By country

Refund Policy Generator Canada

PIPEDA federally, Quebec Law 25 provincially, and CASL - the strictest anti-spam regime in the world.

Generate your refund policy Read the refund policy guide

Canada has no national cooling-off right for online purchases, which puts the refund policy almost entirely in your hands - except in Quebec, where the Consumer Protection Act imposes rules that override whatever the policy says.

Canadian privacy runs on PIPEDA federally, with Alberta, British Columbia and Quebec operating substantially similar provincial laws. PIPEDA is principles-based rather than prescriptive: ten fair information principles, a reasonableness standard, and an Office of the Privacy Commissioner that investigates complaints and publishes findings.

Quebec changed the calculus. Law 25 introduced privacy by default, mandatory privacy impact assessments for systems and cross-border transfers, a named person in charge of protection of personal information, data portability, and administrative monetary penalties that reach 4% of worldwide turnover.

The rule most likely to cost a Canadian business money, though, is not a privacy law at all. CASL requires express or narrowly-defined implied consent before any commercial electronic message, imposes strict formatting duties, and carries penalties up to $10 million per violation.

What a refund policy in Canada has to cover

That there is no general federal cancellation right, so the stated policy is the entitlement
Quebec Consumer Protection Act requirements, which apply regardless of your terms
Provincial variations on cancellation and automatic renewal for the provinces you sell into
The return window, condition requirement and who pays return shipping
A French version of the policy for Quebec consumers

How Canada actually moves personal data

Cross-border storage in the US

PIPEDA permits it with accountability and transparency; Quebec requires a privacy impact assessment concluding the data will receive adequate protection before the transfer happens.

Commercial email and SMS

Every message needs consent, sender identification and a functioning unsubscribe honoured within ten business days. Implied consent from an existing business relationship expires - typically two years from the last purchase.

Cookies and installed software

CASL’s computer program provisions cover software installed on a device, and the OPC treats certain tracking as requiring meaningful consent even though there is no dedicated cookie statute.

Employee data in provincial jurisdictions

PIPEDA covers employee data only for federally regulated works; in Alberta, BC and Quebec, the provincial statutes cover it, which is why one national policy usually needs a provincial annex.

Bilingual disclosure obligations

Quebec’s Charter of the French Language requires French, and in practice equal prominence, for consumer-facing documents including privacy notices.

Third parties the draft will ask you about

Stripe · Moneris · Interac · Canada Post · Shopify · Telus and Rogers · AWS ca-central-1 · Mailchimp · Salesforce

The rules that apply

PIPEDA

Ten principles covering accountability, identifying purposes, consent, limiting collection, use and retention, accuracy, safeguards, openness, individual access and challenging compliance.

Quebec Law 25

Privacy by default, PIAs for information system projects and for transfers outside Quebec, a designated privacy officer whose title and contact must be published, and data portability.

CASL

Consent, identification and unsubscribe rules for commercial electronic messages, plus rules on installing software on someone else’s device.

Provincial private-sector laws

Alberta PIPA and BC PIPA apply in place of PIPEDA for intra-provincial activity, with their own breach and access rules.

Mandatory breach reporting

Breaches posing a real risk of significant harm must be reported to the Privacy Commissioner and to affected individuals, with a record kept of every breach regardless of severity.

What the generated refund policy contains

The statutory right, stated separately
Consumer cancellation rights exist whatever your policy says, so they are set out first and your goodwill terms second.
Time limits and how they are counted
When the clock starts, whether it runs in calendar or working days, and what stops it.
Condition and evidence requirements
What state goods must come back in, and what proof of purchase you accept.
Who pays return postage
Split between faulty and change-of-mind returns, because the law treats them differently.
Refund method and timing
Original payment method, and the deadline you commit to once goods or notice are received.
Exclusions, stated lawfully
Perishables, personalised goods, unsealed hygiene items and downloaded digital content - the exclusions the law actually permits.

Operationalising Canadian compliance

Name a privacy officer and publish the contact
PIPEDA requires accountability with a designated individual; Quebec requires publication of the title and contact details.
Audit your consent records against CASL
Every address needs an identifiable express consent or a live implied-consent basis with a date attached.
Run PIAs where Quebec requires them
System projects involving personal information, and any transfer of personal information outside Quebec.
Set up the breach register
All breaches are recorded; those posing a real risk of significant harm are reported to the OPC and to individuals.
Produce a French version for Quebec
Equal prominence, not a machine translation of a legal document.

Where this usually goes wrong

Treating CASL like CAN-SPAM

CAN-SPAM is opt-out; CASL is opt-in with narrow implied-consent categories that expire. A US-built email programme dropped into Canada is usually non-compliant on day one.

No Quebec privacy officer named

Law 25 requires the role, and requires the title and contact information to be published. The default holder is the most senior person unless the role is delegated in writing.

No privacy impact assessment before a cross-border transfer

Quebec requires the assessment before the transfer, not as documentation afterwards.

English-only notices for Quebec consumers

The Charter of the French Language applies to consumer documentation, and Law 25’s transparency requirement points the same way.

Assuming PIPEDA covers everything

Alberta, BC and Quebec displace it for intra-provincial activity, and health information has separate provincial statutes again.

Frequently asked questions

Does PIPEDA apply to my business?

It applies to organisations that collect, use or disclose personal information in the course of commercial activity, including foreign organisations with a real and substantial connection to Canada. Alberta, BC and Quebec laws displace it for activity wholly within those provinces.

What is Quebec Law 25?

A comprehensive modernisation of Quebec private-sector privacy law that added privacy by default, mandatory impact assessments, a designated privacy officer, portability rights and penalties reaching 4% of worldwide turnover.

Is CASL really stricter than CAN-SPAM?

Substantially. CASL requires consent before sending rather than an opt-out afterwards, regulates the installation of software on devices, and carries penalties up to $10 million per violation for organisations.

Do I need my policy in French?

For Quebec consumers, effectively yes. The Charter of the French Language applies to consumer-facing documents, and Law 25 transparency reinforces it.

Can I run a no-refunds policy?

Not against statutory rights. In the UK and EU a consumer’s cancellation and faulty-goods rights apply regardless of what your policy says, and advertising "no refunds" is itself treated as a misleading practice.

Do digital products have to be refundable?

The cancellation right can be waived for digital content, but only if the customer gave express consent to immediate delivery and acknowledged losing the right. That acknowledgement has to be captured at checkout, not assumed.

How long do I have to issue a refund?

In the UK and EU, within 14 days of receiving the goods back or of the customer proving they returned them. Card scheme rules and marketplace policies often impose something tighter.