Most Canadian websites need some form of cookie consent, but not always an opt-in banner. Canada has no cookie-specific law. The Personal Information Protection and Electronic Documents Act (PIPEDA) applies once cookies collect personal information, and it lets you rely on clear notice and an immediate opt-out for low-risk cookies while sensitive data, children and unexpected uses need express consent. Visitors from Quebec are different: the province's Law 25 keeps tracking technologies off until the visitor turns them on.
There is no Canadian equivalent of the EU's ePrivacy Directive spelling out when a website may set a cookie. PIPEDA, a principles-based privacy statute in force since 2000, does that job by applying its consent rules to whatever the cookies collect.
Cookies are personal information under PIPEDA
PIPEDA defines personal information as information about an identifiable individual. The Office of the Privacy Commissioner of Canada (OPC) treats information collected for online tracking and behavioural advertising as generally being personal information, so IP addresses, device identifiers, browsing history and the profiles built from them all fall within scope.
A session cookie that keeps a shopping cart alive might not identify anyone on its own. An analytics cookie such as _ga, which gives each browser a unique client ID and follows it across visits, almost certainly does, and so does an advertising cookie that builds a cross-site profile, such as _fbp from Meta or IDE from Google.
Once a cookie collects personal information, PIPEDA's Fair Information Principles apply, most importantly consent, identifying purposes and limiting collection.
PIPEDA allows implied consent for low-risk cookies
Under the GDPR and the ePrivacy Directive, no non-essential cookie may be set before the visitor actively agrees. PIPEDA works differently. Section 6.1 makes consent valid only if the people your site is aimed at would understand the nature, purpose and consequences of what they are agreeing to, but the form of consent can vary with the sensitivity of the information and the visitor's reasonable expectations.
| Consent type | When it applies | What it looks like on a website |
|---|---|---|
| Express (opt-in) | Sensitive information, a use outside the visitor's reasonable expectations, or a meaningful risk of significant harm | A banner that holds non-essential cookies back until the visitor agrees |
| Implied (opt-out) | Non-sensitive information, a clear purpose and a collection the visitor can reasonably expect | A visible notice explaining cookie use, with an easy opt-out that works at once |
The OPC's 2011 guidelines on privacy and online behavioural advertising accept opt-out consent for tracking only under conditions. The purposes must be made obvious, not buried in a privacy policy. Visitors must be told at or before the time of collection. They must be able to opt out easily, ideally at that same moment. The opt-out must take effect immediately and persist, and the information should stay non-sensitive and be destroyed or de-identified as soon as possible.
Persistence is the condition sites miss. If a visitor opts out and the cookie is back on the next visit, the opt-out has not done its job. The OPC adds that tracking a visitor cannot decline, such as device fingerprinting or "zombie" cookies, should not be used for behavioural advertising at all.
When Canadian websites need express consent
The OPC's guidelines for obtaining meaningful consent say organisations must generally get express consent when the information is sensitive, when the use is outside the person's reasonable expectations, or when it creates a meaningful residual risk of significant harm. Three situations come up on websites.
Sensitive information. Cookies that collect or infer health, financial or similar information need express consent. In PIPEDA Report of Findings #2014-001, the OPC looked at a complaint about Google AdSense ads for CPAP devices that followed a visitor around after he had searched for sleep apnea equipment, and treated that health-related browsing as sensitive.
Children. The behavioural advertising guidelines say it is difficult to get meaningful consent from children, so as a best practice organisations should avoid tracking children and tracking on websites aimed at children.
Unexpected uses. In PIPEDA Findings #2023-001 (26 January 2023), Home Depot of Canada sent the hashed email addresses and in-store purchase details of customers who asked for e-receipts to Meta's Offline Conversions tool to measure ad performance. The OPC found that customers would not have expected that, so express consent was needed and had not been obtained.
The courts have been here too. On 9 September 2024 the Federal Court of Appeal (2024 FCA 140) found that Facebook breached PIPEDA's meaningful consent requirement, reversing the Federal Court. The Supreme Court of Canada granted Facebook leave to appeal on 12 June 2025 and heard the appeal on 19 March 2026. As of October 2026, its decision is reserved.
Affiliate tracking follows the same test. A cookie set when a visitor follows an affiliate link records which partner sent them so the sale can be credited, which is low-sensitivity information. Whether notice and an opt-out are enough depends on whether visitors were told and whether the same data feeds advertising profiles beyond that one sale.
Which kind of consent a cookie needs in Canada
Quebec's Law 25 keeps tracking off by default
Quebec has its own private sector privacy law, amended by Quebec's Law 25, and its rule on tracking is stricter than PIPEDA's. Section 8.1 applies to any technology with functions that can identify, locate or profile the person. According to the Commission d'accès à l'information (CAI), Quebec's privacy regulator, you must tell visitors beforehand that you use such a technology and how they can activate those functions, which means they cannot be on by default.
The rule has applied since September 2023, with the main body of Law 25's changes. The CAI can impose administrative monetary penalties of up to CAD 10 million or 2% of worldwide turnover, and the act also provides for penal fines.
For a website, Law 25 means analytics and advertising cookies stay off for Quebec visitors until they choose to turn them on. You can show Quebec visitors a different banner from the rest of Canada with geo-targeting, or apply the opt-in model to every Canadian visitor and run one consent flow.
CASL treats cookies as consented to by conduct
Canada's Anti-Spam Legislation (CASL) also regulates installing computer programs on someone else's device in the course of commercial activity, but for cookies it sets a low bar. Section 10(8) of CASL says a person is considered to expressly consent to the installation of a cookie, HTML code or JavaScript when their conduct makes it reasonable to believe they consent.
So for an ordinary website, CASL adds little on top of PIPEDA. A visitor who has blocked cookies in their browser is hard to describe as consenting, but the consent questions that matter for a banner come from PIPEDA and, for Quebec, Law 25.
PIPEDA and the GDPR compared for cookies
If you already follow the GDPR's cookie rules, PIPEDA asks for less in form but not necessarily less in substance.
| Requirement | GDPR and ePrivacy Directive | PIPEDA |
|---|---|---|
| Consent model | Opt-in for all non-essential cookies | Opt-out for non-sensitive, expected uses, opt-in otherwise |
| Pre-ticked boxes | Not valid consent | Not meaningful consent for uses that need express consent |
| Cookie walls | Generally not allowed | Consent should not be a condition of service beyond what is necessary |
| Withdrawing consent | Article 7(3) GDPR | Principle 4.3.8: at any time, subject to legal or contractual limits and reasonable notice |
| Who enforces | National authorities with fining powers | The OPC investigates and can apply to the Federal Court, which can order remedies and damages |
| Fines | Up to EUR 20 million or 4% of worldwide turnover | No fine for a consent failure, and up to CAD 100,000 only for the offences in section 28 |
The fine gap is real. Under section 28 of PIPEDA, fines of up to CAD 100,000 apply only to specific offences such as breaking the breach reporting and record-keeping rules or obstructing the Commissioner, not to cookie consent. The consequences of a consent failure are an OPC finding, published by name, and a possible Federal Court application. The detail of valid consent is covered in PIPEDA consent requirements.
What the 2024 deceptive design sweep found
In 2024 the OPC took part in the Global Privacy Enforcement Network's sweep of deceptive design. According to the OPC's announcement of 9 July 2024, 26 privacy authorities examined more than 1,000 websites and apps, including 145 reviewed by the OPC. Across the whole sweep, 97% used at least one deceptive design pattern, 57% made the least privacy-protective option the most obvious and easiest to choose, and 42% used emotionally charged language.
The OPC published no Canada-only percentages, but the direction is clear. Dark patterns in cookie banners, such as a large Accept button next to a hidden refusal, are what regulators are looking for.
Bill C-36 would replace PIPEDA's consent rules
Bill C-27 and its Consumer Privacy Protection Act died when Parliament was prorogued in January 2025. The next attempt is Bill C-36, which would enact the Protecting Privacy and Consumer Data Act. It was introduced in the House of Commons on 15 June 2026 and, as of October 2026, is at second reading. It is not law.
As introduced, the bill requires express consent unless implied consent is appropriate given the person's reasonable expectations and the sensitivity of the information, adds a legitimate interest exception that cannot be used to influence a person's behaviour or decisions, and sets administrative penalties of up to the greater of CAD 10 million or 3% of gross global revenue, with fines for offences of up to CAD 25 million or 5%. The reform guide tracks the bill in more detail.
Building a cookie banner for Canadian visitors
What you need depends on the cookies your site sets and where your visitors are:
- Only strictly necessary cookies (session, load balancing, security tokens): no banner is needed for them, but say what they do in your privacy policy.
- Analytics cookies (Google Analytics, Matomo with cookies, Hotjar): at minimum a visible notice and an easy opt-out that works at once under PIPEDA, and opt-in for visitors from Quebec.
- Advertising and cross-site tracking (
_fbp,IDE, retargeting pixels): express, opt-in consent is the safer reading of the OPC's guidance across Canada.
Whatever the model, the banner should appear before the cookies that depend on it are set, explain the categories in plain language, offer a real choice rather than "Accept all" with a small settings link, respect the choice on every visit, not make acceptance a condition of using the site, let visitors change their mind later, and keep a record of each choice to support the accountability principle. Canada's rules sit next to others on the privacy laws by region overview, and a cookie scanner gives you the list of cookies to start from.
Questions about cookie consent in Canada
Does PIPEDA require opt-in consent for all cookies?
No. PIPEDA allows implied, opt-out consent for non-sensitive information when the purpose is clear and the visitor can reasonably expect the collection. Express, opt-in consent is needed for sensitive information, children and uses visitors would not expect.
Can I rely on "continued browsing" as consent under Canadian law?
It is risky. The OPC expects visitors to be told about tracking purposes at or before collection and to have an easy opt-out that works immediately and persists. A banner that only says continuing to browse means accepting cookies does not meet that for tracking or advertising cookies, and it is never enough for Quebec visitors.
Do I need a separate cookie banner for Quebec visitors?
You need a different behaviour for them. Under section 8.1 of Quebec's private sector act, as amended by Law 25, technologies that identify, locate or profile a person must stay off until the person turns them on. Many sites apply the same opt-in model to every Canadian visitor instead of running two flows.
What is the maximum penalty for cookie consent failures in Canada?
PIPEDA has no fine for a consent failure: its fines of up to CAD 100,000 apply only to section 28 offences. In Quebec, the CAI can impose administrative penalties of up to CAD 10 million or 2% of worldwide turnover. Bill C-36, not yet law, would add federal penalties of up to CAD 10 million or 3%, and fines for offences of up to CAD 25 million or 5%.
Does Google Analytics require express consent under PIPEDA?
Not always under PIPEDA. Google Analytics sets cookies such as _ga that identify a browser across visits, and the OPC's guidance expects at least clear notice and an effective, immediate opt-out. For Quebec visitors, analytics must stay off until they turn it on.
How does CASL affect cookie consent separately from PIPEDA?
Very little. Section 10(8) of CASL considers a person to have expressly consented to cookies, HTML and JavaScript when their conduct makes it reasonable to believe they consent, so the consent rules that shape a banner come from PIPEDA and Quebec's Law 25.
Will the new federal privacy law change cookie consent requirements?
If passed as introduced, Bill C-36 would make express consent the default unless implied consent is appropriate given expectations and sensitivity, and would add penalties of up to CAD 10 million or 3% of global revenue. As of October 2026 it is at second reading in the House of Commons.
Show Quebec visitors a different banner from the rest of Canada
Kukie.io lets you set region rules per site, so visitors from Quebec get opt-in with tracking off until they choose, while the rest of Canada sees the model you pick. Every choice is stored as a consent record.
