By country

Terms & Conditions Generator Canada

PIPEDA federally, Quebec Law 25 provincially, and CASL - the strictest anti-spam regime in the world.

Generate your terms and conditions Read the terms and conditions guide

Canadian terms are read against provincial consumer protection statutes that vary meaningfully - Ontario, Quebec, Alberta and BC each impose their own rules on cancellation, automatic renewal and unfair practices - and Quebec adds language requirements to the mix.

Canadian privacy runs on PIPEDA federally, with Alberta, British Columbia and Quebec operating substantially similar provincial laws. PIPEDA is principles-based rather than prescriptive: ten fair information principles, a reasonableness standard, and an Office of the Privacy Commissioner that investigates complaints and publishes findings.

Quebec changed the calculus. Law 25 introduced privacy by default, mandatory privacy impact assessments for systems and cross-border transfers, a named person in charge of protection of personal information, data portability, and administrative monetary penalties that reach 4% of worldwide turnover.

The rule most likely to cost a Canadian business money, though, is not a privacy law at all. CASL requires express or narrowly-defined implied consent before any commercial electronic message, imposes strict formatting duties, and carries penalties up to $10 million per violation.

What a terms and conditions in Canada has to cover

Provincial consumer protection compliance for the provinces you sell into, not just a single national clause
Quebec Consumer Protection Act constraints, which limit several standard clauses including some liability exclusions
Automatic renewal and cancellation terms in the form provincial law requires
A French-language version for Quebec consumers, with equal prominence
Governing law drafted knowing that consumer protection statutes will apply regardless of the clause

How Canada actually moves personal data

Cross-border storage in the US

PIPEDA permits it with accountability and transparency; Quebec requires a privacy impact assessment concluding the data will receive adequate protection before the transfer happens.

Commercial email and SMS

Every message needs consent, sender identification and a functioning unsubscribe honoured within ten business days. Implied consent from an existing business relationship expires - typically two years from the last purchase.

Cookies and installed software

CASL’s computer program provisions cover software installed on a device, and the OPC treats certain tracking as requiring meaningful consent even though there is no dedicated cookie statute.

Employee data in provincial jurisdictions

PIPEDA covers employee data only for federally regulated works; in Alberta, BC and Quebec, the provincial statutes cover it, which is why one national policy usually needs a provincial annex.

Bilingual disclosure obligations

Quebec’s Charter of the French Language requires French, and in practice equal prominence, for consumer-facing documents including privacy notices.

Third parties the draft will ask you about

Stripe · Moneris · Interac · Canada Post · Shopify · Telus and Rogers · AWS ca-central-1 · Mailchimp · Salesforce

The rules that apply

PIPEDA

Ten principles covering accountability, identifying purposes, consent, limiting collection, use and retention, accuracy, safeguards, openness, individual access and challenging compliance.

Quebec Law 25

Privacy by default, PIAs for information system projects and for transfers outside Quebec, a designated privacy officer whose title and contact must be published, and data portability.

CASL

Consent, identification and unsubscribe rules for commercial electronic messages, plus rules on installing software on someone else’s device.

Provincial private-sector laws

Alberta PIPA and BC PIPA apply in place of PIPEDA for intra-provincial activity, with their own breach and access rules.

Mandatory breach reporting

Breaches posing a real risk of significant harm must be reported to the Privacy Commissioner and to affected individuals, with a record kept of every breach regardless of severity.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

Operationalising Canadian compliance

Name a privacy officer and publish the contact
PIPEDA requires accountability with a designated individual; Quebec requires publication of the title and contact details.
Audit your consent records against CASL
Every address needs an identifiable express consent or a live implied-consent basis with a date attached.
Run PIAs where Quebec requires them
System projects involving personal information, and any transfer of personal information outside Quebec.
Set up the breach register
All breaches are recorded; those posing a real risk of significant harm are reported to the OPC and to individuals.
Produce a French version for Quebec
Equal prominence, not a machine translation of a legal document.

Where this usually goes wrong

Treating CASL like CAN-SPAM

CAN-SPAM is opt-out; CASL is opt-in with narrow implied-consent categories that expire. A US-built email programme dropped into Canada is usually non-compliant on day one.

No Quebec privacy officer named

Law 25 requires the role, and requires the title and contact information to be published. The default holder is the most senior person unless the role is delegated in writing.

No privacy impact assessment before a cross-border transfer

Quebec requires the assessment before the transfer, not as documentation afterwards.

English-only notices for Quebec consumers

The Charter of the French Language applies to consumer documentation, and Law 25’s transparency requirement points the same way.

Assuming PIPEDA covers everything

Alberta, BC and Quebec displace it for intra-provincial activity, and health information has separate provincial statutes again.

Frequently asked questions

Does PIPEDA apply to my business?

It applies to organisations that collect, use or disclose personal information in the course of commercial activity, including foreign organisations with a real and substantial connection to Canada. Alberta, BC and Quebec laws displace it for activity wholly within those provinces.

What is Quebec Law 25?

A comprehensive modernisation of Quebec private-sector privacy law that added privacy by default, mandatory impact assessments, a designated privacy officer, portability rights and penalties reaching 4% of worldwide turnover.

Is CASL really stricter than CAN-SPAM?

Substantially. CASL requires consent before sending rather than an opt-out afterwards, regulates the installation of software on devices, and carries penalties up to $10 million per violation for organisations.

Do I need my policy in French?

For Quebec consumers, effectively yes. The Charter of the French Language applies to consumer-facing documents, and Law 25 transparency reinforces it.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.