The Facebook boost got rejected before it even went live. The TikTok account lasted three weeks before a flag. The Instagram reach is down to 4% of followers and dropping. If you've been piecing together a social media presence for your vape shop, you already know that every platform holds the same power over you: set the rules, change them without notice, enforce them inconsistently.
Email doesn't work that way. Your list belongs to you. The rules are written down in actual legislation — Canada's Anti-Spam Legislation (CASL) and the Tobacco and Vaping Products Act (TVPA) — and they've been stable long enough that the compliance steps are well understood. When you send a compliant email to a verified, opted-in subscriber, it lands in their inbox. No algorithm decides whether it's worth showing. No platform decides your product category is newly restricted this month.
For Canadian vape retailers, email is the most controllable, most documentable marketing channel available. It's also the most underused. This guide covers the legal framework, the list-building mechanics, and what's actually worth sending.
Email vs. Social Media: The Honest Comparison
Our social media marketing guide for Canadian vape retailers covers what's allowed on Instagram, Facebook, TikTok, and YouTube in detail. The short version: paid ads are banned everywhere, organic reach is algorithm-dependent, and platform policy can shift with no warning. Email sits in a different category entirely.
| Social media (organic) | ||
|---|---|---|
| Who controls reach | Platform algorithm | You |
| Typical reach per send | 3–8% of followers | 35–50% open rate (retail average) |
| Age verification | Page-level setting, imperfect | Built into sign-up form |
| Compliance documentation | Screenshots, manual records | Automatic (ESP logs consent) |
| Platform deplatforming risk | High | None — you own the list |
| Rules set by | Private company, can change anytime | Federal legislation (CASL + TVPA) |
The open rate figure is worth pausing on. A retail email list with a healthy open rate of 35–45% means a third of your subscribers actually read your message. Compare that to a Facebook post reaching 4% of your followers on a good day, with no guarantee those followers are even your target customer. The economics are not close.
The two laws that govern your email program
CASL (Canada's Anti-Spam Legislation) governs any commercial electronic message sent to a Canadian recipient. The requirements: express or implied consent from the recipient, clear sender identification, and a working unsubscribe mechanism in every email. Violations carry fines up to $10 million for businesses — but for a retailer operating in good faith, meeting these requirements is straightforward.
The TVPA's Vaping Products Promotion Regulations (VPPR) apply to promotional email content the same way they apply to print or social media: no content appealing to youth, health warnings where content functions as an advertisement, and stricter rules in Quebec and Manitoba. Email doesn't get special treatment — but it doesn't get extra restrictions either.
The practical advantage: a properly built CASL opt-in, with age confirmation at sign-up, simultaneously satisfies your TVPA obligation to avoid reaching minors. One compliance step covers both laws. For the full regulatory picture, see our 2026 Canadian vape compliance guide.
Building a List Legally: What the Sign-Up Needs to Include
The sign-up form is where your compliance record gets built. Everything downstream — what you send, how you send it, how you defend yourself if a complaint is ever filed — rests on the quality of what you collect here.
Express consent with age confirmation. CASL requires consent before you send commercial email. For vape retailers, express consent (an explicit, documented opt-in) is better than implied consent even when implied consent would technically suffice — it's cleaner to prove and doesn't expire the way implied consent does. The consent checkbox and the age confirmation can live in the same form field: "I am 18 or older (19+ in Alberta, Manitoba, and other applicable provinces) and I consent to receive marketing emails from [Shop Name]." The box must be unchecked by default. Pre-checked boxes don't constitute valid CASL consent.
Record everything automatically. Klaviyo, Mailchimp, Omnisend, and most Shopify-integrated email platforms log IP address, timestamp, and form source for every sign-up automatically. Don't disable this logging. That record is your first line of defence if a CRTC or Health Canada complaint is ever filed. For implied-consent subscribers (recent purchasers who didn't fill out a form), track the purchase date — implied consent expires 24 months from the last transaction, and you need to know when to re-obtain express consent or stop sending.
In-store collection. Counter sign-ups are high-value — a customer giving you their email in person is already loyal enough to be worth retaining. A paper form works fine, provided it includes a clear written consent statement and is dated and filed. The statement needs to say what they're consenting to: "I consent to receive marketing emails from [Shop Name]." A verbal "can I add you to our list?" does not constitute CASL consent. This is also a natural moment for your staff to confirm age — which should already be happening as part of your standard retail practice. For more on building a staff compliance culture, see our guide on vape staff training and compliance.
Never purchase lists. Purchased email lists fail CASL consent requirements by definition — the people on them never opted in to hear from you specifically. They also destroy deliverability: a list full of people who didn't ask for your emails generates spam complaints, which damages your sending domain's reputation with inbox providers. A domain with a bad reputation eventually gets blacklisted, meaning your emails stop arriving even for people who do want them. Two hundred genuine opt-ins outperform twenty thousand purchased addresses by every metric that matters.
What to Actually Send
The retailers who do email well aren't running complex automation sequences. They're sending useful, relevant messages on a predictable cadence to people who asked to hear from them. Three content types do the heavy lifting.
New stock and restock announcements. This is the highest-value email a vape retailer can send, and it's the most informational in character — which matters for VPPR risk. "We received the new Lost Mary OS5000 shipment today — all flavours now available" is a useful message to someone who's been waiting on that SKU, and it reads as an inventory update rather than a lifestyle advertisement. Keep the framing plain. Price-leading subject lines push content toward promotional territory; availability updates stay in the informational lane. Your new arrivals page is the natural landing destination for these emails — link there rather than a specific product page so the email stays useful even when individual SKUs sell out.
Educational content. A monthly email with genuinely useful information earns ongoing subscriber attention between stock announcements. Device maintenance walkthroughs, guides to getting the most from a disposable, comparisons between pod systems and disposables — this content positions your shop as the most knowledgeable option in your area. It's also low-risk under the VPPR: content that helps customers use their devices well is not promotional in character. Keep the email itself concise and link out to longer blog posts for readers who want the full detail.
Regulatory and compliance updates. Your customers are affected by the same rules you are. When provincial flavour restrictions change what's on your shelves, when new Health Canada requirements affect packaging, when age of purchase rules update — a plain-language explanation of what's changing and what it means builds trust and reduces friction at the counter. Customers who understand the regulatory environment are also more likely to understand why you carry what you carry, and why the provenance of your stock matters.
What to avoid in every email: subject lines framed around discounts and urgency that read like spam, imagery featuring people of ambiguous age, flavour descriptions leaning on candy or dessert associations, and any lifestyle framing that positions vaping as an identity rather than a product. Any of these attracts VPPR scrutiny; the first one also attracts spam filters.
| Email type | Cadence | VPPR risk | Health warning needed? |
|---|---|---|---|
| Restock / new arrival | As needed | Low (informational) | If framed as ad: yes |
| Educational / how-to | Monthly | Low | Generally no |
| Promotional offer | Occasional | Medium | Yes |
| Regulatory update | When relevant | Low | No |
On the health warning question: the VPPR requires a warning in content that constitutes a "promotion" of a vaping product. Purely informational stock announcements and educational content generally fall outside that definition. If your email leads with a price, a time-limited offer, or explicit product appeal claims, include the warning. When unsure, include it — it's one line in your template footer and removes ambiguity.
Platform Setup: The Non-Negotiables
Most Shopify-integrated email platforms — Klaviyo, Mailchimp, Omnisend — handle the technical requirements automatically if you configure them correctly at setup. Four things matter most.
Consent fields on every form. Every sign-up point — footer embed, pop-up, checkout opt-in — needs an unchecked consent checkbox with age confirmation language. Audit this periodically; pop-up apps and theme updates sometimes reset form configurations.
Unsubscribe in every email. CASL requires a working unsubscribe mechanism that processes within 10 business days. Every major ESP handles this automatically, but test it once on your own list — send a subscribe request, then unsubscribe, and confirm you're actually removed. It takes five minutes and confirms the mechanism works before a customer or regulator tests it for you.
Sender authentication. SPF, DKIM, and DMARC records on your sending domain are standard deliverability setup. They also serve a secondary function: they establish that emails sent from your domain are authorised by you, which matters if a spam complaint triggers an investigation. Your ESP's onboarding documentation covers the DNS record setup; most platforms walk you through it step by step.
Implied consent expiry tracking. If you're including purchasers under implied consent rather than asking for express opt-in at checkout, set a reminder to re-consent those subscribers before the 24-month window closes. Most ESPs can automate this with a re-engagement campaign sent at month 22. Subscribers who don't re-engage should be removed from your commercial email list — keeping them creates CASL exposure with no corresponding marketing benefit.
The Compliance Case Only Holds If the Inventory Does Too
A clean email program creates a paper trail showing Health Canada's Tobacco Control Directorate — which actively monitors TVPA compliance across marketing channels — that your shop takes its obligations seriously. That paper trail has real value. But it only holds up if the products you're announcing are themselves compliant.
Sending a well-structured, age-verified email about a product that carries grey-market authenticity questions, missing excise stamps, or non-CRC packaging creates an inconsistency that a Health Canada review would notice. The compliance case for your email program and the compliance case for your shelves are the same case. If you're sourcing from a supplier whose products are properly registered and correctly stamped, those are the products worth announcing to your list — and announcing them is defensible.
If you're still working through the inventory side, the guide on stocking your first vape shop in Canada covers what to look for in wholesale sourcing. Getting compliant stock on the shelf is the foundation everything else — including your email program — sits on.
Before Your First Send: A Compliance Checklist
List setup — do this once
- Express consent checkbox (unchecked by default) on every sign-up form
- Age confirmation in sign-up language — 18+ or 19+ depending on province
- ESP consent logging active: timestamp, IP, and form source recorded per subscriber
- In-store paper sign-up forms dated, filed, and retrievable
- No purchased or imported lists of unverified contacts
- Implied consent expiry dates tracked for purchase-based subscribers
Per campaign
- Sender name and physical business address in every email footer
- Functional unsubscribe link present and tested
- Health warning included where content functions as a vaping product promotion
- No imagery that could appeal to a person under 18
- No flavour language using candy, dessert, or youth-associated framing
- Subject line accurately reflects email content — no misleading headers
Ongoing
- Campaign archive maintained — exported records of all sends
- Unsubscribe requests processed within 10 business days
- Implied consent subscribers re-consented before 24-month window closes
- Quebec and Manitoba subscribers flagged — provincial restrictions are stricter
- CASL and TVPA updates reviewed annually — rules have been stable but do evolve
The archive point deserves emphasis. Health Canada's Tobacco Control Directorate monitors promotional content across all channels — keeping dated records of your campaigns, including screenshots of your sign-up forms and consent settings at the time of each send, gives you a clear, documentable response to any complaint that gets filed. It's the same documentation habit worth maintaining across all your marketing channels.
