ceiling, not the expected outcome.

The caveat matters. Industry legal trackers that follow published CRTC settlements describe actual outcomes for small and mid-sized senders as running well short of the statutory ceiling. The size of a penalty depends on factors including the nature and scope of the violation, the operator’s compliance history, and whether the conduct was deliberate. A single missed unsubscribe request is unlikely to attract a headline number; a pattern of continued sends after documented opt-outs is a different matter. That cap is best read as a signal of how seriously the regime treats the channel. It says little about what any given breach will actually cost.

For a player, the penalty structure is background. The operative facts are the dated ones. When was consent given? When was the unsubscribe sent? Did the message continue past ten business days? Those are the facts a complaint to the CRTC would rest on, and they are the facts an operator’s compliance team is tracking.

The line, restated

The line between legitimate marketing and spam in this channel is not drawn by frequency or by how a player feels about the buzz. It is drawn by three CASL mechanics. Consent must be positive and provable, identification must travel with the message, and an unsubscribe must be honoured within ten business days. In Ontario, AGCO’s separate consent requirement for inducements and its outright ban on marketing to self-excluded players add a second layer.

A player who wants fewer notifications has a cleaner path than the settings menu suggests. Separate the functional stream from the marketing stream. The operator’s own marketing preferences are the relevant control; the phone’s global toggle silences both streams at once. A continued send past the ten-business-day mark is best treated as a dated compliance question, worth a documented complaint. The two rulebooks do the rest of the work, provided the operator is reading them the same way the regulator is.

The second rulebook: Ontario’s AGCO standards

CASL is federal and applies across Canada. Ontario adds a provincial layer through the Alcohol and Gaming Commission of Ontario, and the two instruments do not cover identical ground. This section is Ontario-specific; a player in another province is governed by CASL plus whatever their provincial regulator requires, which is a separate analysis.

Under AGCO’s Registrar’s Standards for Internet Gaming, two provisions bear directly on the notification channel.

The first is the self-exclusion marketing ban. A player who has registered for self-exclusion must not be sent marketing or inducements. This is not a consent question. It is a prohibition. An operator that continues to push bonus reminders to a self-excluded player cannot cure the problem by pointing to an earlier opt-in. The self-exclusion status overrides it. For players, this is the clearest line in the entire channel. Self-exclusion is the one signal that should stop marketing outright, and the standards make it an operator obligation rather than a player preference.

The second is the separate consent requirement for inducement marketing. AGCO’s standards require distinct consent for inducements (offers designed to prompt play, such as deposit matches, free spins, and bonus credit) as opposed to general account communications. A single blanket “I agree to receive communications” tick does not satisfy this; the inducement stream needs its own consent. That is a stricter posture than CASL’s general consent framework, and it is why an Ontario-licensed operator’s sign-up flow may present two separate marketing choices where a non-Ontario operator presents one.

Per AGCO’s Registrar’s Standards for Internet Gaming, that marketing ban falls on the operator automatically; a self-excluded player does not have to invoke it themselves. The practical effect for the notification channel is that a self-exclusion breach or an inducement sent without separate consent is exactly the kind of lapse AGCO’s standards are built to catch.

Responsible-gambling framing belongs directly in this section. Self-exclusion is a player-protection tool, and the marketing ban attached to it is the mechanism that makes the tool work. A player considering self-exclusion should treat the marketing stop as part of the package, and an operator’s notification behaviour after a self-exclusion request is a fair test of whether the standards are being honoured in practice. Players in Ontario can find self-exclusion registration through AGCO’s responsible-gambling resources; 18+ only, and support is available through provincial problem-gambling services.

Fewer notifications without losing the ones that matter

The terms-desk framing is that “notifications” is not one category, and the two rulebooks do not treat the categories identically.

Account and security messages (login alerts, password resets, KYC document requests, payout status updates, responsible-gambling tool confirmations) are functional. Under CASL they sit outside the marketing consent requirement because they facilitate or confirm a transaction the player already agreed to. Under AGCO’s standards they are not inducements. A player who wants fewer marketing pings should not treat these as part of the same stream; turning them off can mean missing a payout query or a security alert.

Marketing and inducement messages (bonus reminders, “your spins are waiting,” VIP nudges, deposit-match offers) are the commercial electronic messages the consent, identification, and unsubscribe mechanics govern. In Ontario, the inducement subset needs its own consent under AGCO’s standards, separate from general marketing.

Given the functional/marketing distinction described above, a player can usually reduce the marketing stream without touching the functional one. The operator’s marketing preferences are the place to check; the phone’s global notification settings silence everything, including the payout confirmation. How an operator handles the data behind those preferences, and what it retains, is covered in this desk’s breakdown of how online casinos keep your data safe.

There is a loyalty-economics angle too. VIP programmes often route their most persistent nudges through the notification channel, and the consent posture for those messages is worth reading alongside the programme terms, and this desk’s analysis of VIP and loyalty programmes in Canadian online casinos covers how the tiers are structured. A VIP host who pings a self-excluded player is a standards breach regardless of tier.

FAQ

Is a push notification from a casino app covered by CASL?

Yes, if it encourages participation in a commercial activity. Per the CRTC’s FAQ, CASL covers a commercial electronic message sent by any means of telecommunication, and this desk reads that wording as covering app push notifications the same way it covers SMS and email, though no CRTC ruling names push notifications specifically. Installing the app is not consent to marketing through it.

How long does a casino have to stop marketing after I unsubscribe?

Ten business days, per the CRTC’s FAQ. The separate sixty-day figure describes how long the unsubscribe mechanism itself must stay usable after the message was sent. It is not a period during which marketing can continue.

Does Ontario have stricter notification rules than the rest of Canada?

Ontario adds AGCO’s Registrar’s Standards for Internet Gaming on top of CASL. Those standards bar marketing to self-excluded players outright and require separate consent for inducement marketing. The AGCO layer is Ontario-specific; other provinces are governed by CASL plus their own regulator’s requirements.

Can I turn off bonus reminders without losing payout or security alerts?

Usually yes. Functional messages (payout status, KYC requests, security alerts) sit outside the marketing consent requirement, while bonus reminders and inducement offers are governed by it. Adjusting the operator’s marketing preferences targets the second stream without silencing the first.

What happens if a casino keeps texting me after I opt out?

The compliance question is dated. When was the opt-out sent? Did messages continue past ten business days? A documented pattern is the basis for a complaint to the CRTC. CASL’s maximum penalty for a business runs into eight figures, though published outcomes have run well below that cap.