By country

Cookie Policy Generator Canada

PIPEDA federally, Quebec Law 25 provincially, and CASL - the strictest anti-spam regime in the world.

Generate your cookie policy Read the cookie policy guide

Canada has no dedicated cookie statute, so the obligation comes from PIPEDA’s meaningful-consent guidance plus CASL’s rules on installing software on a device. The result is a disclosure-heavy document with an express-consent requirement for anything a reasonable person would find unexpected.

Canadian privacy runs on PIPEDA federally, with Alberta, British Columbia and Quebec operating substantially similar provincial laws. PIPEDA is principles-based rather than prescriptive: ten fair information principles, a reasonableness standard, and an Office of the Privacy Commissioner that investigates complaints and publishes findings.

Quebec changed the calculus. Law 25 introduced privacy by default, mandatory privacy impact assessments for systems and cross-border transfers, a named person in charge of protection of personal information, data portability, and administrative monetary penalties that reach 4% of worldwide turnover.

The rule most likely to cost a Canadian business money, though, is not a privacy law at all. CASL requires express or narrowly-defined implied consent before any commercial electronic message, imposes strict formatting duties, and carries penalties up to $10 million per violation.

What a cookie policy in Canada has to cover

Each tracking technology, its purpose and its retention, in plain language
Which trackers rely on express consent and which on implied, with the OPC meaningful-consent factors in mind
CASL computer-program considerations for anything installed on the device
Opt-out mechanisms and what breaks if they are used
Quebec-specific disclosure, including profiling technologies which Law 25 requires to be notified with a means to deactivate

How Canada actually moves personal data

Cross-border storage in the US

PIPEDA permits it with accountability and transparency; Quebec requires a privacy impact assessment concluding the data will receive adequate protection before the transfer happens.

Commercial email and SMS

Every message needs consent, sender identification and a functioning unsubscribe honoured within ten business days. Implied consent from an existing business relationship expires - typically two years from the last purchase.

Cookies and installed software

CASL’s computer program provisions cover software installed on a device, and the OPC treats certain tracking as requiring meaningful consent even though there is no dedicated cookie statute.

Employee data in provincial jurisdictions

PIPEDA covers employee data only for federally regulated works; in Alberta, BC and Quebec, the provincial statutes cover it, which is why one national policy usually needs a provincial annex.

Bilingual disclosure obligations

Quebec’s Charter of the French Language requires French, and in practice equal prominence, for consumer-facing documents including privacy notices.

Third parties the draft will ask you about

Stripe · Moneris · Interac · Canada Post · Shopify · Telus and Rogers · AWS ca-central-1 · Mailchimp · Salesforce

The rules that apply

PIPEDA

Ten principles covering accountability, identifying purposes, consent, limiting collection, use and retention, accuracy, safeguards, openness, individual access and challenging compliance.

Quebec Law 25

Privacy by default, PIAs for information system projects and for transfers outside Quebec, a designated privacy officer whose title and contact must be published, and data portability.

CASL

Consent, identification and unsubscribe rules for commercial electronic messages, plus rules on installing software on someone else’s device.

Provincial private-sector laws

Alberta PIPA and BC PIPA apply in place of PIPEDA for intra-provincial activity, with their own breach and access rules.

Mandatory breach reporting

Breaches posing a real risk of significant harm must be reported to the Privacy Commissioner and to affected individuals, with a record kept of every breach regardless of severity.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

Operationalising Canadian compliance

Name a privacy officer and publish the contact
PIPEDA requires accountability with a designated individual; Quebec requires publication of the title and contact details.
Audit your consent records against CASL
Every address needs an identifiable express consent or a live implied-consent basis with a date attached.
Run PIAs where Quebec requires them
System projects involving personal information, and any transfer of personal information outside Quebec.
Set up the breach register
All breaches are recorded; those posing a real risk of significant harm are reported to the OPC and to individuals.
Produce a French version for Quebec
Equal prominence, not a machine translation of a legal document.

Where this usually goes wrong

Treating CASL like CAN-SPAM

CAN-SPAM is opt-out; CASL is opt-in with narrow implied-consent categories that expire. A US-built email programme dropped into Canada is usually non-compliant on day one.

No Quebec privacy officer named

Law 25 requires the role, and requires the title and contact information to be published. The default holder is the most senior person unless the role is delegated in writing.

No privacy impact assessment before a cross-border transfer

Quebec requires the assessment before the transfer, not as documentation afterwards.

English-only notices for Quebec consumers

The Charter of the French Language applies to consumer documentation, and Law 25’s transparency requirement points the same way.

Assuming PIPEDA covers everything

Alberta, BC and Quebec displace it for intra-provincial activity, and health information has separate provincial statutes again.

Frequently asked questions

Does PIPEDA apply to my business?

It applies to organisations that collect, use or disclose personal information in the course of commercial activity, including foreign organisations with a real and substantial connection to Canada. Alberta, BC and Quebec laws displace it for activity wholly within those provinces.

What is Quebec Law 25?

A comprehensive modernisation of Quebec private-sector privacy law that added privacy by default, mandatory impact assessments, a designated privacy officer, portability rights and penalties reaching 4% of worldwide turnover.

Is CASL really stricter than CAN-SPAM?

Substantially. CASL requires consent before sending rather than an opt-out afterwards, regulates the installation of software on devices, and carries penalties up to $10 million per violation for organisations.

Do I need my policy in French?

For Quebec consumers, effectively yes. The Charter of the French Language applies to consumer-facing documents, and Law 25 transparency reinforces it.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.