Canada

PIPEDA (and Quebec Law 25)

Canada’s federal private-sector privacy law; Quebec’s Law 25 adds stricter rules, including consent for tracking technologies.

Status
In effect since January 1, 2001
Citation
S.C. 2000, c. 5
Official text
Read the law(opens in a new tab)

Who it covers

Businesses with a real and substantial connection to Canada, such as serving Canadian customers.

What it asks of your website

  • Get meaningful consent for collecting and using personal data, and express consent for sensitive data. In Quebec, tracking technologies must stay off until the person turns them on.
  • Explain your privacy practices in plain language.
  • Name a person responsible for privacy and let people access and correct their data.

Two laws to know: PIPEDA and Quebec’s Law 25

PIPEDA covers personal information that businesses collect, use or disclose in commercial activity across Canada. Quebec, Alberta and British Columbia have their own private-sector laws that replace PIPEDA inside those provinces, but PIPEDA still applies when data crosses provincial or national borders.

Quebec’s law, updated by Law 25, is the strictest, and it matters most for cookies.

Cookies and ads under PIPEDA

Consent is valid only if people would understand what they’re agreeing to. The Privacy Commissioner’s guidance asks for clear yes-or-no options and a layered notice. For behavioral advertising, opt-out consent can be reasonable if the opt-out takes effect immediately and lasts, the data isn’t sensitive, and it’s destroyed or de-identified as soon as possible. Sensitive data needs express consent, and the Commissioner says to avoid tracking children.

Cookies in Quebec: off until the visitor chooses

Law 25 requires telling people about any technology that can identify, locate or profile them, and how to turn it on. Quebec’s privacy regulator, the Commission d’accès à l’information, says these technologies can’t be on by default. Consent must be clear, free, informed and for specific purposes.

Policies, privacy officer and requests

  • Privacy policy: PIPEDA requires making your practices readily available; Law 25 requires publishing a plain-language policy on your website when you collect data online.
  • Privacy officer: PIPEDA requires naming someone accountable. In Quebec, publish that person’s title and contact details on your website.
  • Requests: answer within 30 days under both laws. In Quebec, no answer counts as a refusal.
  • Breaches: report serious ones to the regulator and the people affected. Quebec also requires a register of every incident.

Enforcement and penalties

Under PIPEDA, the Privacy Commissioner investigates; complainants can then go to Federal Court, which can award damages. Certain offences carry fines of up to $100,000.

Quebec is far tougher. The Commission can impose administrative penalties of up to C$10 million or 2% of worldwide turnover, and courts can impose fines of up to C$25 million or 4%, whichever is higher.

A federal replacement for PIPEDA, Bill C-36, was introduced in June 2026; it isn’t law, so PIPEDA still applies.

Where GoConsent helps

Privacy Policy builder

A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.

Copy and delete requests (Pro)

Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.

A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.

FAQ

Questions, answered

Do I need cookie consent in Canada?

In Quebec, tracking technologies must be off until the visitor turns them on. Elsewhere, opt-out can be reasonable for non-sensitive ads under the Commissioner’s conditions.

How fast must I answer a privacy request in Canada?

Within 30 days under both PIPEDA and Quebec’s law.

How big are Quebec’s penalties?

Up to C$25 million or 4% of worldwide turnover in court, or C$10 million or 2% as administrative penalties.

Sources

Check your site against this law

GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.

Get GoConsent free See Pro plans