The Office of the Privacy Commissioner of Canada (OPC) enforces PIPEDA by investigating complaints and publishing findings, but it cannot fine organisations or issue binding orders on its own. Its findings become enforceable in two ways: through a compliance agreement the organisation signs, or through the Federal Court, which can order changes and award damages. Criminal fines of up to CAD 100,000 exist only for a short list of offences.
That makes the OPC closer to an ombudsman than to a European data protection authority. Division 2 of PIPEDA (sections 11 to 17.2) sets out the process, and for a website collecting personal information from Canadians through cookies, analytics or account sign-ups, knowing how it works matters more than the fine amounts.
How the OPC complaint process works
Enforcement is mainly complaint-driven. Under section 11(1) of PIPEDA, an individual can file a written complaint against an organisation for breaking Division 1 or 1.1 or for not following a recommendation in Schedule 1. Under section 11(2), the Commissioner can start a complaint when satisfied there are reasonable grounds to investigate. The OPC did so on 15 January 2026 against X Corp. and xAI over sexualised deepfakes generated by the Grok chatbot.
A complaint that results from a refused access request must be filed within six months of the refusal, or a longer period the Commissioner allows.
Not every complaint leads to a full investigation. The OPC tries early resolution first, an informal process that settles the issue without formal findings. According to the OPC's 2024-2025 annual report, the office received 1,458 PIPEDA complaints, accepted 446 and closed 331 through early resolution, while organisations filed 686 breach reports affecting about 20 million Canadian accounts.
Investigation powers under section 12.1
When early resolution fails or the complaint is serious, the OPC investigates formally. Section 12.1 gives the Commissioner powers like those of a superior court of record: summoning witnesses and taking evidence under oath, entering business premises other than dwellings at reasonable times, examining and copying records, and interviewing staff in private.
Mediation or conciliation can be tried at any stage. The OPC may decline to investigate under section 12, for example when another grievance procedure should be used first, and may discontinue an investigation under section 12.2, for instance for lack of evidence, a trivial or vexatious complaint, or a fair response already given by the organisation.
The PIPEDA enforcement path
A report with no binding force
Within one year of a complaint being filed or started, the Commissioner must prepare a report under section 13 with the findings and recommendations, any settlement reached, where appropriate a request that the organisation say what it will do, and the recourse available under section 14.
Those findings are not legally binding. The OPC cannot order an organisation to change its practices, pay compensation or pay a penalty. That is the core structural limit of PIPEDA enforcement, and the sharpest difference from the GDPR, where authorities issue binding decisions backed by administrative fines.
The OPC reports a complaint as well-founded, well-founded and resolved, not well-founded, or settled during the investigation. Some outcomes stay unresolved: in PIPEDA Findings #2025-002, Google did not de-list news articles as recommended, so the OPC recorded that part of the complaint as well-founded and unresolved.
Compliance agreements under section 17.1
Added by the Digital Privacy Act of 2015, compliance agreements sit between recommendations and court action. Under section 17.1, the Commissioner can enter into one when there are reasonable grounds to believe an organisation has committed, is about to commit or is likely to commit a contravention, and the agreement can contain any terms the Commissioner considers necessary.
While an agreement is in force, the Commissioner cannot apply to the Federal Court on the same matter, but the complainant can still go to court. If the organisation complies, the Commissioner confirms it in writing. If it does not, section 17.2 lets the Commissioner ask the Federal Court to enforce the agreement or to hear the matter.
Federal Court remedies
The Federal Court is the backstop. Under section 14, a complainant can apply for a hearing after receiving the Commissioner's report, or after being told the investigation was discontinued, within one year or a longer period the Court allows. The hearing is de novo: the Court decides the matter afresh rather than reviewing the OPC's findings.
| Remedy | Section | What the Court can do |
|---|---|---|
| Compliance order | 16(a) | Order the organisation to correct its practices to comply with Divisions 1 and 1.1 |
| Publication order | 16(b) | Order the organisation to publish a notice of the corrective action |
| Damages | 16(c) | Award damages to the complainant, including for humiliation |
| Summary hearing | 17(1) | Hear the application without delay and in a summary way unless inappropriate |
Under section 15, the Commissioner can also apply to the Court with the complainant's consent, appear on the complainant's behalf, or intervene with the Court's leave.
Damages in practice
PIPEDA damage awards have been modest. Nammo v. TransUnion of Canada (2010) awarded CAD 5,000 over inaccurate credit information, the first monetary award under the Act, and Chitraker v. Bell TV (2013) awarded CAD 21,000, including CAD 10,000 in exemplary damages, partly because the company did not cooperate. The Court in Chitraker held that financial loss is not required, and an organisation's conduct after the breach, whether it cooperates and puts things right, affects the amount. Class actions in provincial courts add another route for systemic problems.
Criminal offences under section 28
Section 28 makes it an offence to knowingly break the breach reporting, notification and record-keeping rules (sections 10.1 and 10.3), to destroy information an individual has asked for while they still need it for their recourse (section 8(8)), to retaliate against a whistleblower (section 27.1) or to obstruct the Commissioner during an investigation or audit.
| Prosecution | Maximum fine |
|---|---|
| Summary conviction | CAD 10,000 |
| Indictable offence | CAD 100,000 |
Prosecutions are rare and are brought by the Attorney General of Canada, not the OPC. The system relies much more on the complaint, investigation and court path.
What the OPC has found recently
As of October 2026, the OPC's list of investigations into businesses shows where its attention lies:
- 23andMe (#2025-001): a joint investigation with the UK Information Commissioner into the 2023 breach, examining safeguards against credential stuffing and the notification of the regulators and affected people.
- Google (#2025-002): de-listing of outdated news articles about a complainant, found well-founded and unresolved after Google declined.
- Loblaw (#2026-001, 5 March 2026): retention of former PC Optimum members' purchase histories, covered in PIPEDA retention limits.
- OpenAI (#2026-002, 6 May 2026): a joint investigation with the Quebec, BC and Alberta commissioners.
- X Corp. and xAI (#2026-004, 11 June 2026): Commissioner-initiated complaints over sexualised deepfakes generated by Grok, finding no valid consent.
Breaches remain the largest workload, and consent for tracking and advertising, AI and children's data feature throughout. The PIPEDA breach notification rules are where most organisations meet the OPC first.
PIPEDA and GDPR enforcement compared
| Feature | PIPEDA | GDPR |
|---|---|---|
| Regulator's decisions | Recommendations, not binding | Binding decisions and orders |
| Administrative fines | None | Up to EUR 20 million or 4% of worldwide turnover |
| Criminal fines | Up to CAD 100,000 for section 28 offences | Set by member states |
| Court needed for an enforceable order | Yes | No |
| Compliance agreements | Yes (section 17.1) | No formal equivalent |
| Individuals' claims | Federal Court after the OPC report | Directly in court for compensation (Article 82) |
Under the GDPR, an authority can investigate and fine without going to court. Under PIPEDA, everything from complaint to binding order needs either the organisation's cooperation or a Federal Court application, which is slower but gives organisations more chances to fix things first.
What website owners should do
Cookie consent and analytics tracking fall within the OPC's scope. Its guidance treats browsing data collected for behavioural advertising as personal information and says tracking people cannot control should not be used for that purpose. The detail is in PIPEDA cookie consent and PIPEDA consent requirements.
- Run a cookie scan to find every cookie and third-party script, and keep analytics and marketing cookies from running before meaningful consent where it is needed.
- Keep a documented complaints procedure: Principle 4.10 of Schedule 1 requires one.
- Record every breach of security safeguards, as section 10.3 requires (the breach regulations set a 24-month retention period), and report breaches with a real risk of significant harm.
- If an investigation reaches you, cooperate promptly. Organisations that delay or ignore recommendations tend to fare worse, from the tone of the findings to the damages a court awards.
Bill C-36 would change enforcement
Bill C-27 died in January 2025. Its successor, Bill C-36, introduced on 15 June 2026 and at second reading as of October 2026, would replace Part 1 of PIPEDA with the Protecting Privacy and Consumer Data Act. As introduced, it creates a Digital Safety and Data Protection Commission of Canada with administrative penalties of up to the greater of CAD 10 million or 3% of gross global revenue, fines for the most serious offences of up to CAD 25 million or 5%, and a private right of action. The reform guide follows the bill, and the privacy laws by region overview compares Canada with other countries.
Questions about PIPEDA enforcement
Can the OPC fine my business for violating PIPEDA?
No. The OPC can investigate, publish findings and enter into compliance agreements, but it cannot impose fines. Criminal fines of up to CAD 100,000 apply only to section 28 offences, such as knowingly failing to report a breach or obstructing an investigation, and are prosecuted by the Attorney General.
How long does a PIPEDA investigation take?
The Commissioner must prepare a report within one year of the complaint being filed or started. Complex cases can take longer: the Google de-listing case went to the Federal Court and the Federal Court of Appeal over jurisdiction before the OPC could decide it.
What happens if my organisation ignores the OPC's recommendations?
The complainant, or the Commissioner with the complainant's consent, can apply to the Federal Court for an order and damages. The Court hears the matter afresh, and ignoring recommendations tends to count against the organisation.
Does PIPEDA require consent for analytics cookies on Canadian visitors?
PIPEDA requires knowledge and consent for collecting personal information. The OPC treats browsing data collected for behavioural advertising and profiling as personal information, so analytics cookies that identify people or build profiles need meaningful consent, express where the use is sensitive or unexpected.
Can individuals sue my company directly under PIPEDA?
Only after the OPC process. A complainant must first receive the Commissioner's report, or notice that the investigation was discontinued, and then has one year to apply to the Federal Court.
What is a compliance agreement and is it enforceable?
A compliance agreement under section 17.1 is an arrangement between the OPC and an organisation, with terms aimed at bringing it into line with PIPEDA. While it is in force, the Commissioner cannot take the same matter to court, and if the organisation breaks it, the Commissioner can ask the Federal Court to enforce it.
Will PIPEDA be replaced soon?
Possibly. Bill C-36, introduced on 15 June 2026, would replace Part 1 of PIPEDA and add penalties of up to CAD 10 million or 3% of global revenue. As of October 2026 it is at second reading, and PIPEDA remains in force.
Know what your site collects before anyone complains
Most PIPEDA complaints start with something a person noticed. Kukie.io scans your site, sorts its cookies into categories, holds back the ones that need consent and stores each visitor's choice as a consent record.
