Open workspace

Guide · Canada's federal law

PIPEDA: Canada's privacy law for sites with ads

PIPEDA is the federal law that regulates how private companies use personal data in Canada. For behavior-based ads, the Privacy Commissioner accepts the opt-out model, but only with clear conditions. This guide explains when the law applies, what meaningful consent is and how to set up the site.

Audit my site nowRead the guide
  • ✓Based on the official guidance of the Privacy Commissioner of Canada
  • ✓Practical examples for online advertising
  • ✓Reads the site without changing anything
10fair information principles at the base of the law
3provinces with their own law considered similar: Alberta, British Columbia and Québec
2years of mandatory retention of breach records
2026year bill C-36, which reforms the law, reached the House of Commons

What it is

The federal law that covers data in the private sector

PIPEDA (the Personal Information Protection and Electronic Documents Act) is the Canadian federal privacy law for the private sector. It applies to organizations that collect, use or disclose personal information during commercial activities.

Personal information, for the law, is any information about an identifiable person. On a site, this includes form data and also identifiers used to track browsing and choose ads.

The law is enforced by the Privacy Commissioner of Canada (Office of the Privacy Commissioner, or OPC). It publishes the guidance on consent and behavioral advertising that publishers use as a reference.

Checklist

What you need to meet

What PIPEDA and the Privacy Commissioner's guidance require of a site with ads that receives visitors from Canada.

  1. Appoint someone responsible

    The company must name someone responsible for complying with the law's principles. Publish a contact for questions and requests.

    Example

    Privacy officer: John Smith. Contact: privacy@yoursite.com

  2. Explain the ads in an obvious way

    The OPC wants people to clearly understand what is collected, who it is shared with, what for and what the risks are. Google also requires the policy to say that third parties, such as Google, use cookies to show ads.

    Example

    We use our own cookies and our partners' cookies, such as Google's, to show ads based on your interests. You can opt out at any time.

  3. Easy, immediate and lasting opt-out

    An opt-out for ads is only accepted if it is easy, preferably before collection, and takes effect right away and on later visits. Data must be destroyed or de-identified as soon as possible.

    Example

    Fixed footer link: Ad choices

  4. Express yes for sensitive data

    Health, finances, ethnic origin, political opinions, genetic and biometric data, sex life and religion require express consent. Also ask for an explicit yes for uses outside what the person would expect.

  5. No tracking that cannot be refused

    If the person cannot refuse the technique, the OPC says it should not be used for ads. The examples cited are zombie cookies, supercookies and device fingerprinting.

  6. Protect children

    For those who cannot give meaningful consent, ask the parents or guardians, and the OPC considers that this generally applies to children under 13. As a best practice, avoid tracking children and sites directed at them.

  7. Access and withdrawal of consent

    People can find out which data the site has, see it and challenge it. They can also withdraw consent, and collection and use must stop.

  8. Report and record breaches

    A breach with a real risk of significant harm must be reported to the OPC and the affected people. Every breach must be recorded for two years.

In practice

Right and wrong

Official tools

Certified CMPs and official links

Google does not require a certified CMP or have its own message for Canada, so the links below show what Google asks of every publisher and what the regulator expects.

Who it applies to

When PIPEDA reaches your site

Canada has federal and provincial laws. Understanding which one applies avoids setting up the site wrong.

Commercial activity in Canada

Private companies that collect, use or disclose personal information in commercial activities across the country follow PIPEDA.

Provinces with their own law

Alberta, British Columbia and Québec have private-sector laws considered similar. Within those provinces, these laws usually apply in place of PIPEDA.

Data that crosses borders

When data passes from one province to another or leaves the country, PIPEDA still applies, including in these three provinces.

Federally regulated companies

Banks, airlines, telecommunications and broadcasters always follow PIPEDA, including for employee data.

Principles

The law's 10 principles, summarized for a site

PIPEDA's Schedule 1 has 10 fair information principles. Grouped together, they fit into six practical ideas.

Accountability

The company is responsible for the data it controls and must appoint someone to look after compliance.

Purposes and consent

Say what the data will be used for before or at the time of collection, and obtain appropriate consent.

Limit collection, use and retention

Collect only what is necessary, use it only for what was stated and do not keep it longer than needed.

Accuracy and safeguards

Keep the data correct and protected against unauthorized access.

Transparency

Make your practices easy to find and understand, such as in a clear privacy policy.

Access and challenge

The person can see their data, ask for correction and complain about how the company complies with the law.

Consent

Meaningful consent: express or implied

PIPEDA requires meaningful consent. This means the person must understand what they are accepting: which data, for what, who it is shared with and what risks exist.

The law accepts two types of consent. Express is an active yes, such as ticking a box. Implied, or opt-out, is accepted when the information is not very sensitive and the use is reasonably expected, as long as the person has an easy way to refuse.

The more sensitive the data, the stronger the consent. The OPC expects express consent for health and financial data, ethnic and racial origin, political opinions, genetic and biometric data, sex life, sexual orientation and religious beliefs.

Behavioral advertising also cannot be a condition for using the internet or the site. In other words, a visitor who refuses tracking keeps access to the content.

Behavioral advertising

The OPC's conditions for opt-out in ads

The guidance on online privacy and behavioral advertising, updated in December 2015, accepts opt-out only when all of these conditions are met.

Purpose in plain sight

Tracking for ads must be explained in an obvious way, and not hidden in the privacy policy. Banners and layered notices help.

Notice at the right time

The person is informed before or at the time of collection, including who the partners involved are.

Easy opt-out

Refusing must be simple, preferably before collection starts.

Immediate and lasting effect

The opt-out takes effect right away and keeps applying on future visits.

Only non-sensitive data

Collection is limited to non-sensitive information, whenever possible.

Quick disposal

The data is destroyed or de-identified as soon as possible.

Site obligations

What a site with ads needs to have for Canada

  1. Appoint someone responsibleDefine who looks after privacy and publish a contact for questions and requests.
  2. Explain the ads in plain languageIn the privacy policy and in a visible notice, say that the site uses cookies and partners for interest-based ads, and who those partners are.
  3. Offer an opt-out that worksA permanent link, such as Privacy choices or Ad preferences, that turns off tracking right away and remembers the choice.
  4. Do not track childrenThe OPC recommends avoiding tracking of children and of sites aimed at them, because meaningful consent is hard in that case.
  5. Handle access requestsThe person can ask to see their data and correct it. Have a clear path for that.
  6. Record and report breachesBreaches with a real risk of significant harm must be reported to the OPC and to the people affected. All breaches must be recorded for two years.

Enforcement

How the Commissioner acts

The OPC receives complaints, investigates, publishes findings and makes recommendations. Under PIPEDA, the path to force a company to comply with the law goes through the Federal Court, which can issue orders and award damages.

Some conduct is a crime. Knowingly failing to follow the rules on breach reporting and record-keeping can lead to fines. And a public OPC investigation, even without a fine, usually has a strong effect on a site's reputation.

On June 15, 2026, the government introduced in the House of Commons bill C-36, which creates the Consumer Privacy and Data Protection Act and amends PIPEDA. As of early November 2026, the bill was in second reading and had not been passed. In the meantime, PIPEDA continues to apply as it is.

Timeline

Dates that matter for those with Canadian visitors

From the ads guidance to the reform bill.

  1. December 2015

    Behavioral advertising guidance

    The OPC updates the conditions for accepting opt-out in interest-based ads.

  2. October 2018

    Breach guide

    The OPC publishes the guidance on breach reporting and record-keeping.

  3. September 22, 2022

    Québec begins Law 25

    The province starts the entry into force of its law in three phases. For Québec visitors, the rules are stricter.

  4. June 15, 2026

    Bill C-36

    The federal privacy reform bill is introduced in the House of Commons.

AdSense and Ad Manager

What changes for Google ads

Google's EU user consent policy applies to the EEA, the United Kingdom and Switzerland. Canada is not on that list, so Google does not require a certified CMP or the TCF message for Canadian traffic.

Even so, Google's publisher policies apply worldwide. The site's privacy policy must say that third parties may set and read cookies or use web beacons and IP addresses to serve ads. And content aimed at children cannot receive interest-based ads.

To comply with PIPEDA, the publisher usually combines three pieces: a visible notice about personalized ads, a permanent opt-out link and a CMP or setting that stops requesting personalized ads for those who refused. For Québec visitors, the setup must be stricter because of Law 25.

In practice

What is and is not allowed for Canadian visitors

Examples based on the OPC guidance on consent and advertising.

Allowed

  • Personalized ads with opt-out, when the notice is clear and the data is not sensitive
  • A layered notice that explains the ads on the very first visit
  • A permanent Privacy choices link in the footer
  • Non-personalized ads for those who refused
  • Stricter setup only for Québec visitors
  • Privacy policy that lists the ad partners

Not allowed

  • Explaining tracking only in the middle of the privacy policy
  • Opt-out that disappears on the next visit or turns off nothing
  • Using health or financial data for ads without express consent
  • Tracking visitors on pages made for children
  • Blocking content for those who refuse tracking
  • Thinking the European setup solves everything in Canada

In ConsentMode

What the audit checks for Canadian visitors

  • Opens the site as a Canadian visitor and shows in a screenshot whether there is a visible notice about personalized ads.
  • Looks for the opt-out link, clicks it and checks whether the ad tags change behavior.
  • Identifies the CMP and shows whether the message changes between Québec, the rest of Canada and Europe.
  • Reads the privacy policy and points out whether partners, cookies, the officer's contact and a way to access data are missing.
  • Flags content that looks aimed at children with personalized ads.
Run an auditSee everything that is checked

Frequently asked questions about PIPEDA

Do I need a cookie banner for Canada?

PIPEDA does not require a banner in the European format. It requires meaningful consent. For interest-based ads, the OPC accepts opt-out if the notice is obvious and the opt-out is easy, immediate and lasting. A layered notice is usually the simplest way to meet this.

What is the difference between PIPEDA and Law 25?

PIPEDA is federal and applies across the country. Law 25 is from Québec and is stricter, with high administrative fines and its own rules for tracking technologies. For Québec visitors, follow Law 25.

Can the OPC fine my site?

Under PIPEDA, the OPC investigates and recommends, and cases can go to the Federal Court. Some conduct, such as knowingly breaking the breach rules, is a crime and can lead to fines. Bill C-36, still in progress, proposes changing this model.

Does Google require a certified CMP for Canada?

No. The requirement of a certified CMP with TCF applies to the EEA, the United Kingdom and Switzerland. For Canada, Google's general policies and Canadian law apply.

My site is Brazilian. Does PIPEDA apply to me?

It may apply when the site has a real connection with the Canadian audience, such as content and ads aimed at Canada. This analysis is legal. In practice, offering a clear notice and opt-out to Canadian visitors is a simple setup.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Check what a Canadian visitor sees on your site

The audit tests the notice, opt-out, CMP and privacy policy, and delivers a fix plan.

Start the audit