Arctos builds websites, not legal opinions. This guide covers what usually comes up while building one, so the right questions reach your lawyer early.
The short answer
- Collect only what each form needs, and say why in a privacy policy that matches what the site does.
- Tracking cookies for marketing or analytics need meaningful consent; Quebec visitors need it first.
- Email sign-ups need consent and an unsubscribe link under CASL.
- Federal reform is coming again: Bill C-36 was introduced in June 2026 but is not law yet.
Which law applies
PIPEDA is the federal private-sector privacy law. It covers federally regulated organizations and commercial activity in provinces without their own substantially similar law.
Alberta and British Columbia each have a Personal Information Protection Act (PIPA) for private-sector organizations in the province, and Quebec has its own private-sector law, updated by Law 25. Personal information that crosses provincial or national borders can still bring PIPEDA in.
Quebec's Law 25
Law 25 applies to organizations that collect personal information about people in Quebec, wherever the organization is based. For websites, the practical effect is express consent before non-essential cookies are activated, a published privacy policy, and a named person responsible for personal information.
If your site serves Quebec, plan for this at the design stage. Retrofitting consent onto finished tracking is harder than building it in.
Bill C-36, the next federal law
Bill C-27 died when Parliament was prorogued in January 2025. Its successor, Bill C-36, the proposed Protecting Privacy and Consumer Data Act, received first reading on 15 June 2026. It would replace the privacy part of PIPEDA, create a new commissioner within a Digital Safety and Data Protection Commission, and allow penalties of up to $10 million or 3 percent of global revenue, rising to $25 million or 5 percent for the most serious offences.
It is a bill, not a law. Nothing changes for your website until it passes and comes into force.
Email sign-ups and CASL
Canada's Anti-Spam Legislation requires consent before sending commercial email, identification of the sender, and a working unsubscribe in every message. For a website, that means a newsletter box that does not pre-tick consent and a record of when and how each person agreed.
A website checklist
- A privacy policy that names what each form collects, why, and who to contact.
- Forms that ask only for what the next step needs.
- Tracking and advertising scripts that load only after consent.
- Knowing where form submissions and analytics data are stored, and by whom.
- Unticked email consent with a record of each sign-up.
- Accessible forms and pages, the other half of a trustworthy site. How this site approaches it.
Questions
Do Canadian websites need a cookie consent banner?
If the site uses cookies or similar tracking for marketing or analytics, Canadian privacy regulators expect meaningful consent, and Quebec's Law 25 requires consent before non-essential cookies are activated for Quebec residents. A site that uses only essential cookies, or privacy-friendly analytics that do not track individuals, may not need a banner.
Does Quebec's Law 25 apply to businesses outside Quebec?
It can. Law 25 applies to organizations that collect personal information about people in Quebec in the course of business, wherever the organization is based. A website that serves Quebec visitors and collects their information is within reach.
Which privacy law applies to an Alberta business?
Alberta's Personal Information Protection Act (PIPA) governs private-sector organizations in Alberta. Federal PIPEDA still applies to federally regulated organizations and to personal information that crosses provincial or national borders in the course of commercial activity.
Is Bill C-36 law yet?
No. Bill C-36, the proposed Protecting Privacy and Consumer Data Act, received first reading on 15 June 2026. It would replace the privacy part of PIPEDA and introduce larger penalties, but it must pass Parliament before it applies.