CookieChimp Logo
Book a Demo

Do You Need a Cookie Consent Banner in Canada? The Complete 2026 Guide

Yes — if your site or app uses analytics, ads, pixels, or third-party SDKs, you need a notice-and-choice mechanism in Canada. Here's what changed in 2026 (Bill C-36, the TikTok joint report, Quebec's section 8.1 rulings) and exactly how to configure your banner.

Written by
Daniel
Published on
Do You Need a Cookie Consent Banner in Canada? The Complete 2026 Guide

Canadian privacy compliance used to be the thing teams did after GDPR and CCPA. That is no longer a defensible order of operations.

Since the last edition of this guide, Canada produced the two things it had been missing: a real ruling on what consent has to look like on screen, and a serious attempt at replacing PIPEDA. In September 2025, four regulators published a joint investigation report that took apart a major platform's consent experience element by element. In June 2026, the federal government tabled Bill C-36, which would repeal the privacy half of PIPEDA and hand enforcement to a new commission with order-making powers and multi-million-dollar penalties.

If your website or app uses cookies, analytics, tracking scripts, pixels, third-party SDKs, or advertising integrations, this guide is the 2026 edition: what the law actually requires today, what is coming, and what to ship.

Yes, in practice — but Canada does not have a single "cookie law" that says so. The obligation comes from privacy-law consent rules that apply whenever cookies, pixels, SDKs, or similar technologies collect personal information. Because online behavioural advertising almost always involves personal information, a banner (or an equivalent notice-and-choice mechanism) is the practical way to comply.

What differs by region is the consent model, not whether you need one:

Visitor location Consent model to design for
Quebec Opt-in. Technologies that identify, locate, or profile must be off until the visitor turns them on.
Rest of Canada Opt-out can be lawful for ordinary, non-sensitive online behavioural advertising — but only if the notice and the decline control genuinely meet the OPC's conditions.
Sensitive, health, location, or unexpected tracking anywhere in Canada Express opt-in.

Supportive: Outside Quebec, Canada gives you room to design a consent experience that does not nuke your analytics on day one.

Cynical: That room evaporates the moment a regulator looks at what your pixels actually collect. "Non-sensitive" is a conclusion you have to earn, not a checkbox you tick.

Development Date What it means for your banner
Bill C-36 tabled — the Protecting Privacy and Consumer Data Act (PPCDA) June 15, 2026 Would replace PIPEDA's privacy provisions, make express consent the default standard, add a documented "legitimate interest" exception, and create a new enforcement body with penalties up to the greater of $10M or 3% of gross global revenue. Not law yet.
Joint TikTok investigation report (OPC + Quebec CAI + BC OIPC + Alberta OIPC) September 23, 2025 The first detailed Canadian ruling on consent user experience: layered notice, up-front prominence, French availability, and settings that default to the highest level of privacy.
CAI's first published section 8.1 findings September 23, 2025 Linking a cookie notice to a privacy policy does not satisfy Quebec's opt-in rule. The activation control has to be visible and the profiling has to be off first.
Alberta PIPA reform in consultation Feb 2025 report, public engagement through 2026 Twelve recommended amendments, including new enforcement powers. No bill introduced yet — expect movement in 2026–2027.
BC Bill 9 (2026) amends FIPPA, not PIPA 2026 session BC's private-sector law is unchanged. Do not let public-sector headlines change your BC banner configuration.

The through-line: Canadian regulators moved from publishing principles to grading implementations.

1. Canada's privacy framework in 2026

Canada's privacy regime is still a patchwork of federal and provincial laws, which is why a "highest common denominator" instinct is usually right.

Federal — PIPEDA (still the law in force)

The Personal Information Protection and Electronic Documents Act governs how most private-sector organizations handle personal information, and it is what applies to your site today. It requires:

  • Meaningful consent: consent is only valid if it is reasonable to expect that the individual would understand the nature, purpose, and consequences of the collection, use, or disclosure.
  • Clear explanations: what is collected, why, and who receives it — at or before the time of collection.
  • Accessibility: presented so a person can actually act on it, without legalistic filler.

The Office of the Privacy Commissioner of Canada (OPC) treats data collected through cookies for online tracking and targeting as personal information where there is a serious possibility it could be linked to an individual. That standard captures cookie IDs, IP addresses, pixel IDs, device identifiers, and cross-site signals in most real-world ad-tech setups.

Federal — Bill C-36, the third attempt at reform

Bill C-36 received first reading on June 15, 2026 and is at second reading. It would enact the Protecting Privacy and Consumer Data Act (PPCDA), repeal Part 1 of PIPEDA, and rename what remains the Electronic Documents Act. It follows Bill C-11 (2020) and Bill C-27 (2022), both of which died on the order paper.

What matters for consent design if it passes broadly as tabled:

  • Express consent becomes the default standard, with implied consent surviving only in limited circumstances.
  • Plain-language explanations are required at the point of consent — a codification of what the OPC has said in guidance for years.
  • A "legitimate interest" exception modelled on the GDPR, available only with a documented assessment of interests, harms, and mitigations. This is the provision most likely to change how analytics is justified in Canada.
  • Children's personal information is explicitly sensitive.
  • Automated decision systems — machine learning, neural networks, and similar techniques — carry public-accounting and explanation-on-request obligations.
  • Enforcement moves from the Privacy Commissioner to a new Digital Safety and Data Protection Commission of Canada, with investigation, audit, and order-making powers.
  • Administrative monetary penalties up to the greater of $10 million or 3% of gross global revenue.

Parliament rose for the summer and returns September 21, 2026. Committee study, third reading, the Senate, and royal assent all still have to happen, and amendments at committee are likely. Prior attempts show how easily that chain breaks — treat C-36 as a planning signal, not a compliance deadline.

Supportive: Every version of federal reform has pushed in the same direction — express consent, plain language, real penalties. If you build for that now, you are unlikely to be wrong later.

Cynical: This is the third bill in six years. Building your roadmap around its exact wording is how teams end up re-planning in 2027.

Provincial — the laws that already displace PIPEDA

Three provinces have general private-sector privacy laws declared substantially similar to PIPEDA, which apply instead of PIPEDA to organizations operating wholly within them:

  • Quebec — the Act respecting the protection of personal information in the private sector, as amended by Law 25. The strictest regime in North America.
  • Alberta PIPA — under active reform review. A legislative committee delivered twelve recommendations in February 2025 (new enforcement powers, a defined harm threshold, mandatory service-provider contracts), the government ran a public engagement in February 2026, and consultation with the province's Information and Privacy Commissioner continued through spring 2026. No bill has been introduced.
  • BC PIPA — unchanged. British Columbia's Bill 9 (2026) amends FIPPA, the public-sector law. It does not touch PIPA.

Health-sector laws in Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia add a further layer for health information custodians. For a province-by-province mapping, see our guide to cookie banner requirements in Canadian provinces.

2. Opt-in vs opt-out: what the OPC actually permits

The 2025 edition of this guide told you to use opt-in everywhere and stop thinking about it. That is still the lowest-risk configuration, but it is not what the law requires outside Quebec, and it is worth understanding the difference before you accept the consent-rate cost.

The OPC's online behavioural advertising guidance sets out when opt-out consent for OBA can be reasonable. All of these have to hold:

  • The purposes are made obvious and understandable, not buried.
  • Notice is given at or before the time of collection.
  • The individual can easily opt out — ideally at or before collection.
  • The opt-out takes effect immediately and persists.
  • The information is limited to non-sensitive data.
  • The information is destroyed quickly or effectively de-identified.

That last condition is the one most ad-tech stacks fail. If your vendor retains identifiers for its own modelling, "non-sensitive and short-lived" stops being a defensible description.

  • The information is sensitive (health, financial, biometric, precise location, and — under Bill C-36 — children's data).
  • The collection, use, or disclosure falls outside the individual's reasonable expectations.
  • There is a meaningful residual risk of significant harm.
  • The tracking is for profiling or advertising in Quebec, under section 8.1.

The OPC's Home Depot finding is the canonical example: customers asking for an emailed receipt would not reasonably expect their hashed email and purchase details to be sent to Meta for advertising measurement and Meta's own purposes. Express opt-in was required. Server-side conversion APIs and offline-conversion uploads sit squarely in that pattern.

3. Quebec's Law 25 and section 8.1

Law 25 has been fully in force since its final tranche (data portability) landed on September 22, 2024. For banner design, the operative provision is section 8.1.

Section 8.1 applies whenever a business collects personal information using technology with functions that allow a person to be identified, located, or profiled. The business must first inform the person that the technology is being used and tell them the means available to activate those functions. That wording — activate, not deactivate — is why the CAI reads section 8.1 as a default-off rule: the visitor switches profiling on, not off.

Law 25 defines profiling as collecting and using personal information to assess characteristics such as preferences, interests, or behaviour. Behavioural analytics, retargeting, ad pixels, and personalization engines are all inside that definition.

What Quebec compliance requires in practice:

  • Express opt-in that is free, informed, specific to each purpose, and given by a clear affirmative action.
  • Off by default for every non-essential identifying, locating, or profiling technology.
  • French, under the Charter of the French Language and Law 25's clear-and-simple-language obligation. The joint TikTok report treated missing French-language privacy communications as a direct barrier to valid consent for francophone users.
  • Documented, provable consent records.

Penalty exposure is two-tiered, and the two tiers get conflated constantly:

Mechanism Maximum
Administrative monetary penalty (imposed by the CAI) Greater of $10 million or 2% of worldwide turnover
Penal fine (prosecution) Greater of $25 million or 4% of worldwide turnover, doubled for a repeat offence

On top of that, Law 25 carries a private right of action: statutory punitive damages of at least $1,000 per person where an infringement is intentional or results from gross negligence — available through class proceedings. For a consumer site with a Quebec user base, that exposure can outrun the regulatory number.

On September 23, 2025, the OPC, Quebec's CAI, and the BC and Alberta commissioners released their joint findings on TikTok's collection and use of personal information for ad targeting and content personalization. The Offices found the matter well-founded and conditionally resolved, on the strength of remedial commitments due within six months.

Strip out the platform-specific parts and what remains is a checklist for anyone building a consent flow:

  • Express consent was required, because the combined information was sensitive and the tracking and profiling fell outside users' reasonable expectations.
  • Burying it in the policy fails. Key details about what was collected and how it was used to infer demographics and interests were not surfaced when consent was requested.
  • Vague purpose language fails. "To train and improve" our algorithms was called out as insufficient — which models, and what it means for the user, both matter.
  • Scattered documents fail. A supplementary "Ads and your data" article that was not linked from the privacy policy was treated as not readily available at the time consent was sought.
  • Layered notice is good practice, not a shortcut. Four things need prominence: what is collected, who receives it, why, and the potential harms. Just-in-time notices help, but cannot carry the whole disclosure.
  • French matters. Privacy communications unavailable in French could not support meaningful consent from francophone users in Canada.
  • Defaults matter (Quebec). The CAI found information was collected through identify/locate/profile functionality without the user making an active gesture, and that privacy settings did not provide the highest level of privacy by default.

Supportive: This is the most useful document Canadian regulators have produced for CMP implementers. It tells you what "meaningful" means in interface terms.

Cynical: Every finding here maps to a banner pattern that is still shipping on thousands of Canadian sites. "Accept" plus a policy link was already not enough in 2025; now there is a published report saying so.

A banner has to facilitate an informed choice, not manufacture a click.

Design principles

  • Clarity — plain language, no "service improvement" euphemisms standing in for ad targeting.
  • No coercion — no pre-ticked boxes, no scroll-equals-consent, no visually demoted reject path.
  • Timing — the banner appears and the choice is captured before non-essential scripts fire.

Practical behaviour

Feature Requirement
Choice Accept and Reject at equal prominence and equal click depth.
Granularity Separate categories — analytics, advertising, personalization, functional — not all-or-nothing.
Disclosure at the point of consent Purposes, recipients, and consequences visible in the banner or its first layer, not only in the policy.
Withdrawal A persistent icon or footer link that reopens preferences and takes effect immediately.
Blocking Non-essential scripts blocked until consent (Quebec: mandatory; elsewhere: how you prove your opt-out is real).
Language French for Quebec visitors, covering the banner and the linked policy.
Records Timestamped, provable proof of what was consented to and when.

6. Mobile apps: same rules, different surface

Meaningful consent applies identically to apps, which have no browser cookies but plenty of identifiers.

  • SDKs and device IDs — third-party SDKs, IDFA, and the Google Advertising ID collect personal information and require the same consent analysis as cookies.
  • Onboarding notice — surface the disclosure at first launch, before analytics and attribution SDKs initialize.
  • OS-native permissions — use the iOS App Tracking Transparency prompt for cross-app tracking; it complements your consent layer rather than replacing it.
  • In-app toggles — a settings screen where consent can be reviewed and withdrawn. The TikTok commitments included exactly this: a centralized privacy check-up.
  • Localization — French for Quebec users, in-app as well as on the web.
  • Highest privacy by default — for Quebec, profiling functionality ships off.

7. Global comparison (2026)

Region Primary law Consent standard Cookie expectation
Canada (PIPEDA) PIPEDA (Bill C-36 pending) Opt-in or opt-out depending on sensitivity and expectations Notice-and-choice required; opt-out permitted only under the OPC's conditions
Quebec Law 25, section 8.1 Strict opt-in for identifying, locating, profiling Off by default until the visitor activates
EU / EEA GDPR + ePrivacy Directive Strict opt-in for non-essential storage/access Required before any non-essential cookie; still a national patchwork after the ePrivacy Regulation was withdrawn in 2025
UK UK GDPR + PECR, as amended by the Data (Use and Access) Act 2025 Opt-in, with new exceptions phasing in Some low-risk/statistical use cases moving toward exemption; EU-first logic still safer for dual-market sites
California CCPA/CPRA Opt-out, with GPC honoured as a valid signal No banner mandated, but a working "Do Not Sell or Share" path and GPC handling are

For the full picture on what moved globally this year, see what changed in cookie consent laws in 2026.

8. Canadian compliance checklist

Transparency

  • We explain what data we collect — in the banner, not only the policy.
  • We explain why, specifically enough that a user could predict the consequence.
  • We name the third parties that receive the data.
  • We state retention periods.
  • Every document we rely on for consent is linked from the consent surface itself.
  • Non-essential tracking does not start before a choice is made.
  • Accept and Reject are equally prominent and equally reachable.
  • No pre-checked boxes, no scroll-as-consent, no dark patterns.
  • Granular category controls are available.
  • Withdrawal is always available and takes effect immediately.
  • Quebec visitors get opt-in with profiling off by default.

Language and accessibility

  • Plain language, no jargon.
  • French available for Quebec — banner, preference centre, and policy.
  • Controls are keyboard-accessible and readable at normal contrast.

Record keeping

  • Consent choices are logged securely and are exportable.
  • We can show when and what a specific user consented to.
  • Consent is refreshed when purposes or vendors change materially.

Technical behaviour

  • Ad scripts blocked until consent.
  • Analytics disabled until consent (or configured to the local opt-out model, correctly).
  • Server-side tagging and conversion APIs respect the same consent state as client-side tags — this is where most audits find leaks.
  • Turning a category off actually stops the corresponding tracking, including already-set cookies.

Mobile-specific

  • First-launch privacy notice before SDK initialization.
  • OS permissions aligned with actual data use.
  • In-app withdrawal control.
  • ATT prompt where cross-app tracking occurs.
  • French localization where required.

9. Choosing your Canada strategy

There are two defensible approaches. Pick deliberately.

Option A — universal opt-in. One GDPR-style strict opt-in banner for all Canadian traffic. It clears Quebec (the highest bar), PIPEDA, Alberta and BC PIPA, and the GDPR if you have EU traffic. There is no geo-detection to get wrong and no risk of serving the wrong consent state to a Quebec visitor behind a VPN or a mislabelled IP. The cost is measured consent rates outside Quebec, where opt-out is lawful.

Option B — province-aware targeting. Opt-in for Quebec and for any sensitive context; a properly built opt-out experience for the rest of Canada. This preserves analytics coverage where the law allows it, at the price of maintaining a geo-targeting configuration and being honest about what "non-sensitive" means for your stack. CookieChimp supports Canadian province and territory targeting for exactly this — see can cookie banners target Canadian provinces.

If you cannot confidently answer "what does every vendor on this page do with the identifiers we send them?", choose Option A. The tailored approach is only lower-cost when the underlying data mapping is real.

FAQ

Is a cookie banner legally required in Canada?

There is no standalone Canadian cookie law. The requirement flows from consent obligations under PIPEDA and provincial privacy laws whenever tracking technologies collect personal information — which online behavioural advertising almost always does. A banner is the practical mechanism, not the legal object.

Does Bill C-36 change what I need to do right now?

No. C-36 received first reading on June 15, 2026 and is not law. PIPEDA still applies. But its direction — express consent as the default, documented legitimate-interest assessments, real penalties — matches where regulators already are, so building toward it is not wasted work.

Is Quebec's Law 25 really opt-in for cookies?

For technologies that identify, locate, or profile a person, yes. Section 8.1 requires you to inform the visitor and tell them how to activate those functions, which the CAI reads as requiring them to be off by default. Strictly necessary cookies that deliver the requested service sit outside that.

Do I need a French version of my banner?

For Quebec visitors, yes — under the Charter of the French Language and Law 25's clear-language obligation. The joint TikTok report treated the absence of French privacy communications as undermining valid consent for francophone users. French-only for the banner while the linked policy stays English does not close the gap.

Can I use one banner for Canada and the EU?

Yes, if it is a strict opt-in banner. A GDPR-configured banner satisfies Quebec and exceeds what the rest of Canada requires. What you cannot do is run a US-style notice-only banner and assume it covers Canadian traffic.

What are the actual penalties under Law 25?

Administrative monetary penalties reach the greater of $10 million or 2% of worldwide turnover; penal fines reach the greater of $25 million or 4%, doubled for a repeat offence. Individuals can also claim punitive damages of at least $1,000 for intentional or grossly negligent infringements, including through class actions.

Does the OPC treat cookie data as personal information?

Where there is a serious possibility the information could be linked to an individual, yes. In a typical ad-tech configuration involving cookie IDs, IP addresses, and cross-site identifiers, assume it is.

References

Simplify Canadian compliance with CookieChimp

Getting this right in-house means building script blocking that holds under server-side tagging, a French preference centre, province-aware consent models, and an auditable consent log — then maintaining all of it through a federal bill and an Alberta reform cycle.

A consent management platform absorbs that. With CookieChimp you can deploy a Law 25-compliant, off-by-default banner for Quebec and a tailored experience for the rest of Canada from one configuration, block non-essential scripts until consent is given, serve French where it is required, and keep a provable record of every choice.

Get started with CookieChimp.

The content of this article is provided for information purposes only and does not constitute legal or other advice.