Under PIPEDA, consent is valid only if the people your activity is aimed at would understand the nature, purpose and consequences of what they agree to. That is section 6.1 of the Act. Whether you need express (opt-in) or implied consent then depends on how sensitive the information is and whether the use is within their reasonable expectations, and section 7 lists the cases where no consent is needed at all.
For website owners, the practical questions follow from that test. When can you rely on implied consent for cookies and tracking? When do you need an explicit opt-in? The answers sit across clause 4.3 of Schedule 1, section 6.1 and section 7 of the Act, and the Office of the Privacy Commissioner of Canada's guidelines, and they depend on context.
What meaningful consent requires
PIPEDA's consent rule is the third fair information principle, clause 4.3 of Schedule 1: the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate. Section 6.1, added by the Digital Privacy Act in 2015, sets the test quoted above.
The Office of the Privacy Commissioner of Canada (OPC) issued its Guidelines for obtaining meaningful consent in 2018, jointly with the information and privacy commissioners of Alberta and British Columbia. They name four elements organisations should put up front:
| Key element | What it means in practice |
|---|---|
| What personal information is collected | Specific categories, not vague terms like "usage data" or "information about you" |
| Who it is shared with | Named third parties or meaningful categories, such as advertising networks |
| Why it is collected, used or disclosed | Specific purposes, not catch-all statements |
| Risks of harm and other consequences | Meaningful residual risks after mitigation, particularly where significant harm is possible |
Burying these points in a long privacy policy does not meet the standard. The guidelines expect key information where the decision is made: before a purchase, before an app download, in the banner itself.
Implied consent and express consent
PIPEDA recognises two forms of consent, and the difference decides how a cookie banner should behave in Canada.
Express consent needs a clear, affirmative action: ticking a box, selecting "I agree" or saying yes. Pre-ticked boxes do not qualify. The person must actively signal agreement after being told what they are agreeing to.
Implied consent can be inferred from someone's actions or their relationship with an organisation. A customer who gives an email address to complete an order can be taken to agree to order emails at that address.
The OPC's guidelines set a risk-based test. Express consent is generally required when:
- The information is sensitive, such as health or financial data
- The collection, use or disclosure is outside the person's reasonable expectations
- It creates a meaningful residual risk of significant harm
Implied consent can be acceptable where the information is less sensitive and the use matches what a reasonable person would expect. Building cross-site advertising profiles with _fbp without telling anyone is not that case.
The Facebook decision
In September 2024, the Federal Court of Appeal ruled in Canada (Privacy Commissioner) v Facebook, Inc. (2024 FCA 140) that Facebook failed to obtain meaningful consent between 2013 and 2015 when it disclosed user data to third-party app developers. The court judged consent from the point of view of a reasonable person, not the organisation's lawyers. Broad privacy policies that technically mentioned data sharing were not enough.
The court also found that contracts with third parties do not replace informing users properly. Meta appealed: the Supreme Court of Canada granted leave on 12 June 2025 and heard the appeal on 19 March 2026, and no judgment had been reported as of mid-October 2026.
Section 7 lists when consent is not required
PIPEDA is not a blanket consent law. Section 7 allows personal information to be collected, used or disclosed without the person's knowledge or consent in listed situations, because asking would be impractical or would defeat the purpose.
The exceptions most relevant to website operators:
| Exception | PIPEDA provision | Typical scenario |
|---|---|---|
| Publicly available information | Sections 7(1)(d), 7(2)(c.1), 7(3)(h.1) | Information specified by regulation, such as public registries or published directories |
| Fraud and contravention investigations | Sections 7(3)(d.1) and 7(3)(d.2) | Disclosure to another organisation to investigate a breach of contract or law, or to detect or prevent fraud |
| Legal compliance | Section 7(3)(c) | Responding to a subpoena, warrant or court order |
| Emergencies | Section 7(3)(e) | A threat to someone's life, health or security |
| Business transactions | Section 7.2 | Due diligence and completion of a merger or acquisition, with safeguards |
| Journalistic, artistic or literary purposes | Section 7(1)(c) | Collection solely for that work |
| Employment in federal works | Section 7.3 | Federally regulated employers managing the employment relationship, with notice |
Two points matter. The exceptions permit processing without consent but never require it. And every other PIPEDA duty still applies: limit what you collect, protect it, and keep to purposes a reasonable person would consider appropriate under section 5(3).
None of these exceptions covers analytics or advertising cookies. Section 7 is about investigations, emergencies, legal duties and similar cases, not about measuring or marketing to visitors.
How consent applies to cookies and tracking
PIPEDA does not mention cookies. Cookies, pixels and similar technologies that collect information about identifiable people still fall within its definition of personal information, particularly when they capture IP addresses, device identifiers or behaviour tied to one user.
The OPC's Guidelines on privacy and online behavioural advertising treat browsing activity collected for advertising as personal information that needs consent. They also accept opt-out consent for that advertising when strict conditions are met: people are told the purposes clearly at or before collection, the opt-out is easy, immediate and persistent, the information is non-sensitive, and it is destroyed or de-identified quickly. The form of consent therefore depends on the cookie's purpose and how sensitive the data is:
| Cookie type | Usual form of consent | Why |
|---|---|---|
Strictly necessary, such as a PHPSESSID session | None needed beyond notice | Delivers the service the visitor asked for |
| Functional or preference, such as a language choice | Implied | Low risk and within reasonable expectations |
Analytics, such as _ga | Implied with clear notice and an easy opt-out, or express | Non-sensitive measurement, with express consent where data goes to third parties for their own purposes or is unexpected |
Advertising and cross-site, such as _fbp or IDE | Express where sensitive data, children or unexpected uses are involved, otherwise opt-out under the OPC's conditions | Profiling and sharing with third parties |
Many sites choose opt-in for analytics anyway, because it works for Canada, Quebec and the EU at once. That is a design choice, not an OPC rule, as the guide to cookie consent under PIPEDA explains.
The OPC is firm on one point: tracking a visitor cannot decline, such as device fingerprinting, zombie cookies and super cookies, should not be used for advertising at all.
Canada's Anti-Spam Legislation (CASL) does not add a cookie consent of its own. Section 10(8) of CASL deems a person to have expressly consented to the installation of a cookie, HTML code or JavaScript where their conduct makes it reasonable to believe they agree. Your cookie consent obligations come from PIPEDA and the provincial laws.
Consent for children and teenagers
The OPC takes the position that children under 13 generally cannot give meaningful consent, so in all but exceptional cases a parent or guardian must consent for them. Teenagers can consent, but only through a process designed for their level of maturity.
The OPC's advertising guidelines recommend, as best practice, not tracking children and not tracking on websites aimed at children, because meaningful consent is hard to obtain from them. If many of your visitors are under 18, review your analytics and advertising cookies carefully.
Withdrawing consent
Clause 4.3.8 of Schedule 1 lets individuals withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Organisations must explain the consequences of withdrawing, but cannot use them to pressure people into staying.
For a website, that means visitors need a way to change their cookie choices after the first decision. A banner that appears once and cannot be reopened does not do it. A persistent link, often in the footer, lets visitors update their preferences at any time.
After a withdrawal, stop collecting data for that purpose, and delete what you hold where you can, unless the law or a contract requires you to keep it.
PIPEDA consent compared with the GDPR and the CCPA
PIPEDA sits between the EU's opt-in regime and the opt-out approach of US state privacy laws.
| Feature | PIPEDA | GDPR | CCPA |
|---|---|---|---|
| Default consent model | Depends on context (implied or express) | Opt-in for non-essential cookies | Opt-out of sale and sharing |
| Analytics cookies | Implied with notice and opt-out can be enough, express when unexpected or shared | Opt-in | No consent, but an opt-out where it counts as sharing |
| Advertising cookies | Express, or opt-out under the OPC's strict conditions | Opt-in | Right to opt out of sale and sharing |
| Processing without consent | Section 7 exceptions | Six lawful bases, including legitimate interests | Business purpose exemptions |
| Withdrawal | Required, with notice of the consequences | Must be as easy as giving consent | Opt-out can be used at any time |
The GDPR and the CCPA each have their own guides. If your website has visitors in several places, building to the strictest rule that applies keeps things simple. For sites with Canadian and EU traffic, that usually means an opt-in banner with category choices, which meets the GDPR's consent standard and PIPEDA's express consent cases together.
Bill C-36 would make express consent the default
Bill C-27, which would have replaced PIPEDA's privacy rules with the Consumer Privacy Protection Act, died on the order paper when Parliament was prorogued in January 2025, and the April 2025 federal election followed. On 15 June 2026 the government introduced Bill C-36, which would enact the Protecting Privacy and Consumer Data Act. As of October 2026 it is at second reading in the House of Commons.
For consent, the bill would change the starting point. Consent would have to be express unless implied consent is appropriate, given the person's reasonable expectations and the sensitivity of the information (section 15(5)). A new legitimate interest exception would allow some processing without consent after a privacy impact assessment (section 18(3) and (4)). A child's personal information, meaning anyone under 18, would count as sensitive. Administrative penalties could reach the greater of CAD 10 million or 3% of gross global revenue, and offence fines CAD 25 million or 5%, against CAD 100,000 under PIPEDA today. The guide to Canada's privacy law reform follows the bill.
Quebec already sets a stricter standard. Its Law 25, fully in force since September 2024, requires technology that can identify, locate or profile a person to be off by default, and its consent rules are closer to the GDPR's than PIPEDA's. Quebec's Law 25 applies alongside PIPEDA for visitors from Quebec.
Practical steps for valid consent in Canada
Getting consent right under PIPEDA is about showing that your visitors understood what they agreed to.
- Run a cookie scan to find every first-party and third-party cookie, then map each to a purpose and a recipient.
- Describe each cookie category in plain language, with the four key elements: what is collected, who receives it, why, and the risks.
- Give a real choice: "Accept" and "Reject" with equal weight, and category choices. Load no tracking scripts before the visitor responds.
- Use express consent for anything sensitive, anything aimed at children and anything visitors would not expect.
- Record every consent decision with a timestamp, the version of your notice and the categories accepted or declined, so you can show consent if the OPC asks.
- Keep a persistent way to change or withdraw consent.
Questions about PIPEDA consent
Does PIPEDA require a cookie consent banner?
PIPEDA does not name banners. It requires meaningful consent before collecting personal information, and analytics and advertising cookies often collect it, so a banner is the practical way to inform visitors and record their choice.
Can I rely on implied consent for Google Analytics cookies?
Sometimes. For non-sensitive, first-party measurement that visitors would expect, implied consent with clear notice and an easy opt-out can be enough. Where the data goes to a third party for its own purposes or the use is unexpected, express consent is needed, and many sites use opt-in so one banner works for Canada and the EU.
What is the difference between PIPEDA consent and GDPR consent?
The EU's ePrivacy rules require opt-in consent for all non-essential cookies, and the GDPR has six lawful bases. PIPEDA uses a sliding scale: implied consent can be enough for lower-risk uses, express consent is needed for sensitive data or unexpected purposes, and section 7 lists narrow exceptions.
Does CASL require consent for cookies?
No. Section 10(8) of CASL deems a person to have expressly consented to the installation of a cookie, HTML code or JavaScript when their conduct shows they agree. Cookie consent obligations come from PIPEDA and the provincial privacy laws.
Can a visitor withdraw consent after accepting cookies?
Yes. Clause 4.3.8 of Schedule 1 lets individuals withdraw consent at any time, subject to legal or contractual limits and reasonable notice. Give visitors a persistent way to change their choice, then stop collecting for that purpose.
Will Bill C-36 change Canada's consent rules?
If passed, yes. Bill C-36, introduced on 15 June 2026, would make express consent the default unless implied consent is appropriate, add a legitimate interest exception and treat children's information as sensitive. As of October 2026 it is at second reading, so PIPEDA still applies.
Give Canadian visitors a clear, informed choice
Kukie.io scans your site for cookies, sorts them into categories and shows visitors from Canada a banner with equal accept and reject options, with a stricter rule for Quebec if you set one. Every choice is recorded, so you can show what each visitor agreed to. It sits alongside the rules you set for other privacy laws worldwide.
