← ALL REGULATIONS
PIPEDA and cookies: meaningful consent in Canada.
PIPEDA requires meaningful consent to collect personal information, including through cookies. The Privacy Commissioner accepts opt-out consent for online behavioural advertising under strict conditions, but sensitive information, and tracking in Quebec, need more.
PIPEDA at a glanceOpt-out allowed
- Applies to
- Private-sector organisations in commercial activity, except where a province has a substantially similar law
- Consent standard
- Meaningful consent, per the Privacy Commissioner’s 2018 guidelines
- Advertising cookies
- Opt-out accepted under conditions
- Enforced by
- Office of the Privacy Commissioner of Canada
- Penalties
- Fines up to C$100,000 for specific offences; the Commissioner cannot fine for most breaches
WHAT PIPEDA REQUIRES
What PIPEDA asks of a site that uses cookies.
THE RULEMeaningful consentPeople must be able to understand what is collected, why, and who it is shared with, in clear language, when they consent.
WITH KATLAKatla scans the site, classifies every cookie it finds and generates the cookie policy from that list, in 13 languages.
THE RULEOpt-out for online advertising, with conditionsThe Commissioner accepts opt-out consent for behavioural advertising only when people are told clearly, the opt-out is easy, immediate and persistent, and no sensitive information or children are involved.
WITH KATLAKatla’s US State Laws (CCPA) mode is an opt-out banner whose choice persists, and it honours Global Privacy Control. Its button wording is California’s, so check that it reads right for Canadian visitors.
THE RULEExpress consent for sensitive informationSensitive information, such as health or financial data, needs express consent.
WITH KATLAA site that handles sensitive information can run Katla in GDPR mode, where nothing non-essential is set before an opt-in.
THE RULEQuebec visitors need moreQuebec’s Law 25 requires tracking functions to stay off until the person activates them, so a Canada-wide setup has to meet Quebec’s rule.
WITH KATLAIf you serve Quebec, run Katla in GDPR mode. Auto mode treats Canadian timezones as opt-out.
PIPEDA questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Do I need a cookie banner in Canada?
- PIPEDA does not name cookies, but it requires meaningful consent for the personal information they collect. Opt-out can be enough for non-sensitive advertising cookies; Quebec requires tracking to stay off by default.
- What happened to Bill C-27?
- Bill C-27, which would have replaced PIPEDA with the Consumer Privacy Protection Act, died when Parliament was prorogued in January 2025. PIPEDA remains in force.
- Which provinces have their own law?
- Quebec, British Columbia and Alberta have private-sector privacy laws recognised as substantially similar, which apply instead of PIPEDA to most activity within those provinces.
- Can the Privacy Commissioner fine a business?
- For most breaches, no: the Commissioner investigates and can take a matter to the Federal Court. Fines of up to C$100,000 apply to specific offences, such as obstructing an investigation or failing to report a breach.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.