Personal Information Protection and Electronic Documents Act (Canada)
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal privacy law that governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activities. PIPEDA came into effect in 2001 and applies across Canada, with some exceptions for provinces that have substantially similar provincial privacy laws.
PIPEDA is built on 10 fair information principles and applies to most private-sector organizations that collect, use, or disclose personal information in the course of commercial activities. This includes the use of cookies and tracking technologies on websites.
PIPEDA applies to:
Some provinces have their own substantially similar privacy laws that apply instead of PIPEDA for activities within the province:
Important: Even in these provinces, PIPEDA applies to activities that cross provincial/national borders. If you operate a website accessible across Canada or internationally, PIPEDA likely applies.
PIPEDA does NOT apply to:
PIPEDA is based on 10 principles that form the foundation of Canadian privacy law:
Organizations are responsible for personal information under their control and must designate someone to be accountable for compliance. This person is typically called a Privacy Officer or Chief Privacy Officer.
Organizations must identify the purposes for which personal information is collected at or before the time of collection.
The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
For Cookies: The type of consent required depends on the sensitivity of the information collected and how it's used. Marketing cookies typically require express consent, while some functional cookies may rely on implied consent if properly disclosed.
The collection of personal information must be limited to what is necessary for the identified purposes. Information must be collected by fair and lawful means.
Personal information must not be used or disclosed for purposes other than those for which it was collected, except with consent or as required by law. Personal information must be retained only as long as necessary.
Personal information must be as accurate, complete, and up-to-date as necessary for the purposes for which it is used.
Personal information must be protected by security safeguards appropriate to the sensitivity of the information.
Organizations must make information about their policies and practices regarding personal information readily available to individuals.
Upon request, individuals must be informed of the existence, use, and disclosure of their personal information and be given access to that information. Individuals can challenge the accuracy and completeness of their information and have it amended as appropriate.
Individuals can challenge an organization's compliance with PIPEDA to the designated individual (Privacy Officer) and, if not satisfied, to the Privacy Commissioner of Canada.
PIPEDA doesn't have specific "cookie law" provisions like the EU's ePrivacy Directive, but cookies fall under PIPEDA's general consent requirements. The Office of the Privacy Commissioner of Canada (OPC) has provided guidance on online tracking and cookies.
According to OPC guidance:
Cookies essential for website functionality typically don't require consent because they're necessary for the service the user is requesting:
Cookies that enhance functionality but aren't strictly necessary may rely on implied consent IF:
Examples: language preferences, volume settings for video players, UI customization
Analytics cookies (Google Analytics, Adobe Analytics, etc.) typically require express consent because:
Marketing and advertising cookies always require express (opt-in) consent because:
CookieConfig is designed to help you meet PIPEDA's consent and transparency requirements:
Designate someone responsible for PIPEDA compliance and publish their contact information.
Identify all cookies and tracking technologies on your website. Classify them by category and sensitivity.
Place the CookieConfig script in your website's <head> section BEFORE any tracking scripts.
Set up your cookie categories in the CookieConfig dashboard:
Ensure your privacy policy complies with PIPEDA's Openness principle and includes:
Update the banner text to clearly explain your cookie usage. Consider offering both English and French versions if you operate nationally.
Create processes to handle requests from Canadian users to:
Ensure you have appropriate security measures:
Verify that:
Ensure your team understands PIPEDA requirements and your organization's privacy policies and procedures.
Periodically review your cookie usage, privacy policy, and consent mechanisms to ensure ongoing compliance.
The Office of the Privacy Commissioner of Canada (OPC) is responsible for overseeing and enforcing PIPEDA. The OPC has investigative powers and can issue findings and recommendations.
Under amendments that came into force in 2015 (PIPEDA Breach Notification Regulations):
The following can result in fines up to $100,000:
As of September 22, 2023, Quebec's Law 25 significantly strengthened privacy requirements in Quebec. If you do business in Quebec, be aware that Law 25:
Law 25 is more stringent than PIPEDA in many respects. If you operate in Quebec, consult with legal counsel about additional requirements.
Mistake: Assuming that providing a privacy policy is sufficient consent for analytics and advertising cookies.
Why It's Wrong: Behavioral tracking and targeted advertising are sensitive uses that require express, opt-in consent.
Solution: Require active consent (checkbox, button click) for analytics and marketing cookies. Don't rely on continued browsing as consent.
Mistake: Having a vague privacy policy that doesn't clearly explain cookie usage or having no privacy policy at all.
Why It's Wrong: Violates PIPEDA's Openness principle. Users must be informed about data practices.
Solution: Create a comprehensive privacy policy that clearly explains all cookie types, purposes, and third-party sharing in plain language.
Mistake: Blocking access to your website unless users accept all cookies.
Why It's Wrong: Makes consent conditional, which may not be considered meaningful consent under PIPEDA.
Solution: Provide access to basic content even if users reject non-essential cookies. Only require truly necessary cookies for core functionality.
Mistake: Not providing users with an easy way to withdraw cookie consent or change preferences after initial choice.
Why It's Wrong: PIPEDA requires that consent can be withdrawn at any time.
Solution: Provide a persistent link (in footer or as floating button) for users to access cookie preferences at any time.
Mistake: Using numerous tracking technologies that collect more data than necessary for stated purposes.
Why It's Wrong: Violates PIPEDA's Limiting Collection principle.
Solution: Regularly audit your cookies and remove unnecessary ones. Only use tracking technologies that serve specific, necessary purposes.
Mistake: Sharing cookie data with third parties (analytics providers, ad networks) without disclosing this in your privacy policy or obtaining consent.
Why It's Wrong: Violates PIPEDA's consent and disclosure requirements.
Solution: Clearly identify all third parties who receive data from cookies in your privacy policy, and obtain appropriate consent.
Mistake: Keeping cookie data indefinitely without a defined retention period.
Why It's Wrong: Violates PIPEDA's Limiting Use, Disclosure, and Retention principle.
Solution: Set appropriate expiration dates for cookies. Delete or anonymize data when it's no longer needed for the identified purpose.
Mistake: Not having documented privacy policies, procedures, or a designated Privacy Officer.
Why It's Wrong: Violates PIPEDA's Accountability principle.
Solution: Designate a Privacy Officer, document your privacy practices, train staff, and maintain compliance records.
CookieConfig is a tool to help implement cookie consent requirements under PIPEDA and other privacy regulations. However, it is not legal advice. Your specific compliance obligations depend on your business activities, the provinces you operate in, and the types of data you process. We strongly recommend consulting with legal counsel familiar with Canadian privacy law for your specific situation, especially if you operate in multiple provinces or in Quebec (which has additional requirements under Law 25).