The sixty-second answer
For a commercial electronic message: the name you carry on business under, a mailing address, and at least one of a telephone number, email address or web address, plus an unsubscribe mechanism - all set out clearly and prominently, and valid for a minimum of sixty days after sending. Everything else is optional.
The prescribed list, in full
Most email signatures are longer than the law requires and missing at least one thing the law does require. The requirement itself is short and precise, and it lives in two places.
CASL section 6(2) says a commercial electronic message must be in a form that conforms to the prescribed requirements and must set out prescribed information identifying the sender and, if different, the person on whose behalf it is sent; information enabling the recipient to readily contact one of them; and an unsubscribe mechanism in accordance with subsection 11(1) [1].
The CRTC's Electronic Commerce Protection Regulations then spell out what "prescribed information" means. For the purposes of subsection 6(2), a commercial electronic message must set out [2]:
(a) the name by which the person sending the message carries on business, if it is different from their name, and if not, their name;
(b) if the message is sent on behalf of another person, the name by which that person carries on business, on the same basis;
(c) if the message is sent on behalf of another person, a statement indicating which person is sending the message and on whose behalf it is being sent;
(d) the mailing address, and either a telephone number providing access to an agent or a voice messaging system, an email address, or a web address, of the sender or, if different, of the person on whose behalf the message is sent.
Read (d) closely, because it is the item most often botched. The mailing address is not optional and it is not one of the alternatives - it is required, and you must also give at least one of the three contact channels. A signature with a phone number and no address does not satisfy it.
The unsubscribe mechanism
Subsection 11(1) sets the standard. The mechanism must enable the recipient to indicate, at no cost to them, that they no longer wish to receive any commercial electronic messages - or any specified class of them - from the sender, using the same electronic means by which the message was sent or, where that is not practicable, any other electronic means that will let them indicate the wish. And it must specify an electronic address, or a link to a web page accessible through a web browser, to which the indication may be sent [3].
Two operational requirements sit alongside. The address or web page must remain valid for a minimum of 60 days after the message has been sent [3]. And you must give effect to an unsubscribe "without delay, and in any event no later than 10 business days after the indication has been sent, without any further action being required on the part of the person" [3]. That last clause rules out confirmation loops that only take effect if the recipient clicks a second time.
Which of your emails this actually applies to
Not all of them, and this is where signatures get over-engineered. Section 6 of the Act does not apply to several categories of message, set out by regulation [4]:
Messages sent by an employee, representative, consultant or franchisee of an organisation to another within the same organisation, where the message concerns the organisation's activities - or to someone in another organisation where the two have a relationship and the message concerns the receiving organisation's activities [4].
Messages sent in response to a request, inquiry or complaint, or otherwise solicited by the person to whom the message is sent [4].
Messages sent to satisfy a legal or juridical obligation, to provide notice of an existing or pending right, obligation, court order, judgment or tariff, or to enforce one [4].
CASL also excludes, at the statutory level, a message sent to a person engaged in commercial activity that consists solely of an inquiry or application related to that activity [1].
So: your reply to a customer's question, your note to a colleague, and your invoice reminder are not the target. Your outbound promotion is. In practice the sensible approach is one signature that satisfies the prescribed list all the time, because the alternative is deciding message by message and getting it wrong on the one that matters. The wider question of when you cross into campaign territory is in do I need a mailing list tool, or can I just email my customers.
What can live behind a link
You are not required to cram everything into the footer. Where it is not practicable to include the prescribed information or the unsubscribe mechanism in the message itself, that material "may be posted on a page on the World Wide Web that is readily accessible by the person to whom the message is sent at no cost to them by means of a link that is clearly and prominently set out in the message" [2].
Three conditions there. Readily accessible. No cost. And a link that is clearly and prominently set out - not a word buried in a paragraph of grey six-point type.
"Clearly and prominently" is itself a requirement, applying to both the prescribed information and the unsubscribe mechanism [2], and the unsubscribe mechanism separately "must be able to be readily performed" [2]. That phrase does real work: an unsubscribe that requires signing in, or answering questions, or emailing a request for removal, is not readily performed.
The sixty-day rule that trips people up
Both the contact information and the unsubscribe destination must stay valid for at least 60 days after the message is sent [1] [3].
This has an unglamorous consequence: the details in your signature commit you for two months past your last send. Changing a phone number, retiring an address, or decommissioning a campaign landing page all have a sixty-day tail behind them. Since email is one of the places a business's own contact details are most likely to go stale, this is a good argument for putting the durable ones in the signature - the mailing address and a role address like info@ - rather than something you expect to change. Role addresses as aliases are covered in addresses, aliases and shared mailboxes.
What to keep out of it
Unsupportable claims. A signature is a representation to the public. The Competition Act covers representations to the public that are false or misleading in a material respect, and treats a performance or efficacy claim "not based on an adequate and proper test thereof, the proof of which lies on the person making the representation" as reviewable conduct [5]. "Award-winning", "certified", "number one in Atlantic Canada" and "guaranteed" all belong to that category. If you cannot produce the substantiation, take the line out.
Prices. The same section treats a price that is not attainable because of fixed obligatory charges or fees as a false or misleading representation in itself, carving out only charges imposed under an Act of Parliament or a provincial legislature [5]. A price in a signature is a price with no room for conditions.
Detail rendered only as an image. An address that exists only inside a logo graphic disappears when images are blocked, and is invisible to assistive technology. The Accessible Canada Act sets the national purpose of a Canada without barriers on or before January 1, 2040, through the identification and removal of barriers in areas including information and communication technologies [6]. A text signature with one small logo is both more compliant and more likely to be read.
Legal boilerplate nobody reads. A four-paragraph confidentiality notice does not create confidentiality. If you handle personal information, the useful thing is a privacy policy people can actually reach: PIPEDA requires organisations to make information about their policies and practices readily available, without unreasonable effort and in a generally understandable form [7]. A one-line link does that job. More in business email privacy obligations in Canada.
Where we sit
MapleMail is business email on your own domain, and signatures are set once and applied across the devices you read and write on - which matters, because the usual failure is a compliant signature on the laptop and a bare "Sent from my phone" on everything else. The device side is covered in business email on your phone and laptop, and if you are just starting, the order of operations is in how to set up email for a new business.
Plans and what each mailbox includes are on the pricing page. One caveat, meant seriously: this sets out what the Act and regulations say. It is not legal advice, and a claim you are unsure about is worth a lawyer's time.