Do I need a cookie banner in Canada?

Canadian sites have been slower to adopt cookie banners than European ones, partly because Canada has no cookie-specific law. Quebec’s privacy reforms changed the calculation for any business with Quebec visitors.

What does PIPEDA require?

Meaningful consent for collecting and using personal information, and information collected through cookies, pixels and device identifiers is often personal information. The Privacy Commissioner’s online behavioural advertising guidelines say opt-out consent can be reasonable for ad tracking if:

• People are told about the tracking in a clear, obvious way at or before the time it starts, not only in the privacy policy.
• The opt-out is easy, takes effect immediately and persists.
• The information is limited, as far as practicable, to non-sensitive information.

The guidelines also expect the information to be destroyed or de-identified as soon as possible. Opt-out isn’t acceptable for sensitive information such as health information, and the guidelines say organizations should avoid tracking children and tracking on sites aimed at children.

What does Quebec require?

Two rules matter. If you use technology that can identify, locate or profile a person, section 8.1 requires you to inform them first and tell them how to activate those functions. The Commission d’accès à l’information says those functions can’t be activated by default; the person has to turn them on. And under section 9.1, products offered to the public with privacy settings must default to the highest level of confidentiality, though that rule doesn’t apply to the privacy settings of a connection cookie. Whether a given analytics tool profiles people depends on what it collects and how the data is used, so review each tool rather than assuming. See Quebec’s Law 25 for SaaS.

What does that mean in practice?

Type of cookie or tracker	Canada outside Quebec	Quebec visitors
Strictly necessary (login, security, cart)	Notice in privacy policy	Notice in privacy policy
Basic analytics	Clear notice; opt-out is common	Consider opt-in; check whether it profiles
Advertising, retargeting, cross-site pixels	Prominent notice and an easy opt-out, at minimum	Opt-in, off by default
Anything on health, wellness or children’s sites	Opt-in	Opt-in

Many companies serve one opt-in banner to all Canadian visitors because it’s simpler to run, and because ad pixels on health and wellness sites can reveal sensitive information.

Do my vendors’ tools count?

Yes. If you install a pixel, you’re collecting through it, even if the data goes to the platform. Your privacy policy should name the categories of tools and where data goes. See can I store Canadian data in the US.

What about the GDPR?

If you target EU or UK users, their cookie rules require prior consent for non-essential cookies. That’s stricter than PIPEDA.

What to do next

We prepare privacy policies after reviewing your actual trackers and data flows, at fixed fees on our fees page. Clinics should also see privacy for wellness clinics.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To check your site’s tracking setup, book a free 15-minute consult.