What Is PIPEDA? A Plain-English Guide to Canada's Federal Privacy Law

PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada's federal privacy law for the private sector. It sets the rules for how businesses collect, use and disclose personal information in commercial activity, including through cookies on a website. It is built on ten fair information principles, it rests on meaningful consent, and it is enforced by the Office of the Privacy Commissioner of Canada (OPC).

As of October 2026, PIPEDA is still in force, but a replacement is before Parliament: Bill C-36, introduced on 15 June 2026, would move its privacy rules into a new Protecting Privacy and Consumer Data Act with fines of up to CAD 25 million or 5% of global revenue. Until a new law passes and takes effect, everything below applies.

PIPEDA at a glance

The law received Royal Assent in 2000, was fully in force by 2004 and has been amended several times since, most notably by the Digital Privacy Act of 2015, which introduced mandatory breach reporting. The full text of PIPEDA is on the Justice Laws website.

PIPEDA applies across Canada with one significant caveat. British Columbia, Alberta and Quebec have their own private-sector privacy laws that the federal government has declared "substantially similar". In those provinces, the provincial law takes precedence for activity inside the province. Once data crosses a provincial or national border, or the organisation works in a federally regulated sector such as banking, telecoms or aviation, PIPEDA applies again.

If your business collects data from Canadian visitors, PIPEDA is likely to apply to you even if you are based in the UK, the US or anywhere else. It is one of several privacy laws worldwide a site with international traffic has to account for.

The 10 fair information principles

PIPEDA is built on ten fair information principles set out in Schedule 1 of the Act. They are not optional guidance: they are the legal backbone of every obligation under the law.

Every cookie banner, privacy policy and data processing decision on your website should trace back to one or more of these principles.

Who PIPEDA applies to

PIPEDA applies to any private-sector organisation that collects, uses or discloses personal information in the course of commercial activity in Canada. That includes retailers, SaaS companies, online shops, marketing agencies and app developers. It also covers employee information in federally regulated industries such as banking, telecoms, airlines and interprovincial transport.

Foreign businesses are not exempt. If your website sets cookies on Canadian visitors' browsers, collects their email addresses or tracks their behaviour for advertising, PIPEDA's consent requirements apply wherever your servers sit.

Nonprofits and political parties are generally outside its scope unless they carry out commercial activity, such as selling merchandise or running paid events. Provincial health information laws, such as Ontario's PHIPA, cover healthcare providers separately.

Personal information is read broadly

PIPEDA defines personal information as any information about an identifiable individual. That goes well beyond names and email addresses. IP addresses, device identifiers, cookie IDs, browsing history, purchase records and location data can all qualify if they can be linked, alone or combined with other data, to a specific person.

The Federal Court has held that information is personal where there is a "serious possibility" that someone could be identified through it, alone or with other available information. That test matters for cookies and tracking technologies, which routinely collect data points that can be assembled into identifiable profiles.

Sensitivity is a spectrum. Medical records, financial data and information about sexual orientation are highly sensitive and generally need express consent. A language preference cookie sits at the other end. Where your data falls on that scale shapes the form of consent you need.

Consent under PIPEDA: express or implied

Consent is the centre of PIPEDA. Principle 4.3 requires an individual's knowledge and consent for the collection, use or disclosure of their personal information, with limited exceptions.

The law recognises two forms. Express consent (opt-in) is generally needed when the information is sensitive, when the use falls outside the person's reasonable expectations, or when it creates a meaningful residual risk of significant harm. Implied consent (opt-out) can be acceptable for less sensitive information where the purpose would be obvious to a reasonable person.

The test is "meaningful consent". The OPC's Guidelines for obtaining meaningful consent ask organisations to put four elements up front: what is collected, who it is shared with, for what purposes, and the risk of harm. Pre-ticked boxes, privacy policies nobody can find and vague phrases like "we may share data with partners" do not meet that bar.

The 2024 Facebook ruling on meaningful consent

In September 2024, the Federal Court of Appeal ruled in Privacy Commissioner of Canada v. Facebook, Inc. (2024 FCA 140) that Facebook, now Meta, breached PIPEDA when the data of more than 600,000 Canadian users reached a third-party app whose data was later passed to Cambridge Analytica, without meaningful consent.

The court judged meaningful consent by an objective "reasonable person" standard. Whether individual users actually read the terms of service did not matter: what mattered was whether a reasonable person would have understood the nature, purpose and consequences of the disclosure. Facebook's long and complex terms of service and data policy could not support that understanding.

Meta took the case further. The Supreme Court of Canada granted leave to appeal on 12 June 2025 and heard the appeal on 19 March 2026, and no judgment had been reported as of mid-October 2026. Until it rules, the Court of Appeal's reasonable-person test stands.

PIPEDA and cookies on your website

PIPEDA has no stand-alone cookie rule like the EU's ePrivacy Directive. Cookies fall under the same consent principles as any other collection of personal information. If a cookie collects data that can identify someone, and most analytics and advertising cookies do, the consent rules apply.

The OPC's guidelines on privacy and online behavioural advertising accept opt-out consent for behavioural advertising only under conditions: the purposes are obvious and explained at or before collection, the opt-out is easy, immediate and persistent, the data is limited to non-sensitive information and is destroyed or de-identified quickly. The same guidelines say tracking that cannot be declined, such as zombie cookies, super cookies and device fingerprinting, should not be used, and that tracking children should be avoided.

Which cookies need consent?

Strictly necessary cookies, such as a PHPSESSID session or a shopping cart cookie, generally need no consent because they deliver the service the visitor asked for. Everything else needs some form of consent.

Analytics cookies such as _ga from Google Analytics collect browsing behaviour that, combined with other identifiers, is personal information. Implied consent can be acceptable for basic, non-sensitive analytics if visitors are clearly told and have a real way to opt out.

Advertising and tracking cookies such as _fbp and IDE are where the line moves. Express consent is needed when the use involves sensitive data or children, or falls outside what visitors would reasonably expect. Otherwise opt-out can be acceptable, but only under the OPC's behavioural advertising conditions above. The guide to cookie consent under PIPEDA works through the cases.

The Home Depot investigation

In January 2023, the OPC published its findings on Home Depot of Canada's use of Meta's Offline Conversions tool (PIPEDA Findings #2023-001). Home Depot collected customer email addresses at checkout to send e-receipts. Those hashed addresses, with purchase details, were also sent to Meta for advertising measurement, without telling customers.

The OPC found that customers had no reason to expect their receipt data to go to a social media platform, that Home Depot's privacy statement was too vague to support meaningful consent, and that because the sharing fell outside reasonable expectations, implied consent was not enough: express consent was required.

Home Depot stopped the practice and accepted the OPC's recommendations, and the complaint was found well-founded and resolved. The lesson for websites is specific: sending customer data to an advertising platform for a purpose people would not expect needs clear, express consent.

Canada's anti-spam law treats cookies as consented

Canada's Anti-Spam Legislation (CASL) also regulates the installation of computer programs on someone's device, which is why it often comes up next to cookies. For cookies, its answer is short. Section 10(8) of CASL deems a person to have expressly consented to the installation of a cookie, HTML code or JavaScript where their conduct makes it reasonable to believe they consent.

So CASL does not require a separate cookie consent. Your cookie consent obligations come from PIPEDA and the provincial laws. CASL still matters for software you install on a visitor's device in other ways, and for commercial email.

Provincial laws: Quebec's Law 25 and beyond

If your website has visitors from Quebec, Quebec's Law 25 (formerly Bill 64) sets stricter rules. It came into force in stages between 2022 and 2024. It requires technology that can identify, locate or profile a person to be switched off by default, privacy impact assessments before personal information leaves Quebec, and a person in charge of protecting personal information. Administrative penalties reach CAD 10 million or 2% of worldwide turnover.

Alberta and British Columbia each have their own Personal Information Protection Act (PIPA), which replaces PIPEDA for activity inside those provinces.

The practical takeaway: if you serve visitors across Canada, set up consent for the strictest rules that apply. A setup that meets Quebec's Law 25 will generally meet PIPEDA and the other provincial laws too.

How PIPEDA is enforced

The OPC oversees PIPEDA, but its model differs from the GDPR's. The OPC cannot impose administrative fines. It investigates complaints from individuals or on its own initiative, issues findings and recommendations, and works with organisations on corrective measures.

In 2024-25, the OPC accepted 446 complaints under PIPEDA, closed 107 through standard investigations and 331 through early resolution, and received 686 breach reports affecting about 20 million Canadian accounts, according to its 2024-25 annual report. High-profile investigations include Home Depot's data sharing with Meta, Facebook and Cambridge Analytica, and the joint investigation with the UK's Information Commissioner into the 23andMe breach.

Penalties and consequences

PIPEDA's penalties are modest next to the GDPR's. Specific offences, such as failing to report a qualifying breach, failing to keep breach records or obstructing an OPC investigation, carry fines of up to CAD 100,000. The Attorney General of Canada prosecutes them, not the OPC.

Reputational and legal risks are larger. The OPC publishes findings when it considers it in the public interest. After the OPC reports, individuals can take a PIPEDA complaint to the Federal Court, which can award damages: in Chitraker v. Bell TV, the court awarded CAD 21,000, including exemplary damages, for a credit check run without consent. Class actions are also possible.

Mandatory breach reporting

Since November 2018, organisations subject to PIPEDA must report any breach of security safeguards that creates a "real risk of significant harm". Reports go to the OPC, affected individuals must be told as soon as feasible, and records of all breaches, reported or not, must be kept for at least 24 months.

Significant harm includes financial loss, identity theft, humiliation, damage to reputation or relationships, and more. The assessment weighs how sensitive the information is and how likely it is to be misused.

Knowingly failing to report a qualifying breach, or to keep breach records, is an offence with fines of up to CAD 100,000. The OPC updated its online breach report form for businesses in May 2024 and added a Privacy Breach Risk Self-Assessment Tool in March 2025.

PIPEDA compared with the GDPR

Many international websites have to meet both PIPEDA and the EU's General Data Protection Regulation (GDPR). The two share a consent-based approach but differ in important ways, covered in depth in PIPEDA vs GDPR: key differences.

The European Commission confirmed Canada's adequacy status in its January 2024 review, so personal data can flow from the EU to Canadian organisations without additional transfer mechanisms, as long as PIPEDA applies to the processing.

Bill C-36 is the next attempt to replace PIPEDA

The previous attempt, Bill C-27 and its Consumer Privacy Protection Act (CPPA), died on the order paper when Parliament was prorogued in January 2025. The government tried again on 15 June 2026 with Bill C-36, which as of October 2026 is at second reading in the House of Commons.

Bill C-36 would enact the Protecting Privacy and Consumer Data Act, repeal Part 1 of PIPEDA (renaming what remains the Electronic Documents Act) and create a Digital Safety and Data Protection Commission of Canada. The changes most relevant to websites:

• Consent must be express unless implied consent is appropriate given the person's reasonable expectations and the sensitivity of the information (section 15(5)).
• A legitimate interest exception allows some processing without consent, after a privacy impact assessment (section 18(3) and (4)).
• A child's personal information, meaning anyone under 18, counts as sensitive.
• Administrative penalties of up to the greater of CAD 10 million or 3% of gross global revenue, and offence fines of up to CAD 25 million or 5%.
• A right of action for damages once a finding or conviction is final, plus rights to disposal and data mobility.

The bill can still change in committee, and much of it would take effect only after regulations. The guide to Canada's privacy law reform follows its progress. Practices that meet PIPEDA's meaningful consent standard today, such as clear purposes, real choices and records of consent, carry over.

Setting up cookie consent for Canadian visitors

A structured approach works best. Start with an inventory: you cannot explain cookies you do not know about, and many sites find third-party cookies they never added on purpose.

1. Scan your whole domain and list every first-party and third-party cookie with its purpose, provider and expiry. Kukie.io's free scanner finds and categorises cookies for you.
2. Sort each cookie into a category: strictly necessary, functional, analytics or advertising. Only strictly necessary cookies should load before the visitor chooses.
3. Add a consent banner that blocks non-essential cookies until the visitor makes an active choice, and explain each category in plain language so a reasonable person understands it.
4. Show accept and reject options with equal weight. A large "Accept all" button next to a tiny link buried in the footer is a dark pattern.
5. Record every consent decision: who, when, to what, and which version of your cookie policy was shown. Kukie.io keeps these records in its Consent Log.
6. Let visitors change or withdraw consent at any time, for example through a persistent "Cookie settings" link.
7. Re-scan regularly. New marketing tags, analytics tools and embedded videos add cookies you did not plan for.

Short answers about PIPEDA

Give Canadian visitors a clear choice

Kukie.io shows visitors from Canada a banner with equal accept and reject options, holds non-essential cookies until they choose and records each decision, and you can set a stricter rule for Quebec.

Start free