Does my app need a privacy policy?

Which privacy law applies to an Ontario app?

Ontario has no general private-sector privacy statute, so for most Ontario startups the federal PIPEDA applies to personal information collected, used or disclosed in the course of commercial activity. It also generally applies when personal information crosses provincial or national borders. If you have users in Quebec, Quebec’s private-sector privacy law, amended by Law 25, can apply too. British Columbia and Alberta have their own private-sector laws for organizations operating there.

Health businesses in Ontario may be covered by PHIPA instead. See privacy rules for wellness clinics.

Does the law actually require a written policy?

PIPEDA doesn’t use the words “privacy policy”, but its openness principle (clause 4.8 of Schedule 1) requires an organization to make specific information about its personal information policies and practices readily available, in a form that’s generally understandable. For an app, a published privacy policy is the normal way to do that. See do I need a privacy policy in Canada.

Quebec is explicit. Section 8.2 of its private-sector act requires a business that collects personal information through technological means to publish a confidentiality policy, in clear and simple language, on its website and to tell people about changes to it.

What do Apple and Google require?

Both stores require one, whatever the law says. Apple’s App Review Guidelines (5.1.1) say all apps must link to their privacy policy in App Store Connect and within the app, and set out what it must explain. Google Play’s User Data policy expects a privacy policy in both the store listing and the app. Both stores also ask for data disclosures (Apple’s privacy labels, Google’s Data safety section) that should match your policy.

What should the privacy policy say?

It should explain, in plain language (the full list, with the source of each point, is in what a Canadian privacy policy must include):

• What you collect, including information users give you, information collected automatically (device data, analytics, location) and information from third parties.
• Why: each purpose for which you use it. PIPEDA requires purposes to be identified at or before collection (Principle 4.2).
• Who you share it with, by category: cloud hosts, analytics, payment processors, AI model providers, and anyone else.
• Where it’s stored and processed, including outside Canada. The OPC’s cross-border guidance expects you to tell people their information may be processed in another country.
• How long you keep it, and how you delete it.
• How you protect it.
• How people can access and correct their information, and how to withdraw consent. Under Principle 4.9, individuals have a right of access, and section 8 generally gives you 30 days to respond. See privacy access requests.
• Who to contact. PIPEDA requires someone to be accountable (Principle 4.1). Quebec requires a person in charge of protecting personal information, whose title and contact details are published on your website (section 3.1). See does Quebec’s Law 25 apply to my startup.
• Cookies and tracking, and the choices users have.

Is a privacy policy the same as consent?

No. The policy explains your practices; consent is what users agree to. PIPEDA generally requires meaningful consent, and the OPC’s Guidelines for obtaining meaningful consent say the key elements must be highlighted for users, not buried in a long policy. That means short, timely notices at sign-up and when you ask for a sensitive permission (location, contacts, camera, microphone), with express consent for sensitive information or uses people wouldn’t reasonably expect.

Special cases for apps

Children

The OPC’s position is that, in all but exceptional circumstances, children under 13 can’t give meaningful consent, so you need consent from a parent or guardian. Apps aimed at teenagers need consent flows suited to their maturity.

Privacy settings and tracking

Quebec’s section 9.1 requires that a technological product offered to the public with privacy settings be set to the highest level of confidentiality by default (browser cookies excepted). If you use features that identify, locate or profile users, Quebec’s section 8.1 also requires you to tell them first and explain how they can activate those features. The Commission d’accès à l’information reads this to mean the features can’t be on by default.

AI features

If you send user content to a model provider, say so. If you train or improve models on user data, the policy should say that clearly, and consent may need to be express. If a feature makes a decision about someone based exclusively on automated processing, Quebec’s section 12.1 requires you to tell them. See terms for AI products and AI training data and web scraping in Canada.

Business customers’ data

If you’re a B2B SaaS product processing your customers’ end-user data, you also need a data processing agreement and a list of sub-processors. See SaaS agreements.

What about breaches?

Under section 10.1 of PIPEDA, if it’s reasonable to believe a breach of security safeguards creates a real risk of significant harm, you must report it to the Privacy Commissioner and notify affected individuals, and you must keep a record of every breach. Quebec has a similar regime for “confidentiality incidents”. Your policy doesn’t have to describe your incident plan, but you should have one.

Do I need a GDPR privacy policy too?

Possibly. The EU’s GDPR can apply to a Canadian company that offers goods or services to people in the EU or monitors their behaviour there. If you’re actively marketing to EU users, plan for it. One policy can usually cover both, with jurisdiction-specific sections.

Is the law changing?

Bill C-27, which would have replaced PIPEDA’s private-sector rules, died when Parliament was prorogued in January 2025. On June 15, 2026 the government introduced Bill C-36, which would enact a Protecting Privacy and Consumer Data Act and amend PIPEDA. As of October 28, 2026, LEGISinfo shows it had completed first reading and was awaiting second reading in the House of Commons. It isn’t law, and it could change before it passes. A policy built on accurate data mapping now will be much easier to update if it passes.

Why a template usually isn’t enough

A template describes someone else’s product. If your policy says you don’t share data and your app runs three analytics SDKs, the policy is inaccurate, and inaccurate privacy statements can also raise misleading-representation issues under the Competition Act. Start by mapping what data your app and its SDKs actually collect. See privacy policy generators: what they miss.

What to do next

1. List every type of personal information your app, website and third-party tools collect, and why.
2. Name the person accountable for privacy.
3. Write the policy to match, and keep your App Store and Google Play disclosures consistent with it.
4. Add short consent notices at sign-up and at sensitive permissions.
5. Set a reminder to review it whenever you add a feature, vendor or market.

We prepare privacy policies matched to what your product actually does, at a fixed fee shown on our fees page, including in the launch pack with terms of service and AI product terms. See also privacy and data, CASL for SaaS and what contracts a software startup needs.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To talk through your app’s data practices, book a free 15-minute consult.