Canada's PIPEDA (Personal Information Protection and Electronic Documents Act) is not structured like the GDPR. Rather than laying out detailed rules in numbered articles, PIPEDA delegates much of the heavy lifting to Schedule 1: a set of 10 fair information principles originally drawn from the CSA Model Code for the Protection of Personal Information, developed in 1996. These principles form the legal backbone of how private-sector organisations in Canada must handle personal data.
The 10 principles, as numbered in Schedule 1 of PIPEDA (clauses 4.1 to 4.10):
- Accountability
- Identifying purposes
- Consent
- Limiting collection
- Limiting use, disclosure and retention
- Accuracy
- Safeguards
- Openness
- Individual access
- Challenging compliance
Encryption, user authentication, data portability and breach fines are not principles in their own right: encryption and authentication are examples of Principle 7's safeguards. For website owners, every cookie set, every analytics script loaded and every form submitted falls under these 10 principles.
Where the 10 principles come from
The fair information principles predate PIPEDA itself. A 45-member committee at the Canadian Standards Association developed them in 1996, drawing on internationally recognised data protection concepts. When Parliament enacted PIPEDA in 2000, it incorporated these principles as Schedule 1, giving them the force of law under section 5(1).
The Office of the Privacy Commissioner of Canada (OPC) treats these principles as binding obligations and publishes a plain-language summary of each one. High-profile investigations, including a joint inquiry with the UK's ICO into the 23andMe data breach (PIPEDA Findings #2025-001) and an investigation of Google's search engine (PIPEDA Findings #2025-002), show that these principles carry real enforcement weight.
Principles 1 to 3: who is responsible, why you collect and with what consent
Principle 1: Accountability
An organisation is responsible for personal information under its control and must designate someone accountable for compliance. For a website, this means someone, often called a Chief Privacy Officer or privacy lead, must own the privacy management programme.
Accountability extends beyond your own servers. If you use third-party processors (payment gateways, email platforms, cloud hosting), you remain responsible for how they handle data. Clause 4.1 of Schedule 1 requires comparable protection through contractual or other means, and the OPC expects organisations to advise individuals when their information may be processed in another jurisdiction.
Principle 2: Identifying purposes
You must identify the purposes for collecting personal information before or at the time of collection. On a website, this translates to clearly stating why you collect data: in your privacy policy, in your consent banner and at the point of collection itself.
Vague statements like "we collect data to improve our services" are insufficient. If you are collecting an email address to send a newsletter, say so. If _ga cookies are tracking page views for analytics, declare that specific purpose. The OPC found Home Depot in violation of PIPEDA (PIPEDA Findings #2023-001) for sharing customer emails and purchase data with Meta for advertising measurement without informing customers, a textbook failure of this principle.
Principle 3: Consent
This is the principle that most directly affects cookie banners and tracking scripts. Section 6.1 of PIPEDA states that consent is only valid if a reasonable person would understand the nature, purpose and consequences of the collection.
PIPEDA recognises two consent types: express (opt-in) and implied (opt-out). Sensitive data, such as health information, financial records and precise geolocation, requires express consent. For less sensitive data collected in ways that align with reasonable expectations, implied consent may suffice. The Federal Court of Appeal confirmed in 2024 that Facebook violated PIPEDA by failing to obtain meaningful consent when a third-party app collected user data for purposes most people would not expect.
For cookies specifically, the OPC's guidance on online behavioural advertising states that any collection or use of browsing activity must happen with the individual's knowledge and consent. Technologies that prevent users from opting out, such as zombie cookies, super cookies and device fingerprinting, should not be used for advertising if no viable control mechanism exists.
Consent and cookies: where PIPEDA differs from the GDPR
| Aspect | PIPEDA (Canada) | GDPR and ePrivacy (EU) |
|---|---|---|
| Consent model | Express or implied, depending on sensitivity | Prior opt-in for all non-essential cookies |
| Implied consent for analytics | Allowed if data is not sensitive and expectations are reasonable | Not permitted: opt-in required |
| Cookie banner required? | Not explicitly, but practically necessary to demonstrate consent | Yes, under the ePrivacy Directive |
| Withdrawal of consent | Must be possible at any time | Must be as easy as giving consent |
| Fines | None for breaching the principles. Up to CAD 100,000 only for section 28 offences | Up to EUR 20 million or 4% of global turnover |
Principles 4 to 7: how much you collect, how long you keep it and how safe it is
Principle 4: Limiting collection
Collect only what you need. Clause 4.4 states that collection must be limited to what is necessary for the identified purposes, using fair and lawful means.
On a practical level, your website should not be loading 30 tracking scripts if you only need basic analytics. A cookie scan often reveals third-party cookies the site owner did not know existed: remnants of old plugins, embedded widgets or advertising tags from previous campaigns.
Principle 5: Limiting use, disclosure and retention
Personal information must not be used or disclosed for purposes other than those for which it was collected, unless the individual consents or the law requires it. Data should only be retained as long as necessary.
This principle catches many website owners off guard. You collected email addresses for order confirmations, then added them to a marketing list without fresh consent. Or you kept analytics data indefinitely because "storage is cheap." Setting clear retention periods in your privacy policy and configuring your analytics platform to auto-delete data after a defined window directly addresses Clause 4.5 of Schedule 1.
Principle 6: Accuracy
Personal information must be as accurate, complete and up to date as necessary for the purposes for which it is used. For website operators, this matters when maintaining customer accounts, mailing lists or user profiles.
The OPC's 2025 investigation into Google's search engine explored whether accuracy obligations extend to third-party content. The Commissioner found they do not cover the underlying content of linked articles, but the case shows how broadly accuracy questions can arise.
Principle 7: Safeguards
Personal information must be protected by security safeguards appropriate to its sensitivity. Clause 4.7 covers physical, organisational and technological measures.
The 23andMe breach investigation (PIPEDA Findings #2025-001) found "numerous deficiencies": no default multi-factor authentication, insufficient login monitoring and delayed notification to affected individuals. For website owners, Principle 7 means HTTPS everywhere, secure cookie flags (Secure, HttpOnly, SameSite) and keeping third-party integrations patched.
Principles 8 to 10: openness, access and complaints
Principle 8: Openness
Your organisation must make its privacy policies and practices readily available. A privacy policy buried three clicks deep in a footer, written in dense legal language, does not meet the spirit of Clause 4.8.
Your consent mechanism should complement a clear, accessible privacy policy explaining what data you collect, why, who receives it and how long you keep it. The OPC recommends plain language and a format that avoids unexplained acronyms or ambiguous catchall clauses.
Openness and individual access are easy to mix up. Openness (Principle 8) is the right of anyone to know your policies and practices in general, without asking. Individual access (Principle 9) is a person's right to see the information you hold about them specifically, on request.
Principle 9: Individual access
Individuals have the right to know what personal information you hold about them, how it was obtained and who it has been disclosed to. They can challenge the accuracy of that information. Under PIPEDA, you must respond to access requests within 30 days.
Website owners often overlook that cookie data, analytics profiles and advertising identifiers constitute personal information under PIPEDA. If a Canadian visitor submits an access request, your answer may need to include browser fingerprints, IP-based geolocation records and behavioural profiles assembled through marketing pixels.
Principle 10: Challenging compliance
Individuals must be able to challenge your compliance with these principles. Your organisation needs complaint-handling procedures and must inform people about escalating concerns to the OPC.
Breaching a principle is not itself an offence, so there is no fine for it. Under section 28 of PIPEDA, fines of up to CAD 10,000 on summary conviction or CAD 100,000 on indictment apply only to specific offences, such as knowingly failing to report a breach of security safeguards, failing to keep breach records or obstructing the Commissioner. The OPC's main tools are published findings, compliance agreements and Federal Court applications, and the reputational damage from a published finding can be significant. The OPC names organisations publicly when it deems this to be in the public interest.
Bill C-36 would replace the federal regime, but PIPEDA still applies
PIPEDA was written in 2000 and has not received a comprehensive update since. The Canadian government tried to replace it with the Consumer Privacy Protection Act (CPPA) through Bill C-27, but the bill died on the Order Paper when Parliament was prorogued in January 2025. A snap federal election in April 2025 pushed reform further down the road.
As of October 2026, Bill C-36, which would enact the Protecting Privacy and Consumer Data Act, has been introduced and read a first time (15 June 2026) but not passed: it is at second reading in the House of Commons. Until a new law is in force, PIPEDA and its 10 fair information principles remain the federal standard.
Organisations operating in Quebec must also comply with Law 25, which is stricter. Quebec's regulator reads it as requiring technology that identifies, locates or profiles a person to stay off until the person turns it on, which in practice means opt-in consent for tracking cookies, and its administrative penalties reach CAD 10 million or 2% of worldwide turnover. The global compliance hub sets these Canadian rules beside other countries' cookie laws.
A practical checklist for website owners
Mapping the 10 principles to website operations: appoint someone accountable for privacy (1). Document collection purposes in your policy and banner (2). Obtain meaningful consent before non-essential cookies (3). Audit scripts and remove unnecessary trackers (4). Set and enforce retention periods (5). Keep records accurate (6). Secure your site with HTTPS and secure cookie flags (7). Publish a clear privacy policy (8). Handle access requests within 30 days (9). Provide a complaint mechanism referencing the OPC (10).
PIPEDA principles in short answers
Does PIPEDA require a cookie consent banner on my website?
PIPEDA does not explicitly mandate a banner, but it requires meaningful consent before collecting personal information. Because cookies collect data like IP addresses and browsing behaviour, a consent banner is the most practical way to meet this obligation.
Can I rely on implied consent for analytics cookies under PIPEDA?
Potentially, yes, if the data collected is not sensitive and the collection aligns with what a reasonable visitor would expect. You still need to be transparent about what you collect and provide an opt-out mechanism. The OPC guidance on online behavioural advertising outlines these conditions.
Can I be fined for breaching PIPEDA's fair information principles?
Not directly: breaching a principle is not an offence. Fines of up to CAD 100,000 apply only to section 28 offences, such as knowingly failing to report a breach of security safeguards or obstructing the Commissioner, and the Federal Court can award damages to individuals under section 16. Bill C-36 would introduce larger penalties, but it is not law as of October 2026.
Which PIPEDA principle gives people the right to know your policies and practices?
Openness, Principle 8. It requires you to make your privacy policies and practices readily available to anyone. Individual access, Principle 9, is different: it covers a person's request to see the information you hold about them.
Do the 10 fair information principles apply to my website if I am outside Canada?
PIPEDA applies to any private-sector organisation that collects, uses or discloses personal information of Canadians in the course of commercial activity. If your website targets Canadian visitors, sets cookies on their devices or processes their data for commercial purposes, the principles likely apply to you.
How does PIPEDA's consent requirement differ from the GDPR?
The GDPR and the ePrivacy Directive require prior opt-in consent for all non-essential cookies. PIPEDA allows implied consent in some situations, particularly for less sensitive data where collection aligns with reasonable expectations. Express consent is still needed for sensitive personal information.
Is Bill C-36 replacing PIPEDA?
Not yet. Bill C-36, which would enact the Protecting Privacy and Consumer Data Act, was introduced on 15 June 2026 and, as of October 2026, is at second reading in the House of Commons. Until a replacement law is passed and in force, PIPEDA and its 10 fair information principles apply.
Map your site's cookies to the 10 principles
If your website collects data from Canadian visitors, the principles that bite first are purposes, consent and limiting collection. Kukie.io scans your site for cookies and third-party trackers, sorts them into categories and shows a consent banner that blocks the optional ones until visitors choose.
