Outside Quebec, Canadian websites mostly answer to PIPEDA, the federal privacy law. It doesn't ask for a cookie banner the way European law does, but it does set conditions for analytics and advertising tracking that many sites don't meet.
Who it applies to.
PIPEDA covers personal information collected in the course of commercial activity across most of Canada. Quebec, Alberta and British Columbia have their own private-sector laws, which apply instead within those provinces. Quebec's is the strictest on tracking: see Quebec's Law 25 and GA4.
Identifiers such as cookie IDs, IP addresses and browsing histories can be personal information under PIPEDA when they can be linked to a person.
What the regulator expects for advertising tracking.
The Office of the Privacy Commissioner of Canada has published guidelines on online behavioural advertising. They accept an opt-out, rather than an opt-in, only when all of these hold:
- People are told about the tracking clearly when they arrive, not only in a privacy policy.
- The opt-out takes effect straight away and lasts.
- The information collected is kept to non-sensitive information as far as practicable.
- It's destroyed or de-identified as soon as practicable.
The guidelines also say not to track children for advertising, and not to use techniques people can't see or control, such as fingerprinting a device.
Sensitive information, such as health or financial details, needs express consent. Pixels on pages about medical conditions or debt are the usual risk.
What it means in practice.
- Tell visitors when they arrive. A short notice or banner, with a link to more detail.
- Make the opt-out work. It has to stop the tags, not just record a preference. Test it in Google Tag Manager.
- Keep pixels off sensitive pages, or hold them until the visitor agrees.
- Set retention. GA4's data retention setting and your advertising platforms' settings decide how long data is kept.
- Watch for Quebec visitors. A site that serves the whole country usually needs the Quebec rules too.
Reform: still waiting.
Bill C-27 would have replaced PIPEDA with a new consumer privacy law, but it died when Parliament was prorogued in January 2025. A new privacy bill, C-36, was introduced in June 2026 and is at an early stage. Until a new law passes, PIPEDA and the regulator's guidelines apply.
A setup that tells visitors clearly, honours opt-outs and treats sensitive pages carefully is likely to suit whatever replaces it.
What to check.
- List every tag on the site and what each one sends.
- Check visitors are told about tracking when they arrive.
- Opt out, reload and confirm in the network requests that advertising tags stop.
- Check sensitive pages for advertising pixels.
- Check GA4's retention setting.
This article explains how tracking works, not legal advice. Marc Alexander, a GTM consultant, sets up tracking for Canadian businesses, and the GA4 mini audit checks what your tags do when visitors opt out.