PIPEDA
Personal Information Protection and Electronic Documents Act
Key Facts
Effective Date
January 1, 2004
Enacted
April 13, 2000
Enforcing Authority
Office of the Privacy Commissioner of Canada (OPC)
Consent Model
Opt-in
Fulfillment Time
30 days
Applies To
Private-sector organizations across Canada in commercial activities (except Quebec, Alberta, BC for intra-provincial)
Overview
PIPEDA is Canada's federal private-sector privacy law, based on 10 fair information principles. It requires express consent for sensitive information and allows implied consent for less sensitive data. The proposed replacement (CPPA) died in January 2025, with a new bill expected carrying penalties up to CAD $25M or 5% of global revenue.
What This Means for Your Website
- Meaningful consent is required: express for sensitive data, implied for non-sensitive data where that matches reasonable expectations
- OPC guidance specifically addresses cookies and online behavioral advertising
- A designated privacy officer must be accountable for compliance
- Breach notification is required for breaches posing real risk of significant harm
- PIPEDA does not apply in Quebec, Alberta, or BC for intra-provincial commercial activities. Quebec is covered instead by Law 25, which sets a stricter consent bar than PIPEDA and reaches any business handling the personal information of Quebec residents
Key Requirements
The OPC enforces PIPEDA with penalties up to CAD $100,000 per violation. Consumer requests must be fulfilled within 30 days. The expected replacement bill would increase penalties to CAD $25 million or 5% of global revenue. PIPEDA applies federally but yields to substantially similar provincial legislation.
How ConsentStack Handles This
ConsentStack detects Canadian visitors and applies PIPEDA-compliant consent with express opt-in for sensitive data categories, supporting the meaningful consent standard.
Penalties
Up to CAD $100,000 per violation; Federal Court can order compliance and award damages.
Maximum Fine
CA$100,000 per violation
Key Requirements
- Obtain meaningful consent: express for sensitive information, implied for non-sensitive
- Identify purposes at or before collection
- Limit collection to what is necessary
- Safeguard personal information with appropriate security
- Provide individuals access to their personal information
- Designate a privacy officer accountable for compliance
Notable Provisions
- CPPA (Bill C-27) died January 2025
- New bill expected with CAD $25M or 5% revenue penalties
- Does not apply in Quebec, Alberta, BC for intra-provincial activities
Related Regulations (3)
Quebec Law 25Quebec, Canada
Quebec's Law 25 is the strictest privacy law in Canada and the closest North American equivalent to the GDPR. Consent must be clear, free, informed and requested for each purpose, and any technology that identifies, locates or profiles a visitor has to be disclosed. Its privacy-by-default rule carves out browser cookie settings, but non-essential cookies still need consent first.Alberta PIPAAlberta, Canada
Alberta's PIPA is recognized as substantially similar to PIPEDA, covering provincially regulated private-sector organizations. The OIPC has binding order-making power, stronger than PIPEDA's OPC which issues only recommendations. Express consent is required for sensitive data, implied for non-sensitive.BC PIPABritish Columbia, Canada
British Columbia's PIPA is recognized as substantially similar to PIPEDA. The OIPC can investigate complaints, conduct audits, issue binding orders, and require compliance. Nonprofits engaging in commercial activities are also covered. Organizations must destroy personal information once the original purpose is fulfilled.Other North America Regulations
CCPACalifornia, United States
The CCPA was the first comprehensive consumer privacy law in the United States, giving California residents the right to know what personal information businesses collect and to opt out of its sale. It established the opt-out consent model that most subsequent US state privacy laws adopted.CPRACalifornia, United States
The CPRA is the most comprehensive US state privacy law with a dedicated enforcement agency (CPPA). Cross-context behavioral advertising via cookies constitutes sharing personal information, triggering opt-out obligations. GPC signals must be honored as valid opt-out requests.CIPACalifornia, United States
CIPA is a 1967 California chapter covering wiretapping, eavesdropping, and other privacy invasions, not a website-specific law. Since 2022, courts have applied two of its sections to website chat, analytics, and ad tools, and any visitor can sue directly for at least $5,000 per violation, no revenue threshold.TDPSATexas, United States
The TDPSA is the broadest US state privacy law: no revenue thresholds and no minimum consumer data volume thresholds. Applies to any non-small-business processing personal data of Texas residents. Must honor GPC signals since January 2025. This breadth means far more businesses are captured than under any other state law.Quebec Law 25Quebec, Canada
Quebec's Law 25 is the strictest privacy law in Canada and the closest North American equivalent to the GDPR. Consent must be clear, free, informed and requested for each purpose, and any technology that identifies, locates or profiles a visitor has to be disclosed. Its privacy-by-default rule carves out browser cookie settings, but non-essential cookies still need consent first.CPAColorado, United States
Colorado's CPA features the highest per-violation penalties among US state privacy laws at $20,000. Must honor GPC signals since July 2024. Participated in a joint GPC enforcement sweep with California and Connecticut in September 2025. The cure period was eliminated in January 2025.Frequently Asked Questions
Stay compliant with PIPEDA
ConsentStack helps you implement Opt-in consent for Canada (Federal) automatically.