What Are Cookie Banner Requirements in Canadian Provinces?

Canada does not have one simple cookie-banner rule.

For many ordinary commercial websites, PIPEDA is the baseline. For organizations operating entirely within Alberta, British Columbia, or Quebec, provincial private-sector laws can apply instead. For health information custodians in Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia, health-sector privacy laws add another layer. Federally regulated businesses and cross-border or interprovincial personal information flows can still bring PIPEDA back into the picture.

That sounds complicated, but the practical banner pattern is clearer than the legal map:

• Quebec needs an opt-in approach for technologies that identify, locate, or profile people.
• Alberta, British Columbia, and most PIPEDA provinces can often support opt-out consent for ordinary, non-sensitive online behavioural advertising if notice and controls are strong.
• Sensitive data, unexpected third-party sharing, health information, location tracking, and high-risk profiling should move to express opt-in.

This guide maps each Canadian province and territory to the practical cookie-banner requirement a website team should consider in 2026.

Supportive: Canada's framework is less prescriptive than the EU in many situations, which gives businesses room to design a usable consent experience.

Cynical: Flexible consent rules are only flexible if you understand the context. If you do not, they become a compliance guessing game.

Quick Answer

For a normal commercial website using analytics and advertising cookies:

The phrase "can be appropriate" is doing real work here. It is not a blanket permission to track first and explain later.

The Federal Baseline: PIPEDA

PIPEDA is Canada's federal private-sector privacy law. The Office of the Privacy Commissioner of Canada says PIPEDA generally applies to private-sector organizations conducting business in Manitoba, New Brunswick, Newfoundland and Labrador, the Northwest Territories, Nova Scotia, Nunavut, Ontario, Prince Edward Island, Saskatchewan, and Yukon. It also applies to federally regulated organizations, and to personal information that crosses provincial or national borders.

PIPEDA requires knowledge and consent for the collection, use, or disclosure of personal information unless an exception applies. The statute also says consent is only valid if it is reasonable to expect that the person would understand the nature, purpose, and consequences of the collection, use, or disclosure.

For cookie banners, PIPEDA matters because online identifiers can be personal information. The OPC's online behavioural advertising guidance says tracking and targeting information will generally constitute personal information where there is a serious possibility the information could be linked to an individual.

PIPEDA Banner Requirements

When PIPEDA Allows Opt-Out

The OPC's online behavioural advertising guidance says opt-out consent can be reasonable when all of these conditions are met:

• The purposes are clear and understandable.
• The notice is shown at or before collection.
• The user can easily opt out, ideally at or before collection.
• The opt-out takes effect immediately and persists.
• The information is limited to non-sensitive data.
• The information is destroyed quickly or effectively de-identified.

That is why a PIPEDA-oriented cookie banner should not be a decorative notice. It should include a real control.

When PIPEDA Requires Opt-In

The OPC's meaningful consent guidance says express consent is generally required when:

• The information is sensitive.
• The collection, use, or disclosure is outside the individual's reasonable expectations.
• The activity creates a meaningful residual risk of significant harm.

The Home Depot finding shows what this looks like in practice. The OPC found that Home Depot should have obtained express opt-in consent before disclosing hashed email and purchase information to Meta's Offline Conversions tool, because customers requesting an e-receipt would not reasonably expect that disclosure for advertising measurement and Meta's own business purposes.

Supportive: PIPEDA's consent model is practical when tracking is low-risk, expected, and easy to decline.

Cynical: If a vendor can reuse the data for its own targeting, do not assume the visitor "reasonably expected" it because the privacy policy was technically available.

Quebec: Law 25 And Profiling Technologies

Quebec is the major exception for cookie-banner design.

Quebec's private-sector privacy law requires businesses collecting personal information to explain the purposes, means of collection, access and rectification rights, withdrawal rights, third-party disclosures, and possible communication outside Quebec. The information must be provided in clear and simple language.

The key cookie-banner provision is section 8.1. It applies when a business collects personal information using technology that includes functions allowing the person to be identified, located, or profiled. The business must first inform the person of the use of the technology and the means available to activate those functions. The law defines profiling as collecting and using personal information to assess characteristics such as personal preferences, interests, or behaviour.

For advertising pixels, behavioural analytics, retargeting, and personalization, that points strongly toward opt-in.

Quebec Banner Requirements

Quebec also has real penalty exposure. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover for organizations, and penal fines can reach $25 million or 4% of worldwide turnover.

CookieChimp Configuration

For Quebec, target CA-QC and use opt-in for non-essential tracking.

That means advertising, retargeting, behavioural analytics, and personalization scripts should remain blocked until consent is granted. Necessary cookies can still run if they are genuinely required to deliver the requested service.

Alberta: Personal Information Protection Act

Alberta has its own general private-sector privacy law: the Personal Information Protection Act.

The Alberta law requires consent for collection, use, and disclosure unless the Act provides otherwise. It also says an organization cannot require consent beyond what is necessary to provide a product or service.

For cookie banners, the important operational rule is that Alberta permits a notice-and-decline model in some cases. An organization may collect, use, or disclose personal information for particular purposes if it provides notice in an understandable form, gives the individual a reasonable opportunity to decline or object, the individual does not object within a reasonable time, and the activity is reasonable given the sensitivity of the information.

Alberta Banner Requirements

CookieChimp Configuration

For Alberta, target CA-AB if you want province-specific copy. For ordinary non-sensitive analytics or advertising, an opt-out banner can be appropriate if it clearly explains the tracking and offers an immediate decline control.

British Columbia: Personal Information Protection Act

British Columbia's Personal Information Protection Act also requires consent for collection, use, and disclosure unless the Act authorizes or deems consent.

The BC law allows implied consent where the purpose is obvious to a reasonable person and the individual voluntarily provides the information for that purpose. It also allows an opt-out-style notice for specified purposes when the organization gives notice in understandable form, gives a reasonable opportunity to decline, the individual does not decline, and the collection, use, or disclosure is reasonable having regard to sensitivity.

BC also requires notice of purposes on or before collecting personal information, unless a specific deemed-consent provision applies.

BC Banner Requirements

CookieChimp Configuration

For British Columbia, target CA-BC if you want regional language. The practical banner can look similar to a PIPEDA opt-out banner for ordinary non-sensitive tracking, but the notice should be specific about purposes and categories.

Ontario

Ontario does not have a general private-sector privacy law that replaces PIPEDA for normal commercial websites. For most commercial sites, PIPEDA is the baseline.

Ontario does have the Personal Health Information Protection Act (PHIPA), which has been declared substantially similar to PIPEDA for health information custodians. That does not make every Ontario business a health information custodian. It matters when the organization is in the health context: clinics, hospitals, pharmacies, labs, insurers, health platforms, or service providers handling personal health information.

Ontario Banner Requirements

New Brunswick

For ordinary commercial websites, New Brunswick generally follows the PIPEDA baseline. The province also has a health-related privacy law that has been declared substantially similar to PIPEDA for personal health information custodians.

New Brunswick Banner Requirements

Newfoundland And Labrador

Newfoundland and Labrador is similar for cookie-banner purposes. Ordinary commercial sites generally use the PIPEDA baseline, while health information custodians must consider the province's health privacy law.

Newfoundland And Labrador Banner Requirements

Nova Scotia

Nova Scotia also has a health privacy law recognized as substantially similar to PIPEDA for personal health information custodians. For ordinary commercial sites, use the PIPEDA baseline.

Nova Scotia Banner Requirements

Manitoba, Saskatchewan, Prince Edward Island, And The Territories

Manitoba, Saskatchewan, Prince Edward Island, Yukon, Northwest Territories, and Nunavut do not have general private-sector privacy laws that replace PIPEDA for ordinary commercial websites. PIPEDA is the practical baseline for cookie-banner design.

Banner Requirements For These Regions

For these regions, the key work is not selecting a unique statute. The key work is designing the opt-out correctly:

• Show the notice before or at the time tracking starts.
• Explain the purposes in the banner, not only in the privacy policy.
• Provide a visible opt-out control.
• Make the opt-out immediate and persistent.
• Do not use opt-out for sensitive, unexpected, or high-risk tracking.

Supportive: This lets a website avoid unnecessary opt-in friction across large parts of Canada while still respecting meaningful consent.

Cynical: "We gave them a privacy policy link" is not the same as "we gave them a meaningful opt-out."

Health Privacy Overlay

Health privacy deserves its own warning because cookies can become sensitive quickly.

The OPC's summary of Canadian privacy laws identifies health-related privacy laws in Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia that have been declared substantially similar to PIPEDA for health information. Other provinces and territories may also have health privacy laws even if they have not been declared substantially similar in the same way.

For cookie-banner design, do not ask only whether the page is in a health province. Ask what the tracking reveals.

High-risk examples include:

• A patient portal that loads advertising pixels.
• A clinic booking page that shares identifiers with ad networks.
• A pharmacy site that retargets visitors based on medication pages.
• A fertility, mental health, addiction, genetic testing, or diagnostic service that uses behavioural analytics tied to identifiers.

In those cases, use opt-in, minimize vendors, and consider removing advertising trackers entirely from sensitive flows.

Practical Canadian Banner Matrix

Here is the implementation model most teams should start from:

If you want the lowest-risk approach, use opt-in everywhere in Canada. If you want a more tailored approach, use opt-in for Quebec and sensitive contexts, and opt-out for non-Quebec, non-sensitive online behavioural advertising where the OPC conditions are satisfied.

What Should A Canadian Cookie Banner Include?

A Canadian cookie banner should be designed for meaningful consent, not just legal appearance.

At minimum, include:

• A short explanation of why cookies or similar technologies are used.
• Separate categories for necessary, analytics, advertising, personalization, and functional cookies where relevant.
• A visible accept option.
• A visible reject or opt-out option.
• A customize or preferences path for granular control.
• A link to the privacy or cookie policy.
• A persistent way to reopen consent settings.
• Script blocking that matches the user's choice.

For Quebec, the reject and customize controls are not enough by themselves. Non-essential profiling tools should stay off until the visitor opts in.

For the rest of Canada, an opt-out banner should still be easy to use. The opt-out should not be hidden behind multiple screens, ambiguous icons, or low-contrast links.

FAQ

References

• Summary of privacy laws in Canada - Office of the Privacy Commissioner of Canada
• Personal Information Protection and Electronic Documents Act - Justice Laws Website
• Guidelines on privacy and online behavioural advertising - Office of the Privacy Commissioner of Canada
• Guidelines for obtaining meaningful consent - Office of the Privacy Commissioner of Canada
• PIPEDA Findings #2023-001: Home Depot and Meta Offline Conversions
• Quebec Act respecting the protection of personal information in the private sector
• British Columbia Personal Information Protection Act
• Alberta Personal Information Protection Act

CookieChimp supports Canadian province and territory targeting, so you can serve a Quebec opt-in banner and a tailored rest-of-Canada experience from the same consent platform. Get started with CookieChimp.