PIPEDA compliance for websites
Canada allows opt-out tracking, on conditions.
PIPEDA doesn’t demand a tick box before every cookie. The Privacy Commissioner allows opt-out consent for ad tracking, but only if people are told up front, the opt-out is easy, it takes effect immediately and sticks, and nothing sensitive is collected. ConsentBit covers all four.
Google-certified CMP · IAB Europe registered CMP (ID 502) · 9 languages · Webflow, Framer, WordPress and any website builder
First visit to your site
We value your privacy
We use necessary cookies to run this site. With your permission, we’d also like to measure traffic and show relevant ads.
Until they choose, only necessary cookies run. The floating icon reopens their settings any time.
The choice sits on the page, not buried in a policy.
Opt out once, and it holds for 30 days.
Canada’s federal privacy law, overseen by the OPC.
PIPEDA sets the rules for how private-sector organisations collect, use and disclose personal information in the course of commercial activity across Canada. The Office of the Privacy Commissioner (OPC) investigates. Alberta, British Columbia and Quebec have their own laws for activity inside those provinces.
Maximum fine
$100,000
for the offences in section 28, such as knowingly failing to report a breach or obstructing an investigation.
Built on 10 fair information principles, set out in Schedule 1 of the Act
Consent model
express consent for sensitive information, implied consent possible for the rest
Five things PIPEDA expects from your website
These come from the OPC’s guidelines on privacy and online behavioural advertising.
What OPC requires
Purposes made obvious, not buried in a privacy policy
How ConsentBit handles it
The banner states what is collected and why, on the page itself.
What OPC requires
People informed at or before collection, including who else is involved
How ConsentBit handles it
Each category names the kind of script it covers, before anything loads.
What OPC requires
An easy opt-out, ideally at or before collection
How ConsentBit handles it
Reject all sits beside Accept all, at the same size.
What OPC requires
An opt-out that takes effect immediately and is persistent
How ConsentBit handles it
The choice applies at once on every page, and is remembered for 30 days.
What OPC requires
Information limited to non-sensitive data
How ConsentBit handles it
Sensitive tracking belongs in a category the visitor has to switch on.
The OPC also says advertising tracking must never be a condition of using the internet generally, and that people must be able to decline it.
What a visitor sees, step by step
The choice is on screen, and it holds.
They land on your site
The banner explains what is collected and why, with the categories named.
They choose
Accept all, Reject all, or set each category in the preferences panel.
The choice takes effect
It applies immediately. Scripts the visitor refused do not run.
It stays that way
The choice is saved in the visitor’s browser and remembered for 30 days. After that, or if they clear cookies or switch browser, the banner asks again. A floating button lets them change it at any time.
WHAT CANADA ASKS FOR, AND WHAT IT DOESN’T
Opt-out is allowed, but it has to be earned.
This is where Canada differs from Europe. The OPC accepts implied, opt-out consent for online behavioural advertising, as long as a set of conditions is met. Miss them and you are back to needing express consent.
Three provinces run their own private-sector laws, so a business operating in Quebec, Alberta or British Columbia should check those as well.
Your choice, applied at once
This is the opt-out model. Set your banner to CCPA only to use it, on any plan. Here is what happens when a visitor opts out of advertising but leaves measurement on.
Immediate and persistent
The OPC asks that an opt-out take effect immediately and stay in effect. ConsentBit applies the choice on the spot, on every page, and remembers it for 30 days.
Sensitive data changes the rules
Opt-out consent only holds for non-sensitive information. In 2014 the OPC found that using sensitive health information to target ads went beyond what implied consent can cover.
Operating in Quebec as well? Law 25 requires everything off by default there. See what Law 25 requires →
Add a PIPEDA-ready banner to your site, free.
Records
A record of every choice, ready if the OPC asks
Every choice is recorded with when it was made and which categories the visitor accepted or rejected. You can export the log as a CSV file whenever you need it.
The visitor opted out, so advertising scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
If someone complains to the OPC, the question is what you told them and what they chose. The log answers the second half.
FAQ
Canadian privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
It applies to private-sector organisations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada. Alberta, British Columbia and Quebec have substantially similar laws that apply instead for activity inside those provinces, and federally regulated businesses are always covered.
PIPEDA doesn’t name cookie banners. It requires knowledge and consent, and the OPC says the purposes of ad tracking must be obvious rather than buried in a privacy policy. A banner is the normal way to make them obvious and to offer the opt-out.
Not always. The OPC accepts opt-out consent for online behavioural advertising when people are told at or before collection, the opt-out is easy to use, it takes effect immediately and stays in effect, and the information collected is not sensitive.
When the information is sensitive. The OPC lists health and financial data, ethnic and racial origin, political opinions, genetic and biometric data, sex life or sexual orientation, and religious or philosophical beliefs.
The OPC investigates complaints and publishes findings, and cases can go to the Federal Court, which can order damages. The Act also creates offences carrying fines of up to $10,000 on summary conviction and $100,000 on indictment, for things like knowingly failing to report a breach or obstructing an investigation.
Accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. They sit in Schedule 1 of the Act and apply to every organisation it covers.
GDPR requires consent before non-essential cookies are set. Canada allows opt-out consent for ad tracking when the OPC’s conditions are met, and reserves express consent for sensitive information. PIPEDA’s penalties are also far smaller, and enforcement runs through findings and the courts rather than administrative fines.
See what GDPR requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
Make the choice obvious, and make it stick
ConsentBit puts the choice on the page, applies it immediately, remembers it, and keeps the record.
This page is a general overview of PIPEDA, not legal advice. PIPEDA covers far more than website tracking, including access requests, safeguards and breach reporting, and Alberta, British Columbia and Quebec have their own private-sector privacy laws.