PIPEDA and website tracking: cookies, pixels and consent

PIPEDA allows Canadian websites to use opt-out consent for some advertising tracking, but only when visitors are clearly informed at or before collection, can easily decline, and the data is not sensitive. Everything else, from sensitive data to tracking that people would not reasonably expect, needs express consent. The Personal Information Protection and Electronic Documents Act (PIPEDA) is the federal privacy law for the private sector in Canada.

This guide explains what PIPEDA means for cookies, pixels and analytics, what the Office of the Privacy Commissioner of Canada (OPC) expects for online behavioural advertising, and how to set up Google Tag Manager accordingly. This article is not legal advice.

Who has to follow PIPEDA?

PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activities. Quebec, Alberta and British Columbia have their own private-sector laws that are considered substantially similar, so within those provinces their rules generally apply instead. PIPEDA still covers personal information that crosses provincial or national borders, which is common for websites that use US-based analytics and advertising platforms.

For tracking, personal information is broader than names and email addresses. The OPC considers that information collected for online behavioural advertising, such as cookie IDs combined with browsing behavior, will generally be personal information. That puts most marketing tags within PIPEDA's scope.

What does meaningful consent mean for tracking?

Meaningful consent under PIPEDA means people understand what they agree to before or when their data is collected. The OPC's guidelines for obtaining meaningful consent ask organizations to emphasize the key elements: what personal information is collected, for which purposes, with which parties it is shared, and what risks of harm exist. Burying this in a long policy is not enough.

The form of consent depends on the sensitivity of the information and on the reasonable expectations of the person. Implied consent can be acceptable for non-sensitive information used in ways people expect. Express consent is generally required when the information is sensitive, when the use is outside reasonable expectations, or when there is a meaningful risk of significant harm.

For a website notice, this translates into a few concrete lines rather than legal text: we use analytics to measure how the site is used, we use advertising tools from named platforms to show you ads on other sites, here is how to turn advertising off. The notice should appear on the first page a visitor sees, in the language of the site, and the choice should be available again later, for example through a link in the footer.

→ Cookie banner with Consent Mode v2: compliant, with no monthly license

When is opt-out consent acceptable for ad tracking?

The OPC's policy position on online behavioural advertising accepts opt-out consent as reasonable when several conditions are met together. If even one is missing, a site should not rely on opt-out consent for advertising pixels and remarketing.

• Visitors are told about the tracking and its purposes in a clear and obvious way, not only deep in a privacy policy
• Information is given at or before the time of collection, including the parties involved
• Visitors can opt out easily, ideally at or before collection
• The opt-out takes effect immediately and persists
• Collection is limited as far as practicable to non-sensitive information
• Information is destroyed or effectively de-identified as soon as possible

The OPC also says organizations should avoid tracking children and tracking on websites aimed at children, and should not use techniques that visitors cannot decline, such as device fingerprinting or cookies that recreate themselves after deletion.

How to set up Google Tag Manager for PIPEDA

Google Tag Manager can follow PIPEDA with Google Consent Mode and a clear opt-out. For visitors in Canada outside Quebec, a common setup starts with analytics granted and advertising granted, shows a visible notice with an easy way to decline advertising, and updates ad_storage, ad_user_data and ad_personalization to denied as soon as the visitor declines. For Quebec, set a separate default for the region CA-QC with advertising denied, because Quebec Law 25 is stricter.

The opt-out must stick. Store the choice in a first-party cookie or local storage and read it on every page before tags fire. Tags from Meta, TikTok and LinkedIn need triggers that check the same state. A typical case: a Toronto software company showed a notice with an opt-out link, but the link only opened the privacy policy. Visitors could read about opting out, but no tag ever changed its behavior.

→ Setting up Google Consent Mode v2 correctly: no warning in Tag Assistant

Privacy policy, accountability and records

PIPEDA's first principle is accountability: the organization remains responsible for personal information it transfers to service providers, including analytics and advertising platforms. In practice this means knowing which tags run on the site, what each one receives and under which terms. A short tag inventory, reviewed whenever someone adds a plugin or a pixel, is the simplest way to stay on top of it.

The privacy policy should match that inventory. Name the categories of tools, the purposes, the fact that some providers process data outside Canada, and how visitors can opt out. Keep the opt-out instructions short and link them directly from the notice on the page. If a visitor complains to the OPC, a consistent policy, a working opt-out and a documented tag list are what you will want to show.

Find out what your site loads today

A quick look at the real behavior of your site is the best starting point. The free Trackum check at trackum.app/check opens your homepage three times in a real browser, with the banner unanswered, refused and accepted, plus two subpages, and shows which tags and cookies load in each state, without sign-up. For a clean setup, Trackum installs Google Tag Manager, GA4 and Consent Mode v2 at a fixed €150 one-time, tested with and without consent and live within one business day. Prices plus VAT.