Legal Requirements for Websites and Apps: Canada

Canadian websites need a federal-and-provincial assessment: PIPEDA, applicable provincial privacy and consumer laws, and CASL for commercial electronic messages. Quebec adds important privacy and French-language requirements. Add provincial accessibility rules, Quebec's French-language requirements, and provincial consumer law, and the pattern becomes clear: in Canada, the province matters more than the country. If you only remember one thing: you may not email Canadians without consent you can prove. Consent may be express or implied under a qualifying statutory condition; some messages are exempt. A purchased list or conference contact is not automatic permission. Keep evidence, respect time limits and provide a working unsubscribe. The second thing: Quebec Law 25 applies to anyone doing business in Quebec, regardless of where you're based, and it requires privacy-by-default — any technology that identifies, locates or profiles a person must be off by default. This is the Canada chapter of our pre-launch legal checklist. Run that prompt sequence first, then layer this on.

Key takeaways

• PIPEDA applies to personal information collected in commercial activity — including a contact form, a booking system or analytics.
• Quebec Law 25 is the strict one: privacy officer, privacy impact assessments, consent for confidential information, profiling technologies off by default, data portability, penalties to $25 million or 4% of worldwide turnover.
• CASL generally requires express or qualifying implied consent for commercial electronic messages, with evidence and applicable expiry dates. Penalties reach $10 million per violation for businesses.
• Breach reporting: notify the Privacy Commissioner and affected individuals where there's a "real risk of significant harm", and keep a record of every breach for 24 months.
• Accessibility is provincial: Ontario's AODA requires WCAG 2.0 AA for organisations with 50+ employees; federally regulated sectors follow the Accessible Canada Act.
• Quebec's French-language rules apply to commercial websites offered to Quebec consumers.
• Federal privacy reform stalled when Bill C-27 died in early 2025 — PIPEDA remains the law.

PIPEDA: the federal baseline

PIPEDA applies to organisations that collect, use or disclose personal information in the course of commercial activity. Alberta, British Columbia and Quebec have their own private-sector laws deemed substantially similar, which take precedence for intra-provincial activity.

The ten fair information principles, in the version that matters for a small product:

• Accountability. Designate someone responsible for privacy compliance and name them or their role in your policy. Even if that person is you.
• Identifying purposes. State why you're collecting each piece of data, at or before collection.
• Meaningful consent. Consent must be understandable to your actual users. The Privacy Commissioner expects key elements — what you collect, who you share it with, the purposes, and the risk of harm — to be prominent, not buried. Express consent for sensitive information; implied consent may work for the obvious.
• Limiting collection, use and retention. Collect what you need; keep it only as long as necessary; document a retention period.
• Accuracy and safeguards. Keep it correct; protect it in proportion to its sensitivity.
• Openness and access. A clear, findable privacy policy, and a way for individuals to see what you hold and correct it — generally within 30 days.

Breach reporting. Since 2018, breaches involving a real risk of significant harm must be reported to the Office of the Privacy Commissioner and to affected individuals as soon as feasible. Separately, you must keep a record of every breach, harmful or not, for 24 months, and produce it on request. That record is a small file most teams never create until they need it.

Federal reform. Bill C-27, which would have replaced PIPEDA with the CPPA and introduced an AI statute, died when Parliament was prorogued in January 2025. PIPEDA is still the operative federal law; expect reform to return, and don't build around a bill that doesn't exist.

Quebec Law 25: the strict one

Applies to any enterprise doing business in Quebec, regardless of where it is established. Fully in force since September 2023, with data portability added in September 2024.

• Privacy officer. Required by default; if you don't designate someone, it's the person with the highest authority in the organisation. Their title and contact must be published.
• Privacy impact assessments for projects involving information systems or electronic service delivery, and before transferring personal information outside Quebec.
• Consent must be clear, free, informed, given for specific purposes, and requested separately from other terms. Express consent for sensitive information.
• Privacy by default. Any technology that allows a person to be identified, located or profiled must have those functions deactivated by default. In practice: no automatic profiling, no location tracking on by default, no cross-site identity resolution unless the user turns it on.
• Automated decisions. If a decision about someone is made exclusively by automated processing, you must tell them, and on request explain the personal information used, the reasons and the main factors, and let them submit observations.
• Rights. Access, correction, de-indexing in some circumstances, and portability of computerised personal information in a structured, commonly used format.
• Incidents. Report confidentiality incidents presenting a risk of serious injury to the Commission d'accès à l'information and to affected individuals, and maintain an incident register.
• Penalties. Administrative monetary penalties up to $10 million or 2% of worldwide turnover; penal fines up to $25 million or 4%. There is also a private right of action with minimum statutory damages for intentional or grossly negligent breaches.

CASL: the expensive one

Canada's Anti-Spam Legislation governs commercial electronic messages — email, SMS, and messages through social platforms — sent to or accessed from a Canadian computer.

• Express consent uses opt-in. Express consent requires a clear request stating who you are, why you're asking, and how to withdraw — never a pre-checked box, and never bundled into terms of service.
• Implied consent is narrow and it expires: typically two years from a purchase or contract, six months from an inquiry, plus conspicuously published business addresses used for relevant messages.
• Every message must identify the sender, give a mailing address and a working contact method, and include an unsubscribe mechanism that works for at least 60 days and is honoured within 10 business days.
• Keep records. In a CASL complaint, the burden is on you to prove consent — when, how, and what the person saw. Retain the wording, source and timing, plus the relevant relationship and expiry if relying on implied consent; no single field is a complete defence.
• CASL has separate software-installation provisions. Check their scope and exceptions; do not assume every user-initiated app installation requires the same extra consent.
• Penalties: up to $10 million per violation for organisations, $1 million for individuals, with officers and directors potentially liable.

Keep the evidence needed to explain your messaging practices; the risk depends on how the list was obtained and used.

Accessibility

There's no single national web accessibility standard for private business. What applies:

• Accessible Canada Act — federally regulated sectors (banking, telecom, broadcasting, interprovincial transport): accessibility plans, feedback processes and progress reports.
• Ontario (AODA) — private and non-profit organisations with 50 or more employees must make websites and web content conform to WCAG 2.0 Level AA, and file periodic compliance reports.
• Manitoba, Nova Scotia and British Columbia have accessibility legislation at various stages, and other provinces are following.
• Human rights law applies everywhere: an inaccessible service can be a discrimination complaint regardless of headcount.

Use WCAG testing alongside the applicable provincial or federal requirements. A WCAG result alone does not establish compliance with every accessibility duty.

French language and consumer rules

Quebec's Charter of the French Language requires commercial publications, websites, catalogues and contracts offered to Quebec consumers to be available in French, on terms at least as favourable as any other language. This is enforced, and it applies to businesses outside Quebec that market there.

Consumer protection is provincial. Quebec's Consumer Protection Act has particularly detailed rules for distance contracts: mandatory pre-contract disclosure, a written contract sent afterwards, and cancellation rights when the disclosure rules aren't met. Ontario's modernised Consumer Protection Act, 2023 has been passed but awaits its regulations to come into force — its subscription provisions (affirmative consent to renew, cancellation at any time, no unnecessary barriers, advance renewal notice) point the same way as every other market on this site, so build for them now.

Sales tax. GST/HST registration is required once you cross the small supplier threshold, and non-resident digital businesses selling to Canadian consumers have had simplified registration obligations since 2021. Quebec, British Columbia, Saskatchewan and Manitoba have separate provincial regimes. Accountant question, asked early.

The Canada-specific prompt

Run this after the ten prompts in the main checklist:

Add Canadian compliance mechanics to this app. Implement each item and report exactly what changed:

1. A privacy policy that names a privacy officer role and contact, states the purpose of each collection at or before the point it happens, gives retention periods, lists every third party that receives personal information and the countries where it is stored, and explains how to request access or correction with a 30-day response commitment.
2. Point-of-collection notices: on every form, a short line stating what the data is used for. Do not rely on the policy page alone.
3. Email consent that satisfies CASL: an unticked opt-in checkbox with wording that states who is sending, what they will send, and how to unsubscribe; a stored record of the consent timestamp, the IP or account, and the exact wording shown; sender identification and a mailing address in every message; and an unsubscribe link that works without login and takes effect immediately. Show me where the consent record is stored.
4. A breach register: an internal table recording every security incident involving personal information with its date, description, data affected, and whether it was reported. This must exist even for incidents we decide not to report.
5. Quebec Law 25 mode: any feature that identifies, locates or profiles a user — analytics identity, location, personalisation, recommendation profiling — must be OFF by default and require an affirmative action to enable. List every such feature and its current default.
6. If any decision about a user is made solely by automated processing, add a notice at the point of the decision and a way for the user to request an explanation and submit observations.
7. Data portability: an export of the user's personal information in a structured, commonly used, machine-readable format.
8. If we serve Quebec: a French version of all consumer-facing text — interface, legal pages, emails, error messages — on terms at least as favourable as English, with a language switcher. Mark any string you could not translate.
9. An accessibility pass against WCAG 2.1 Level AA — report findings by severity before fixing anything.

For each item report PASS or explain what blocked it.
Copy prompt

Pre-launch checklist — Canada

• Privacy policy names a responsible person and states purposes, retention and recipients
• Point-of-collection notices on every form
• CASL: opt-in consent captured with a stored record of when, how and what wording
• Unsubscribe works without login, honoured promptly, valid 60 days
• Breach register exists; escalation path to the Privacy Commissioner defined
• Quebec: privacy officer published, PIA process for new systems and cross-border transfers, profiling features off by default
• Quebec: French version of all consumer-facing content
• Automated decisions disclosed with an explanation route
• Data export in a machine-readable format
• Accessibility audited against WCAG 2.1 AA (AODA applies at 50+ employees in Ontario)

What the build checks establish

The prompts are implementation requests, not a legal certification. Two-click controls and consent-first defaults are practical design choices, not universal statutory requirements. Confirm jurisdiction, exceptions, retention and provider contracts separately. Verify controls with test accounts and actual browser/network behaviour; a builder’s PASS based only on code inspection is incomplete evidence.

Official sources and review scope

Updated September 14, 2026. The linked sources support the scope and corrections discussed here; this is an editorial review, not an exhaustive legal opinion or a certification of your product. Check the operative rule when acting.

• CRTC consent guidance
• PIPEDA requirements
• Quebec Law 25 changes

• Ontario consumer law status

In Canada, the province is the jurisdiction — and the email list is the risk. Run the pre-launch checklist, then the Canada prompt above. Selling elsewhere? See the United States, the European Union, the United Kingdom, Australia, Brazil and Israel. You can build this.