PIPEDA Compliance for Websites: A Practical Guide for Canadian Businesses

Short answer: if your business collects personal information through its website, such as names and emails from a contact form, customer details at checkout or analytics data tied to individual visitors, PIPEDA requires you to say what you collect and why, get meaningful consent, protect it, and let people access it and complain. On a website, that means an accurate privacy policy, honest forms, sensible handling of cookies and analytics, and good security. Since November 1, 2018, you must also report serious breaches.

PIPEDA has been in force for businesses since 2001, and the federal government has tried to replace it more than once. The latest attempt, Bill C-36, was introduced in June 2026 and has not passed. For now, PIPEDA is the law. Here is what it means for your site.

Who PIPEDA applies to

PIPEDA, the Personal Information Protection and Electronic Documents Act, applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activities across most of Canada. It also applies to federally regulated businesses such as banks, airlines and telecom companies everywhere in Canada.

Three provinces have private-sector privacy laws that the federal government has deemed substantially similar, so those laws apply instead of PIPEDA within the province:

• Quebec: the Act respecting the protection of personal information in the private sector, substantially updated by Law 25. See our guide to Quebec Law 25.
• Alberta: the Personal Information Protection Act.
• British Columbia: the Personal Information Protection Act.

Even in those provinces, PIPEDA still applies to personal information that crosses provincial or national borders in the course of commercial activity, and to federally regulated businesses. An Ontario business selling to customers across Canada is generally under PIPEDA, and may also have Quebec obligations for its Quebec customers.

The 10 PIPEDA principles, applied to a website

PIPEDA's core obligations are 10 fair information principles, taken from a national standard and set out in Schedule 1 of the Act. Here is what each one means for a business website:

1. Accountability. Designate someone responsible for privacy compliance, and make sure your web developer, host, form tools and analytics vendors protect data to a comparable standard, through contracts where needed.
2. Identifying purposes. Say why you collect each piece of information at or before the time you collect it. A contact form should say what you will do with the details.
3. Consent. Get meaningful consent for collection, use and disclosure. Express consent is expected for sensitive information or uses people would not reasonably expect.
4. Limiting collection. Collect only what you need. Every optional form field is a field you have to justify and protect.
5. Limiting use, disclosure and retention. Use information only for the purposes you stated, and delete it when you no longer need it. Old form submissions sitting in a CMS inbox for years are a liability.
6. Accuracy. Keep information accurate enough for its purpose. Customer accounts should let people update their details.
7. Safeguards. Protect information with security appropriate to its sensitivity: HTTPS everywhere, patched software, strong admin passwords, limited access and secure backups.
8. Openness. Make your privacy practices easy to find and understand. This is your privacy policy.
9. Individual access. Let people find out what you hold about them and get a copy, with a clear way to ask.
10. Challenging compliance. Provide a simple way to raise privacy concerns, and tell people about it.

Meaningful consent

Since 2015, PIPEDA has said consent is only valid if it is reasonable to expect that the people you are dealing with would understand the nature, purpose and consequences of what they are agreeing to. The Office of the Privacy Commissioner of Canada (OPC) published its Guidelines for obtaining meaningful consent in May 2018 and began applying them on January 1, 2019. The guidelines set out seven principles:

• Emphasize key elements: what is collected, who it is shared with, why, and any risk of harm.
• Allow people to control the level of detail they get and when, for example with layered privacy notices.
• Provide clear options to say yes or no, where the collection isn't essential to the service.
• Be innovative and creative in how you present information.
• Consider the consumer's perspective, and test whether people actually understand.
• Make consent a dynamic and ongoing process, not a one-time click.
• Be accountable and ready to demonstrate compliance.

For a website, the practical message is: do not bury the important parts in a long legal document. Say the key things at the point of collection, and give people a real choice about anything that is not needed to deliver what they asked for.

What your privacy policy should contain

PIPEDA's openness principle requires you to make information about your policies and practices available in a form that is generally understandable. At a minimum, that includes the name or title and address of the person accountable for privacy, how to access personal information, the types of personal information you hold and how you use it, and what you share with related organizations. For a typical business site, a useful privacy policy covers:

• Who you are and how to contact your privacy contact.
• What you collect through the site: forms, accounts, orders, cookies and analytics.
• Why you collect it and how you use it.
• Who you share it with, including service providers such as hosting, payment, email and analytics, and whether it is stored or processed outside Canada.
• How long you keep it.
• How you protect it.
• How people can access or correct their information, withdraw consent or make a complaint.
• How you handle cookies and tracking, and how to opt out.
• When the policy was last updated.

Cookies, analytics and advertising pixels

PIPEDA does not have a cookie-specific rule, and it does not require the opt-in banners European law does. But information collected through cookies and tracking can be personal information, and the consent principles apply to it.

The OPC's policy position on online behavioural advertising says opt-out consent can be reasonable for tracking-based advertising if people are clearly told about it at or before the time of collection, can easily opt out, the opt-out takes effect immediately and persists, and the information is not sensitive. Sensitive information, such as health or financial details, should not be used for targeting without express consent. If people have no viable way to decline the tracking, the OPC's view is that the technology should not be used for behavioural advertising.

In practice:

• Explain your analytics and advertising tools in your privacy policy, in plain language.
• Give visitors a working way to opt out, such as a cookie preferences link.
• Do not run advertising pixels on pages about health, finances or other sensitive topics without express consent.
• If you serve Quebec visitors, the stricter Law 25 off-by-default rule applies to them.

Many businesses serving customers across Canada simply apply the Quebec standard everywhere. One consent set-up is easier to maintain than two.

Breach reporting

Since November 1, 2018, organizations subject to PIPEDA must report to the OPC any breach of security safeguards involving personal information under their control if it is reasonable to believe the breach creates a real risk of significant harm to an individual. You must also notify affected individuals as soon as feasible, and notify other organizations or government institutions that could reduce the risk of harm. Significant harm includes things like financial loss, identity theft, humiliation and damage to reputation.

You must keep a record of every breach of security safeguards, whether or not it meets the reporting threshold, for 24 months. Knowingly failing to report or keep records is an offence, with fines of up to $100,000.

For websites, common breach sources are outdated CMS software or plugins, weak admin passwords, misconfigured storage and form submissions sent unencrypted. Regular website maintenance, with updates, backups and monitoring, is one of the cheapest safeguards you can buy.

What happened to Bill C-27, and what is Bill C-36?

Bill C-27 would have replaced PIPEDA's privacy rules with a new Consumer Privacy Protection Act and added an AI law. It died on the Order Paper when Parliament was prorogued in January 2025. On June 15, 2026, the federal government introduced Bill C-36, which would enact a new Protecting Privacy and Consumer Data Act and amend PIPEDA. As of mid-October 2026 it is at second reading in the House of Commons. It is not law, its content may change, and nothing in it applies to your business yet. If it passes, expect a transition period. A site that already follows PIPEDA's principles well will be in a good position.

PIPEDA website checklist

• A named privacy contact is listed in your privacy policy with a way to reach them.
• Your privacy policy is current, plain-language, and accurately lists what the site collects, including cookies and analytics.
• Every form states its purpose and collects only the fields you need.
• Optional uses, such as newsletters, have separate, unticked consent options (CASL also applies to marketing email).
• Analytics and advertising tools are disclosed, with a working opt-out.
• No advertising pixels on pages dealing with sensitive topics without express consent.
• Service providers that handle site data, and where they store it, are known and documented.
• Old form submissions and inactive accounts are deleted on a schedule.
• HTTPS on every page, current CMS and plugins, strong admin credentials and tested backups.
• There is a written process for responding to access requests and complaints.
• You have a breach response plan and a breach record log, kept for 24 months.

Not sure what your site actually collects? Our free website check shows the tracking scripts and cookies your pages load, which is the first step to describing them accurately.

This isn't legal advice

This guide summarizes PIPEDA and the OPC's published guidance as of October 2026. It is not legal advice. For questions about how privacy law applies to your business, or about Bill C-36 as it moves through Parliament, talk to a privacy lawyer. For the website side, privacy pages, consent set-up, forms and security, request a quote.