Cross-border acquisition in Canada and Mexico for US startups: consent, advertising, tax and shipping rules

What to take away

What changes when a US startup acquires customers in Canada and Mexico

A US startup can run the same product in Toronto and Monterrey, but it cannot run the same acquisition playbook. Canada and Mexico each set their own rules for consent, advertising, tax and delivery. The differences show up in the first campaign, not at scale.

In Canada, privacy law is federal plus provincial. Quebec adds its own requirements, which is why teams running a quebec startup acquisition campaign need consent records that satisfy both layers. In Mexico, the federal LFPDPPP covers personal data nationwide, and PROFECO enforces advertising standards for consumer offers.

Language matters too. Canada works in English and French, and Quebec has additional privacy and French-language requirements under Law 25 and the Charter of the French Language. Mexico works in Spanish. A campaign translated by a general tool will read as foreign and can breach advertising rules on clarity.

Payment habits differ. Canadian buyers use cards and Interac; Mexican buyers may use cards, OXXO cash-payment vouchers and SPEI bank transfers. Test checkout methods alongside acquisition channels: Google Ads and Meta Ads for consumer campaigns, LinkedIn Ads for B2B, and Amazon.ca, Amazon.com.mx or Mercado Libre when marketplace demand fits. Compare qualified leads or orders and post-delivery contribution by country; do not assume a channel or payment option transfers unchanged.

Acquisition economics shift by province and campaign. Compare customer acquisition costs in canada before setting budgets, then use your own qualified-conversion results rather than assuming labor costs or ad-auction conditions transfer between California, New York, Texas, Florida, Toronto and Vancouver.

Canadian CASL consent requirements for email acquisition

Canadian CASL consent is the rule that most often trips up US email programs. CASL, the Canadian anti-spam law, requires consent before a commercial electronic message is sent to a Canadian address. Consent can be express or implied, and the burden of proof sits with the sender. The CRTC enforces CASL's anti-spam provisions.

PIPEDA, the Personal Information Protection and Electronic Documents Act, is the federal private-sector privacy law, alongside substantially similar provincial laws that may apply to intraprovincial activity.

Express consent means the recipient opted in, with a clear statement of what they will receive. Implied consent covers existing business relationships and publicly published addresses, but only for a limited period and only if the message relates to the recipient's role or business.

Every message needs a working unsubscribe, the sender's identity and a physical mailing address. Unsubscribes must be honored within 10 business days.

The CRTC may impose administrative monetary penalties of up to CAD $1 million on an individual or CAD $10 million on an organization. CASL's statutory private right of action was suspended and is not in force, so do not describe lawsuits under that provision as available.

Consent records must show who consented, when, how and to what. That is why permission records precede automation in any cross-border program. If a CRM cannot store the source and timestamp of consent, fix that before the first send.

Practical steps for a compliant Canadian email flow:

Quebec's Law 25, formerly Bill 64, adds privacy duties, while the Charter of the French Language sets French-language obligations for commercial communications. The OQLF (Office québécois de la langue française) oversees enforcement of the language charter. A US startup selling into Montreal should treat Quebec as its own compliance lane, not a French translation of the Canadian flow.

Canadian advertising rules beyond consent

Canadian advertising claims fall under the federal Competition Act, which bars false or misleading representations made to promote a product or business. That covers price claims, performance claims and endorsements. Under the drip-pricing provisions, an advertised price must also include mandatory fixed fees, although sales taxes may be added at checkout.

Quebec adds its Consumer Protection Act. It requires the advertised price to include the total amount the consumer must pay, other than GST and QST, and it restricts commercial advertising directed at children under 13. Check each campaign against both regimes before one creative runs in Toronto and Montreal, and keep the evidence for every claim on file.

Mexico's LFPDPPP and PROFECO advertising rules

Mexico's LFPDPPP is the federal personal data protection law. It requires a privacy notice before data collection, states the purpose of processing, and gives people access, rectification, cancellation and opposition rights, known as ARCO (acceso, rectificación, cancelación y oposición).

Consent must be informed and, for sensitive data, express. Older materials name INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales); current federal data-protection functions are assigned to Secretaría Anticorrupción y Buen Gobierno. LFPDPPP administrative fines can reach 320,000 UMA (Unidad de Medida y Actualización), with the applicable tier depending on the infraction.

The privacy notice must be available in Spanish. It should name the data controller, the purposes, transfers to third parties and how to exercise rights. US startups often bury this in an English policy and fail the notice requirement at the point of collection.

PROFECO advertising rules govern how offers are presented to consumers. PROFECO, the federal consumer protection agency, requires that advertising be truthful, verifiable and clear about price, terms and conditions. Promotions must state their duration and any restrictions.

If a campaign says a discount ends Friday, it must end Friday. If a price excludes tax, the ad must say so. Comparative claims need evidence. These are the same standards the FTC applies in the US, as covered in our FTC endorsement guides piece, but enforcement runs through Mexican procedure and Spanish-language filings.

Data transfers to US servers need a lawful basis and disclosure. Many Mexican buyers expect a local contact channel, so a WhatsApp number or local phone line improves trust and response rates. That choice also affects how consent is recorded.

A short compliance checklist for Mexico:

USMCA context for cross-border selling

USMCA replaced NAFTA and governs most trade among the United States, Canada and Mexico. It can remove tariffs on qualifying goods that meet rules of origin, which can lower landed cost for physical products. The agreement also covers services, digital trade and intellectual property.

The US government maintains a plain-language overview of Trade Agreements that explains how USMCA and other pacts affect exporters. Read it before assuming a product enters duty free. Rules of origin, certification and record keeping decide that.

The US Department of Labor publishes USMCA guidance on the agreement's labor provisions and how they interact with trade. Labor rules can affect supplier choices, especially for goods assembled in Mexico.

USMCA does not erase tax registration, customs brokerage or consumer law. A US startup still needs an importer of record, correct HS codes and a carrier that handles customs. Software and digital services face different treatment than physical goods.

For acquisition planning, USMCA mainly changes unit economics. Lower duties can fund free shipping thresholds or lower prices. Those decisions feed directly into customer acquisition cost by channel, because shipping and duties sit inside contribution margin.

Tax and shipping differences north and south of the border

Tax differences start with registration. Canada uses GST and HST, and the Canada Revenue Agency explains the registration and collection rules in its "GST/HST for businesses" guidance. The federal GST is 5 percent, and HST provinces such as Ontario (13 percent) and New Brunswick, Newfoundland and Labrador and Prince Edward Island (15 percent) combine federal and provincial tax. Nova Scotia's HST fell from 15 to 14 percent on April 1, 2025. Quebec adds its own QST of 9.975 percent, registered through Revenu Québec. A small supplier is exempt until it passes CAD $30,000 in revenue over four consecutive calendar quarters. A business registers for a business number and a GST/HST account online or with form RC1. Non-resident sellers of digital products to Canadian consumers can use CRA's simplified registration. Marketplaces and digital sales have their own rules.

Mexico uses VAT, known as IVA, at a general rate of 16 percent, plus customs duties and possible withholding on digital services. The tax authority is the SAT (Servicio de Administración Tributaria). Non-resident providers of digital services to Mexican consumers register with the SAT, obtain an RFC (Registro Federal de Contribuyentes) and charge IVA. Article 18-D of the IVA law covers these providers. Sellers of physical goods usually meet IVA and duties at customs through the importer of record.

The steps for a digital provider run in order. Register online with the SAT before the first sale to a Mexican user, charge 16 percent IVA, and file a monthly return by the 17th of the following month. Advisory sources disagree on whether a local representative or proof of domicile is now required, so confirm the current procedure with the SAT or a Mexican tax adviser. US state sales tax rules do not carry over.

Income tax follows different logic. Canada and Mexico may tax profits tied to local activity, and US startups should check treaty provisions to avoid double taxation. The IRS and state agencies in California, New York, Texas and Washington all have a stake when nexus exists.

Shipping differences are just as concrete. For a US-to-Canada or US-to-Mexico pilot, request route-specific quotes from USPS, Canada Post, UPS, FedEx, DHL Express and Estafeta rather than assuming one carrier serves every lane at the same terms. This guide gives no per-lane price because rates move with weight, service level and customs status, and each carrier publishes a current rate calculator. Compare customs handling, delivery coverage, tracking, returns and remote-area surcharges for target cities; remote Canadian regions cost more and winter delays are normal, while address quality and cash-on-delivery expectations vary outside Mexico's largest cities.

Customs thresholds decide whether a small parcel pays at the border. Under CUSMA, the CBSA remits customs duties on courier shipments from the US valued at C$150 or less, and sales taxes on those valued at C$40 or less. A parcel between C$40 and C$150 therefore owes GST/HST but no duty. Mail has a lower limit of C$20.

Mexico's USMCA thresholds are US$50 for tax-free treatment and US$117 for duty-free treatment on express shipments, so 16 percent IVA can apply to a parcel between those values. Duty relief needs origin documentation, and carriers apply the limits differently. Confirm the current SAT and ANAM rules before setting a free-shipping threshold.

A simple comparison for planning:

These differences change return rates, support load and cash timing. Build them into the acquisition model rather than discovering them after launch.

Export assistance and market research before launch

Free US government help exists for cross-border acquisition. The SBA offers export and trade assistance through local counselors and Small Business Development Centers. Counselors can review pricing, logistics and market entry plans.

The Commercial Service at trade.gov provides Research By Country reports for Canada and Mexico. These cover market size, channels, regulations and competitors. Use them to test assumptions before spending on ads.

Put privacy requirements into the market research checklist early. If the research plan collects emails or phone numbers in Canada or Mexico, consent and notice rules apply during research, not only during sales.

Other useful US sources include the Census Bureau for trade data, the BLS for labor costs, the USPTO for trademark clearance, and the BBB for consumer complaint patterns. The FTC and SEC matter if claims or fundraising cross lines.

A pre-launch research sequence:

Building one acquisition process that satisfies both markets

One process can serve both countries if it branches at the right points. Consent capture, claims review and shipping logic should be configurable by country, not hard-coded per campaign.

Treat launch as a sequence: choose one country and customer segment; select one acquisition channel; prepare the local notice, claims and checkout; confirm tax-registration needs and carrier quotes; then pilot and measure qualified conversion, refunds, delivery times and contribution margin. Expand to the second market only after documenting what transferred and what did not.

Start with a single intake form that detects country and serves the correct notice, language and consent language. Store the version shown. That one design choice prevents most CASL and LFPDPPP failures.

Keep a claims library for Mexico that holds evidence for every price, discount and comparison. Route new creative through it before launch. In Canada, keep French and English versions aligned so a claim does not change meaning across languages.

Connect tax and shipping rules to the checkout and to ad promises. If an ad says free shipping, the rule must know whether that holds for Quebec, British Columbia, Jalisco and Nuevo Leon. Broken promises create PROFECO and FTC exposure.

Measure by country and province or state, not by a single North America number. Canadian and Mexican costs behave differently, and blended metrics hide the market that needs fixing. Review consent records, refund rates and delivery times monthly.

Common questions