It's an interesting question.
My understanding of the CASL provisions on consent—even though we're not enforcing them, we're generally aware of them—is that it's an opt-in regime in which an individual receives communications from an organization only if they have opted in to that conduct.
PIPEDA, more generally, does not define specifically the relationships that are subject to opt in or opt out. It gives a certain number of general considerations. Under PIPEDA implied consent is permissible, but explicit consent is required based on a number of criteria. For instance—