PIPEDA is Canada's federal privacy law for the private sector. Its full name is the Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), and it applies to any organization that collects, uses or discloses personal information in the course of commercial activity. It does not ask where your company is based. It asks whether there is a real and substantial connection to Canada.

For a website owner, the practical answer is short. If you have Canadian visitors, run tracking on that traffic and do it as a business, PIPEDA is probably already in scope. Unlike the GDPR, the logic is not a list of legal bases. In Canada, almost everything is settled inside consent.

PIPEDA took effect in three phases between 2001 and 2004. It rests on ten principles in Schedule 1 of the Act, running from accountability (4.1) to challenging compliance (4.10). Section 5(1) makes those principles mandatory, but only where the text says "shall". Where Schedule 1 says "should", section 5(2) treats it as a recommendation.

Section 5(3) adds a filter that matters for tracking. An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. Consent does not cure an inappropriate purpose.

Two kinds of material circulate under the PIPEDA name, and they are easy to mix up. The Act and its regulations are binding. The guidelines of the Office of the Privacy Commissioner of Canada (OPC) are the regulator's reading of the Act, and they shape how it investigates, but they are not statute.

This article marks the difference each time it matters. A rule that comes from the OPC is described as the OPC's position, not as the law.

PIPEDA applies under section 4(1) to organizations that handle personal information in commercial activity, and to federal works, undertakings and businesses. Employee data only falls in when the employer is a federal work or business.

A Canadian court applied the real-and-substantial-connection test to a foreign operator in A.T. v. Globe24h.com (2017 FC 114). The Federal Court took jurisdiction over a company based in Romania because its audience and the impact of its conduct were in Canada.

Quebec, Alberta and British Columbia have their own private-sector laws, and the federal government has recognized them as substantially similar through orders under section 26(2)(b). Those orders exempt organizations from PIPEDA for activity inside the province. They do not cover cross-border flows or federal businesses, so PIPEDA can still apply to the same company on the same day.

The practical rule: if your visitors are in Quebec, read the provincial layer below. If they are spread across Canada, PIPEDA is your baseline, and it is worth choosing a cookie banner that can show the right notice for each region.

Here is the difference most guides get wrong. PIPEDA has no provision equivalent to article 5(3) of the ePrivacy Directive. Nothing in the text says "ask before the first cookie". What the Act asks for is valid consent under section 6.1, and that depends on whether people understand what they are agreeing to.

The OPC fills the gap with two documents. The first is the guidelines for obtaining meaningful consent, published on 24 May 2018 and expected to be followed from 1 January 2019. They set out seven guiding principles and four key elements that must be easy to find: what is collected, who it is shared with, why, and the risk of harm.

The second is the OPC policy position on online behavioural advertising, issued in December 2015 and modified on 11 August 2025.

For behavioural advertising, the OPC accepts opt-out consent, but only if six conditions are all met. In short, people are told clearly about the purposes and the parties involved, the opt-out is easy and takes effect immediately, the data collected is limited and not sensitive, and it is deleted or made anonymous as soon as possible.

The same position says that zombie cookies, supercookies and device fingerprinting should not be allowed at this time. If your stack uses any of these, opt-out is not available to you.

The consent guidelines call for express opt-in consent when information is sensitive, or when the collection or use falls outside what people reasonably expect, or when it creates a meaningful residual risk of significant harm. Health and financial data are the usual examples.

Not in practice. A banner is not required by name, but without one you have a hard time showing meaningful consent, an easy opt-out and a record of the choice. A consent management platform such as AdOpt gives you the notice, the choice and the proof in one place.

Quebec has the strictest layer. Law 25 amended the Act respecting the protection of personal information in the private sector (P-39.1), with phased dates on 22 September 2022, 2023 and 2024. Section 8.1 requires informing people when a technology can identify, locate or profile them, and section 14 requires consent that is clear, free and informed. Administrative penalties can reach CAD 10 million or 2%, and penal fines CAD 25 million or 4%, doubled for repeat offences.

Alberta (PIPA, S.A. 2003, c. P-6.5) has mandatory breach notification in section 34.1. British Columbia's PIPA (S.B.C. 2003, c. 63) has no mandatory private-sector breach notification, to our last check. Neither province has a cookie-specific provision.

PIPEDA gives people a right of access (section 8 and principle 4.9), a right to challenge accuracy and have information corrected, and a right to withdraw consent (4.3.8). It does not give a general right to erasure or to portability. Quebec added portability in section 27 of its law from 22 September 2024.

The full procedure, with deadlines, is in our guide to the PIPEDA DSAR privacy portal.

The OPC investigates complaints, issues findings and can take a case to the Federal Court. It has no power to issue orders or administrative fines. The only money penalties in the Act are the criminal fines in section 28: up to CAD 10,000 on summary conviction and CAD 100,000 on indictment, imposed by a court.

That is why enforcement looks light on paper. The real exposure is a public finding, a court-ordered remedy under section 16, and contract and reputation risk with Canadian customers.

Sections 10.1 to 10.3 require reporting a breach of security safeguards to the OPC and notifying affected people when there is a real risk of significant harm, "as soon as feasible". Records of every breach must be kept for 24 months under the breach regulations (SOR/2018-64).

Earlier reform bills C-11 and C-27 did not pass. The current attempt is Bill C-36 in the 45th Parliament, introduced on 15 June 2026. It would repeal Part 1 of PIPEDA and create a new regime with administrative penalties. As of this writing it is at second reading in the House of Commons and has not received royal assent.

PIPEDA remains the law in force. Do not plan around penalty amounts that have not been confirmed in the bill text.

1. Map every cookie, tag and SDK on your site, with its purpose and its vendor. A data inventory makes the next steps possible.
2. Decide the consent type per category: opt-out only if all six OPC conditions hold, otherwise opt-in.
3. Show the four key elements before any non-essential tag fires.
4. Write the documents that back the banner: the cookies policy and the privacy policy.
5. Keep a record of each choice, including the policy version shown, and make withdrawal as easy as giving consent.

If your marketing stack uses Google tags, Google Consent Mode lets tags adjust to the visitor's choice.

Want to see where consent is being lost on your Canadian traffic? Book a 30-minute call with our team.

It can. The test is a real and substantial connection to Canada, applied in A.T. v. Globe24h.com, 2017 FC 114, where the Federal Court took jurisdiction over a Romanian operator because its audience and impact were in Canada. If you target Canadian visitors and track them commercially, assume PIPEDA applies.

No provision says so by name, because PIPEDA has no equivalent of the ePrivacy Directive's article 5(3). The OPC accepts opt-out consent for behavioural advertising only under six cumulative conditions. For sensitive data or unexpected uses, it expects opt-in. A banner is the practical way to meet either standard.

Not under PIPEDA. The OPC has no power to issue orders or administrative fines. It investigates, reports and can take a case to the Federal Court. The money penalties that exist are criminal fines under section 28, up to CAD 10,000 or CAD 100,000, and a court imposes them.

Thirty days from receipt under section 8(3). Section 8(4) allows an extension of up to 30 more days in specific cases, but the notice must go out within the original 30 days. Under section 8(5), silence counts as a refusal, which opens the door to a complaint to the OPC.

Less than you would think, but it is not automatic. The GDPR lets you rely on several legal bases, while PIPEDA centres on consent plus the appropriate-purposes test in section 5(3). Check your notice wording, opt-out conditions, breach record-keeping and the Quebec layer. Our comparison of GDPR, LGPD and CCPA shows where laws diverge.

• PIPEDA cookies policy, with what the document must contain
• PIPEDA DSAR privacy portal, with the full request workflow