Website Tracking Compliance in Canada
What applies in this market
Canada: Quebec Law 25 and PIPEDA.
Law explainers for this market
Summary
Website tracking is legal in Canada. Federally, PIPEDA is more flexible, requiring express consent for sensitive information, unexpected uses, or a meaningful risk of significant harm. Quebec’s Law 25 is far stricter, and its regulator reads it as requiring tracking to be off until the visitor opts in. If any visitors are in Quebec, build to Law 25.
The practical rule for Canada is to build to Quebec. It is the strictest requirement in the country, so a site that satisfies Law 25 is almost always fine federally too.
The sections below explain the two layers of Canadian tracking law, what compliance requires in practice, and where enforcement comes from. The last section shows how to verify your Canadian setup.
The two layers of Canadian tracking law
PIPEDA (federal). The Personal Information Protection and Electronic Documents Act governs private-sector data handling across most of Canada. It requires meaningful consent and clear notice, and the federal privacy regulator says express consent is needed when information is sensitive, when a use is outside what people would reasonably expect, or when there’s a meaningful risk of significant harm. Otherwise implied consent may be enough. Enforcement is by the Office of the Privacy Commissioner of Canada.
Quebec Law 25 (provincial). The strictest rule in Canada. Section 8.1 requires telling visitors about technology that identifies, locates, or profiles them, and the CAI reads it as meaning that technology must be off by default, so profiling cookies and pixels should not run until the visitor opts in. Enforced by the Commission d’accès à l’information with severe penalties. Quebec Law 25, in full.
There is also CASL, Canada’s anti-spam law, which governs commercial electronic messages like marketing email. It is separate from cookie and tracking rules, but it is part of the Canadian picture for a marketing team.
What Canadian tracking compliance requires in practice
Build to the Quebec standard. Keep profiling cookies, pixels, and geolocation scripts off by default, and let visitors opt in with clear, free, informed consent for each specific purpose. That meets Law 25’s Section 8.1 as the CAI reads it, and comfortably meets PIPEDA’s meaningful-consent requirement at the same time. For visitors outside Quebec only, PIPEDA’s more flexible implied-consent approach may apply, but building to the stricter rule avoids maintaining two behaviors.
Where the enforcement comes from
Quebec’s CAI enforces Law 25, with administrative penalties up to CAD 10 million or 2 percent of worldwide turnover and penal fines up to CAD 25 million or 4 percent, plus a private right of action. The federal Office of the Privacy Commissioner oversees PIPEDA. For specific Canadian enforcement actions, see our Enforcement Watch tracker.
How to verify your Canadian setup
The Quebec default-off rule is the demanding part, and it is testable. DataTrue loads your site in a real browser and records what fires before the visitor makes any choice, so you can confirm no profiling cookie, pixel, or geolocation script runs on page load, and that these activate only after an opt-in. Sensitive Data Detection inspects the payloads with fictitious personas. Meeting and proving the Quebec standard covers Canada.
See how consent verification works
Questions
Is website tracking legal in Canada?
Yes, under two layers of law. PIPEDA sets a federal baseline that can allow implied consent when information is not sensitive and the use is within what people would reasonably expect. Quebec’s Law 25 is stricter, and its regulator reads it as requiring profiling technology to be off by default. If you have Quebec visitors, build to Law 25.
Do I need cookie consent in Canada?
For profiling and advertising cookies, yes, and in Quebec the regulator expects them to be off by default until the visitor opts in. PIPEDA may accept implied consent when information is not sensitive and the use is within what people would reasonably expect, but building to the Quebec standard is the safe approach if any visitors are in Quebec.
What is the difference between PIPEDA and Quebec Law 25?
PIPEDA is the more flexible federal law and can allow implied consent in lower-risk cases. Quebec Law 25 is stricter: consent must be clear, free, informed, and given for each specific purpose, and the regulator reads the law as requiring profiling technology to be off by default. Only Quebec has the default-off expectation.
How do I comply with tracking law across Canada?
Build to the Quebec standard: profiling cookies and pixels off by default, activated only after a clear opt-in. That satisfies Law 25 and meets PIPEDA at the same time, so you maintain one compliant behavior rather than two.
Related guides
See what your tags do in every consent state
DataTrue loads your real pages as a visitor who accepts, rejects, or sends an opt-out signal, and reads what each tag sends. A tag that ignores the visitor’s choice shows up in a test.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
