# PIPEDA: cookie consent rules for Canada

> Canada's federal privacy law, PIPEDA, requires meaningful consent for collecting personal information in commercial activity, and cookie identifiers count as personal information. The form of consent depends on sensitivity: the Privacy Commissioner accepts opt-out consent for online behavioral advertising if visitors are clearly told, can opt out immediately and persistently, and no sensitive data or children are involved, while express opt-in is expected for anything sensitive. PIPEDA has no administrative fines, only offenses capped at C$100,000, which is why the government tabled a replacement, Bill C-36, in June 2026.

Source: https://cookiequiet.com/laws/pipeda
Published: 2026-10-20
Publisher: Cookiequiet

## Quick facts

- **Applies to:** Private sector organizations that collect, use or disclose personal information in the course of commercial activities, across Canada, except where a province has a substantially similar law (Quebec, Alberta, British Columbia) for intra-provincial activity
- **Consent model:** Meaningful consent (section 6.1 and Principle 4.3): express or implied depending on sensitivity and reasonable expectations; opt-out accepted for non-sensitive behavioral advertising under the OPC's guidelines
- **Cookie rule:** No cookie-specific provision; the OPC's guidelines on online behavioral advertising (2011) and on meaningful consent (2018) apply
- **Maximum fine:** C$100,000 per offense on indictment (section 28), limited to specific offenses such as obstructing an investigation or failing to report breaches; no administrative penalties
- **Authority:** Office of the Privacy Commissioner of Canada (OPC)
- **In force since:** 1 January 2001, fully since 1 January 2004; Digital Privacy Act amendments 2015 and 2018

## What is PIPEDA?

The Personal Information Protection and Electronic Documents Act is Canada's federal private sector privacy law. It has applied since 1 January 2001 and, to all commercial organizations, since 1 January 2004. Its substantive rules are the ten fair information principles of Schedule 1, taken from a Canadian standard: accountability, identifying purposes, consent, limiting collection, limiting use, accuracy, safeguards, openness, individual access and challenging compliance. The Digital Privacy Act of 2015 added section 6.1 on valid consent and the mandatory breach reporting that took effect on 1 November 2018. The Office of the Privacy Commissioner of Canada (OPC) investigates complaints, publishes findings and guidance, and can take cases to the Federal Court, but cannot fine.

## Who does PIPEDA apply to?

PIPEDA applies to every organization that collects, uses or discloses personal information in the course of commercial activities, and to federally regulated businesses for employee data. Where a province has a law declared substantially similar, that law applies instead to activity inside the province: Quebec's private sector Act (see [Quebec Law 25](/laws/quebec-law-25)), Alberta's and British Columbia's Personal Information Protection Acts. PIPEDA still applies to cross-border and inter-provincial flows. Foreign websites with a real and substantial connection to Canada, such as serving Canadian customers or tracking Canadian visitors, are within the OPC's reach, as several findings against US companies have shown.

## What does PIPEDA require for cookies and consent?

Personal information is any information about an identifiable individual. The OPC treats cookie identifiers, device identifiers and IP addresses as personal information when they can be linked to a person, which is the point of behavioral advertising.

Consent is governed by Principle 4.3 and section 6.1. Consent is only valid if it is reasonable to expect that the person understands the nature, purpose and consequences of the collection, use or disclosure. The form of consent varies with the sensitivity of the information and the reasonable expectations of the person: express consent for sensitive information, implied consent possible for less sensitive information. Clause 4.3.7 gives examples, including an opt-out checkbox that individuals can use to say no.

The OPC applied this to tracking in its guidelines on privacy and online behavioral advertising (December 2011). Behavioral advertising can be a reasonable purpose, and opt-out consent can be acceptable, provided that:

- individuals are told about the practice clearly and in an obvious way, at or before the time of collection, not buried in a policy;
- they can opt out at the moment the ads are shown or earlier, the opt-out takes effect immediately and is persistent;
- the information collected is limited to what is needed and destroyed or made non-identifiable as soon as possible;
- no sensitive information (health, finances, sexual orientation and the like) is used, and websites aimed at children do not track them, since meaningful consent from children is unlikely;
- tracking is not a condition of using the site.

The Guidelines for obtaining meaningful consent (May 2018, applied by the OPC since 1 January 2019) add the layered, plain-language approach: emphasize the key elements (what is collected, with whom it is shared, for what purposes, and the risk of harm), give people a real choice, and consider the user's perspective. Together the two documents mean that a Canadian site can run non-sensitive behavioral advertising on an opt-out basis, but needs prominent notice and an opt-out that works, and must switch to opt-in for sensitive or children's data.

## What must a compliant banner do?

- Tell visitors, in a visible notice on the first visit, that cookies and similar technologies are used for analytics and advertising and who receives the data.
- Offer an opt-out that is easy to reach, immediate and persistent, or an opt-in where the data is sensitive or the audience includes children.
- Link to a privacy policy that explains the purposes, the third parties and how to withdraw.
- Avoid making tracking a condition of access, and avoid confusing or misleading designs.

Most Canadian sites choose an opt-in banner with Accept and Reject, because it satisfies PIPEDA, Quebec Law 25 (which requires tracking off by default) and the EU rules at once.

## Enforcement and fines

The OPC investigates complaints and its own initiatives, publishes reports of findings and can seek Federal Court orders and damages. In the behavioral advertising area its findings have required companies to improve notice and opt-outs rather than pay penalties, because PIPEDA has none: section 28 makes it an offense, punishable by a fine of up to C$10,000 on summary conviction or C$100,000 on indictment, to obstruct the Commissioner, to retaliate against whistleblowers or to breach the breach-reporting and record-keeping duties, and nothing more.

That gap is why reform has been on the table for years. Bill C-27, the Digital Charter Implementation Act 2022, with its Consumer Privacy Protection Act and administrative penalties of up to C$10 million or 3% of global revenue, died when Parliament was prorogued on 6 January 2025. On 15 June 2026 the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act, which would replace Part 1 of PIPEDA with a new statute, keep consent at its center and create a new enforcement body with the power to impose significant monetary penalties. Until a bill passes, PIPEDA as described here is the law.

## How Cookiequiet handles PIPEDA

Canada is in Cookiequiet's regulated country list, so with geo-targeting on, Canadian visitors get the consent banner, which covers the opt-in expected in Quebec and the notice-and-choice PIPEDA requires elsewhere. Accept all and Reject all have the same weight, categories are off by default, the preferences center stays reachable to withdraw, and the English and French strings follow the browser language. Scripts and embeds are blocked until the visitor chooses, [Consent Mode v2](/consent-mode) keeps Google tags in their denied state, and the consent log records each choice. The privacy policy generator covers the main items the OPC expects (purposes, third parties, retention, rights) as a template, not legal advice; check [whether you need a banner at all](/guides/do-i-need-a-cookie-banner) for a Canada-only audience.

## Questions

### Does PIPEDA require a cookie banner?

It requires meaningful consent and clear notice. For non-sensitive behavioral advertising the OPC accepts opt-out consent with a prominent notice and an immediate, persistent opt-out; sensitive data and children require express consent. A banner is the simplest way to give that notice and choice, and it also covers Quebec's stricter Law 25.

### Is implied consent enough for Google Analytics in Canada?

Often yes for basic, non-sensitive analytics, if the use is explained in an obvious way and visitors can opt out. The more the tool profiles individuals or feeds advertising, the more the OPC's behavioral advertising conditions apply. Quebec's Law 25 requires profiling functions to be off by default regardless.

### What are the fines under PIPEDA?

PIPEDA has no administrative fines for privacy violations. Section 28 creates offenses, such as obstructing an investigation or failing to report breaches, punishable by up to C$10,000 on summary conviction or C$100,000 on indictment. Bill C-36, tabled in June 2026, would add real monetary penalties if passed.

### Does PIPEDA apply to websites outside Canada?

Yes, when the organization has a real and substantial connection to Canada, for example because it targets or tracks Canadian users. The OPC has investigated US-based companies on that basis. Provincial laws in Quebec, Alberta and British Columbia apply to activity within those provinces.

## Sources

- [Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), Justice Laws Website](https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html)
- [Office of the Privacy Commissioner of Canada, guidelines on privacy and online behavioral advertising (2011)](https://www.priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/tracking-and-ads/gl_ba_1112/)
- [Office of the Privacy Commissioner of Canada, Guidelines for obtaining meaningful consent (2018)](https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_omc_201805/)
- [Parliament of Canada, LEGISinfo: Bill C-36, Protecting Privacy and Consumer Data Act (first reading 15 June 2026)](https://www.parl.ca/legisinfo/en/bill/45-1/c-36)