As of October 2026, PIPEDA is still Canada's federal private-sector privacy law. Its replacement is on the table: Bill C-36, which would enact the Protecting Privacy and Consumer Data Act, was introduced in the House of Commons on 15 June 2026 and is at second reading. It is not law, and its provisions would come into force only on dates set by the government after royal assent.
Bill C-36 is the third attempt at the same reform. Bill C-27 and its Consumer Privacy Protection Act (CPPA) died in January 2025, and much of what C-27 proposed returns in the new bill, from binding enforcement to penalties measured in millions. For a website that collects data from Canadians, the direction has not changed: clearer consent, new rights for individuals and real financial consequences.
Why PIPEDA is being replaced
The Personal Information Protection and Electronic Documents Act (PIPEDA) was enacted in 2000 and governs how private-sector organisations collect, use and disclose personal information in commercial activities. It is built on ten fair information principles drawn from the CSA Model Code: accountability, identifying purposes, consent, limiting collection, limiting use, accuracy, safeguards, openness, individual access and challenging compliance. The principles still hold up. Enforcement is the weak point.
The Privacy Commissioner of Canada can investigate complaints, conduct audits and publish findings, but cannot issue binding orders or impose fines under PIPEDA. Fines exist only for a short list of offences in section 28, such as breaking the breach reporting rules or obstructing an investigation, and top out at CAD 100,000. A consent failure carries no fine at all. Compare that with the GDPR's ceiling of 4% of worldwide annual turnover.
PIPEDA also lacks rights that are standard elsewhere: there is no explicit right to have your data deleted, no right to data portability and no specific right concerning automated decisions.
What Bill C-36 proposes
The text of Bill C-36 as introduced repeals Part 1 of PIPEDA, which becomes the Electronic Documents Act, and puts the privacy rules in a new statute. The main changes for organisations:
- Consent. Consent must be express unless implied consent is appropriate given the person's reasonable expectations and the sensitivity of the information. Consent obtained by false or misleading information or deceptive practices is invalid, and consent cannot be a condition of a product or service beyond what the service needs.
- Legitimate interest. Organisations can process personal information without consent for an activity in which they have a legitimate interest that outweighs the foreseeable adverse effects, if a reasonable person would expect it and the purpose is not to influence the person's behaviour or decisions. They must first describe the interest, carry out a privacy impact assessment and keep a record.
- Children. A child is anyone under 18, and a child's personal information is named among the examples of sensitive information.
- Rights. Individuals can ask for their information to be disposed of, meaning deleted or anonymised, and can have it moved to another organisation under a data mobility framework. Access requests get an answer within 30 days.
- Enforcement. A new Digital Safety and Data Protection Commission of Canada, with a Privacy and Consumer Data Commissioner, takes over. Administrative penalties reach the greater of CAD 10 million or 3% of gross global revenue (section 114), and fines for the most serious offences the greater of CAD 25 million or 5% (section 145).
- Private right of action. Individuals affected by a contravention can sue for damages once a finding is final, or after a conviction.
| Topic | Bill C-27 (died January 2025) | Bill C-36 (introduced June 2026) |
|---|---|---|
| New privacy statute | Consumer Privacy Protection Act | Protecting Privacy and Consumer Data Act |
| Artificial intelligence | Bundled in the same bill (AIDA) | Not part of the bill |
| Who enforces | Privacy Commissioner plus a new tribunal | Digital Safety and Data Protection Commission of Canada |
| Administrative penalties | Up to CAD 10 million or 3% | Up to CAD 10 million or 3% (section 114) |
| Offence fines | Up to CAD 25 million or 5% | Up to CAD 25 million or 5% (section 145) |
| Children's information | Sensitive | Sensitive, child means under 18 |
| Private right of action | Yes | Yes (section 132) |
Canada's federal privacy reform so far
Why Bill C-27 failed
Bill C-27, the Digital Charter Implementation Act, 2022, was introduced on 16 June 2022. It bundled the CPPA, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act (AIDA). It passed second reading on 24 April 2023 and was still in committee when the parliamentary session ended on 6 January 2025, which killed it.
Bundling privacy with AI regulation is the most commonly cited reason. AIDA was criticised for leaving the definition of a "high-impact system" to later regulations, which made the bill's real effect hard to judge, and the proposed tribunal drew objections as an extra layer between people and their rights. Bill C-36 answers both: it deals with privacy only, and it replaces the tribunal with a single commission. The 45th Parliament, which opened on 26 May 2025, is the one now considering it.
Quebec's Law 25 is already in force
While Ottawa deliberated, Quebec acted. Quebec's Law 25, adopted in 2021, amended the province's private sector privacy act in stages through September 2024. It applies to organisations carrying on an enterprise in Quebec, wherever they are based.
According to the Commission d'accès à l'information (CAI), Quebec's privacy regulator, the law requires parental consent to collect information from a minor under 14 (unless the collection clearly benefits the minor), a privacy impact assessment before personal information is sent outside Quebec, and tracking technologies that identify, locate or profile people to be off until the person turns them on. The CAI can impose administrative penalties of up to CAD 10 million or 2% of worldwide turnover, and the act also provides for penal fines.
PIPEDA, Bill C-36, Law 25 and the GDPR side by side
The table compares the current federal law, the bill that would replace it, Quebec's law and the GDPR on the points that matter most for websites. The PIPEDA and GDPR comparison goes into more detail.
| Feature | PIPEDA (in force) | Bill C-36 (proposed) | Quebec Law 25 | GDPR |
|---|---|---|---|---|
| Status | Law since 2000 | At second reading, not law | In force, last phase September 2024 | Applies since 2018 |
| Deletion right | No explicit right | Disposal on request | Yes | Yes |
| Data portability | No | Data mobility framework | Yes | Yes |
| Binding orders by the regulator | No | Yes | Yes | Yes |
| Penalties | No fines for consent failures, up to CAD 100,000 for section 28 offences | Up to CAD 10M or 3% (administrative), CAD 25M or 5% (offences) | Up to CAD 10M or 2% (administrative), plus penal fines | Up to EUR 20M or 4% |
| Children | OPC guidance only | Under 18, sensitive information | Parental consent under 14 | Article 8 parental consent |
| Tracking cookies | Implied consent possible for non-sensitive uses | Express unless implied is appropriate | Off until the person turns them on | Prior opt-in under the ePrivacy Directive |
What PIPEDA says about cookies today
PIPEDA does not mention cookies. Its consent and transparency rules apply to any collection of personal information, which the Office of the Privacy Commissioner (OPC) reads as including IP addresses, device identifiers and browsing behaviour collected through cookies and similar technologies.
The OPC's guidance on online behavioural advertising accepts opt-out consent for non-sensitive tracking only when the purposes are obvious, people are told at or before collection, and the opt-out is easy, immediate and persistent. Sensitive information needs express consent, and tracking that people cannot decline, such as device fingerprinting, should not be used for behavioural advertising. The details are in PIPEDA cookie consent.
Bill C-36 would tighten this. Express consent becomes the default, implied consent needs a reason grounded in expectations and sensitivity, and consent obtained through deceptive practices is invalid, which reaches banners that steer visitors towards accepting.
How to prepare your website now
Bill C-36 may change before it passes, but its direction matches C-27, Quebec's law and the OPC's own guidance. Work that meets those standards now will not be wasted.
Audit your cookies and trackers
Run a cookie scan to find every cookie and tracker on your site, and record the purpose, duration and provider of each. Third-party scripts such as analytics tools, social media widgets and advertising pixels are where unexpected cookies come from.
Move towards express consent
Even under PIPEDA's current model, the OPC expects clear information and a real choice. Opt-in for analytics and marketing cookies is already required for Quebec visitors and would be the default under Bill C-36. A banner with clear categories, an equal way to refuse and no pre-selected options meets the direction of all three.
Document what you collect
Bill C-36 keeps the idea of a privacy management program. Record what personal information you collect, why, how long you keep it and who you share it with, and keep a log of consent choices.
Prepare for deletion and mobility requests
Make sure your systems can find a person's data, export it in a usable format and delete or anonymise it on request, and that you can answer an access request within 30 days.
Keep provincial and breach rules in view
If you have customers in Quebec, Law 25 applies to you today, and British Columbia and Alberta have their own private sector privacy acts. PIPEDA's breach notification rules also apply now: a breach that creates a real risk of significant harm must be reported to the Commissioner and to the people affected, and every breach must be recorded. Canada sits alongside other countries on the privacy laws by region overview.
The EU adequacy question
The European Commission's list of adequacy decisions still includes Canada for commercial organisations, so personal data can flow from the EU to Canadian businesses covered by PIPEDA without extra safeguards. Adequacy decisions are reviewed, and the strength of Canada's federal privacy law is part of that assessment, which is one more reason the outcome of Bill C-36 matters for businesses that rely on cross-border data transfers from Europe.
Questions about Canada's privacy reform
Has Bill C-27 been passed into law?
No. Bill C-27 died when the parliamentary session ended on 6 January 2025. The CPPA and AIDA were never enacted, and PIPEDA remains Canada's federal private-sector privacy law.
What is Bill C-36?
Bill C-36 would enact the Protecting Privacy and Consumer Data Act, repeal Part 1 of PIPEDA and create the Digital Safety and Data Protection Commission of Canada. It was introduced in the House of Commons on 15 June 2026.
When will Canada's new privacy law take effect?
Not yet. As of October 2026, Bill C-36 is at second reading in the House of Commons. If it passes both Houses and receives royal assent, its provisions come into force on dates set by order of the government.
Do I need cookie consent for Canadian visitors under PIPEDA?
PIPEDA requires meaningful consent for personal information collected through cookies. For non-sensitive uses, implied consent with clear notice and an immediate, persistent opt-out may be enough. Sensitive information needs express consent, and Quebec visitors need tracking off until they turn it on.
How does Quebec's Law 25 differ from PIPEDA?
Law 25 is stricter. Tracking technologies must be off by default, minors under 14 need parental consent, transfers outside Quebec need a privacy impact assessment, and the CAI can impose administrative penalties of up to CAD 10 million or 2% of worldwide turnover, while PIPEDA has no fines for consent failures.
What penalties would Bill C-36 introduce?
As introduced, administrative penalties of up to the greater of CAD 10 million or 3% of gross global revenue, and fines for the most serious offences of up to the greater of CAD 25 million or 5%.
Will the new Canadian privacy law apply to websites outside Canada?
PIPEDA already applies to organisations that collect personal information from people in Canada in the course of commercial activity, wherever they are based, and Bill C-36 is built on the same commercial-activity scope.
Get your consent records ready before Ottawa decides
Whatever form Bill C-36 takes, you will need to show what each visitor chose. Kukie.io blocks non-essential cookies until visitors choose, can show Quebec visitors an opt-in banner through region rules, and stores each choice as a consent record.
