Canada PIPEDA &
Quebec Law 25
Canada's federal PIPEDA requires meaningful consent for commercial data collection, and Quebec's Law 25 raises the bar to GDPR levels, with fines to match. Sites serving Canada increasingly need a real consent layer.
Trusted by 2,000+clients worldwide
PIPEDA at a glance
Federal law
PIPEDA is consent-based and enforced by the Privacy Commissioner of Canada.
Quebec Law 25
GDPR-style obligations phased in 2022 to 2024, including consent and privacy-by-default.
Fines up to
CAD 25 million or 4% of worldwide turnover under Law 25.Whichever is greater; Law 25 penal fines, administrative penalties are lower
Consent standard
"Meaningful consent": clear purposes, plain language, appropriate form, and express consent for sensitive uses.
This guide is general information for site owners, not legal advice. Check the current text of the law and your own counsel for your situation.
What the law requires on your website
Meaningful consent
Visitors must understand what they agree to: purposes in plain language, with express consent where data is sensitive or expectations are exceeded.
Quebec: consent & default privacy
Law 25 requires that technologies which identify, locate or profile stay off until the visitor activates them. Products with privacy settings must also default to the highest confidentiality, though that rule excludes browser cookies; for websites the operative duty is the one on identification, location and profiling.
Accountability
Documented policies and the ability to demonstrate compliance, including how consent was obtained.
How Clickio Consent helps
Serve visitors from Canada a consent flow configured for PIPEDA and Law 25: a localized dialog, granular purposes, equal-weight decline and stored records.
One tag, per-region rules
Clickio detects each visitor's location and serves the consent experience you configure for that region, this law included, without affecting any other market.
Multi-regulation →Localized dialogs
Language auto-detection and full text customization put the dialog in your visitors' language, with granular purpose choices and equal-weight decline.
Customization →Evidence on file
Every choice is stored as a consent record: the demonstrable-consent trail modern laws place on the controller.
Reporting →Frequently asked questions
Do I need a cookie banner for Canada?
For Quebec traffic under Law 25, effectively yes for profiling and tracking technologies. Federally, the OPC accepts opt-out consent for behavioural advertising when it is clearly explained and easy to refuse, and expects express consent where tracking is sensitive or beyond reasonable expectations.
What changed with Law 25?
Quebec moved to GDPR-grade rules: explicit consent duties, privacy by default, breach notification, and fines up to CAD 25M or 4% of turnover, enforced by the CAI.
Does the dialog need to be in French?
For Quebec, French-language service obligations and plain-language consent point strongly to French. Clickio auto-detects language and serves French to French-preferring visitors.
Does PIPEDA apply to foreign websites?
Canadian regulators assert jurisdiction where there is a real and substantial connection to Canada. Serving Canadian users commercially generally qualifies.
Can I treat Canada like GDPR?
A GDPR-grade consent flow is the usual way sites address the strictest Canadian requirements. Clickio lets you apply it to Canadian visitors (or just Quebec) without touching other regions.
Explore other regulations
Every guide shows how the same Clickio tag serves the right consent experience for that market. Pick the next one that applies to your audience.
Add this market to your consent setup. Start with a 14-day free trial; per-region settings and multi-language dialogs start on Starter.
Per-region settings (own texts, choices and fallback) and multi-language dialogs start on the Starter plan.