Cookie consent in Canada
Consent and privacy law in Canada
PIPEDA federally since 2000, with Quebec's Law 25 phased in from 2022 to 2024
en, fr
Who must comply
Private-sector organizations that collect, use or disclose personal information in commercial activity in Canada.
Penalties
Quebec Law 25 fines up to 25 million Canadian dollars or 4 percent of worldwide turnover
Key obligations
- Obtain meaningful consent
- Limit collection to stated purposes
- Be transparent about practices
- Provide access to personal information
- Safeguard the data held
Local guidance
- Apply PIPEDA federally and Quebec Law 25 for Quebec residents
- Set privacy settings to the highest level by default in Quebec
- Provide notices in English and French
- Prepare for breach reporting and data portability under Law 25
How ConsentX helps
- Meaningful, plain-language consent
- Purpose-specific categories
- Access-request intake
- Evidence trail
We value your privacy
We ask for your consent before any non-essential cookie, with the rules that apply in your region.
This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.
How to comply with Canada using ConsentX
- 1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under Canada.
- 2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that Canada requires, automatically.
- 3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
- 4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a Canada audit.
- 5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.
Frequently asked questions
What is Quebec's Law 25?+
Law 25 modernised Quebec's private sector privacy rules between 2022 and 2024. It adds strict consent, mandatory breach reporting, privacy by default, and data portability, with penalties up to 25 million Canadian dollars or 4 percent of worldwide turnover.
Which law applies across Canada?+
PIPEDA applies federally to private sector organisations, enforced by the Office of the Privacy Commissioner. Quebec, Alberta, and British Columbia have their own substantially similar provincial laws.