Cookie Consent Requirements in Canada: Website Guide 2026

Quick links

PIPEDA Compliance Guide CASL Compliance Guide Quebec Law 25 Guide Free compliance check

Cookie consent in Canada exists in a unique legal grey area. While Canada doesn't have a GDPR-style cookie law, the combination of PIPEDA, Law 25, and CASL creates substantial obligations for Canadian websites.

The Canadian Cookie Compliance Landscape

Why Cookie Consent Matters in Canada

Unlike the EU's ePrivacy Directive, Canada has no standalone cookie law. However, cookies that collect personal information fall under:

PIPEDA — Cookies that identify individuals require consent
Quebec Law 25 — Specific rules for technologies that can identify, locate or profile individuals
CASL — Installing computer programs on users' devices in the course of commercial activity

The CPPA, proposed in Bill C-27, is not on this list: Bill C-27 died in January 2025 and never became law.

CASL and Cookies

CASL's "installation of computer programs" provision (Section 8) prohibits installing a computer program on another person's computer system in the course of a commercial activity without express consent. For cookies, however, section 10(8) of CASL provides that a person is considered to expressly consent to the installation of a cookie, HTML code or JavaScript if their conduct is such that it is reasonable to believe they consent to the installation.

Cookies and scripts are covered by this deemed-consent rule where the visitor's conduct reasonably indicates consent
Other installed software (for example, downloadable programs or apps) generally needs express consent under section 8
Privacy law still applies — cookies that collect personal information remain subject to PIPEDA and Law 25

Maximum CASL Penalty: $10 million per violation (individuals: $1 million)

Types of Cookies and Consent Requirements

Strictly Necessary Cookies (No Consent Required)

Session cookies for shopping carts
Authentication cookies
Security cookies (CSRF protection)
Load balancing cookies
Cookie consent preference cookies

Functional Cookies (Implied Consent May Suffice)

Language preference cookies
Region/currency selection
User interface customization
Accessibility preferences

Analytics Cookies (Consent Required)

Google Analytics
Hotjar/session recording
A/B testing tools
Performance monitoring

Advertising/Tracking Cookies (Consent Required)

Google Ads remarketing
Facebook Pixel
LinkedIn Insight Tag
Cross-site tracking cookies
Third-party advertising cookies

Quebec Law 25 and Cookies

What Law 25 Requires

Quebec's Act respecting the protection of personal information in the private sector sets out several obligations relevant to cookies and tracking:

Tracking technologies — before collecting personal information using technology that can identify, locate or profile a person, you must inform them of its use and of the means available to activate those functions (s. 8.1). The CAI's privacy policy guide for businesses states these functions must be deactivated by default
Plain language disclosure — purposes, means of collection, and the right to withdraw consent, in clear and simple language (s. 8)
Confidentiality policy — businesses that collect personal information by technological means must publish a confidentiality policy on their website (s. 8.2)
Privacy by default — privacy settings of technological products and services must offer the highest level of confidentiality by default, although this rule does not apply to privacy settings for browser cookies (s. 9.1)
Privacy Impact Assessment — for projects to acquire, develop or overhaul an information system involving personal information (s. 3.3)

Law 25 Cookie Consent Banner Best Practices

Your banner and cookie notice should cover:

Clear identification of cookie categories
Purpose of each category
Names or categories of third parties receiving data
Option to accept or refuse each category
Link to full cookie policy
Available in French

PIPEDA Cookie Consent Standards

The OPC's Position on Cookies

The Office of the Privacy Commissioner's Guidelines on privacy and online behavioural advertising state that:

Tracking data is generally personal information: Information used for online tracking and behavioural targeting will generally constitute personal information
Knowledge and consent: Collection or use of browsing activity must be done with the person's knowledge and consent
Form of consent varies: Express (opt-in) consent is expected for sensitive information; opt-out consent for online behavioural advertising may be reasonable if individuals are clearly informed at or before collection, can easily opt out, the opt-out takes effect immediately and persists, collection is limited to non-sensitive information, and data is destroyed or de-identified as soon as possible
Choice: If individuals cannot decline tracking (for example, zombie cookies, super cookies or device fingerprinting), that technology should not be used for behavioural advertising

How to Implement Cookie Consent Correctly

Step 1: Cookie Audit

Scan your website to identify all cookies:

Tools for Cookie Auditing:

Browser developer tools (Application > Cookies)
Cookie scanning services (Cookiebot, OneTrust)
Manual inspection of third-party scripts
Network tab analysis for tracking pixels

Document for each cookie:

Cookie name
Provider (first-party or third-party)
Purpose
Category (necessary, functional, analytics, advertising)
Duration
Data collected

Step 2: Categorize Cookies

Group cookies into consent categories:

Necessary — Always active, no consent needed
Functional — Implied consent acceptable
Analytics — Consent required
Marketing — Consent required (opt-in recommended)

Step 3: Implement Consent Management Platform (CMP)

A CMP handles:

Cookie banner display
Consent collection and storage
Cookie blocking until consent is given
Consent withdrawal
Record keeping for compliance evidence

Popular CMPs for Canadian Compliance:

Cookiebot (PIPEDA + Law 25 support)
OneTrust (Enterprise, multi-jurisdiction)
Osano (Canadian-friendly)
Termly (Budget option)
Canada Compliance AI (Built for Canadian law)

Step 4: Configure Cookie Blocking

Best practice: Non-essential cookies should not fire until consent is given.

Technical implementation:

Tag Manager consent mode (Google Tag Manager)
Script blocking by category
Cookie domain restrictions
Server-side consent validation

Step 5: Design Your Cookie Banner

Best Practice Design:

Appears on first visit
Clear "Accept All" and "Reject All" buttons (equal prominence)
"Manage Preferences" option for granular control
Brief explanation of cookie categories
Link to full cookie policy
Doesn't block content (banner, not modal for first interaction)

Cookie Policy: What to Include

Required Elements

What are cookies — Brief explanation
Types of cookies used — Categorized table
Third-party cookies — Who sets them and why
How to manage cookies — Browser settings and CMP
Impact of disabling cookies — What happens if cookies are refused
Cookie retention periods — How long each cookie lasts
Updates — How changes will be communicated
Contact — Privacy officer details

Google Analytics and Canadian Privacy Law

Google Analytics 4 (GA4) Compliance

GA4 requires specific configuration for Canadian compliance:

IP anonymization — Enable (default in GA4)
Data retention — Set to minimum necessary (2 or 14 months)
Consent mode — Implement Google Consent Mode v2
Data sharing — Disable Google signals if consent not obtained
Data Processing Agreement — Execute Google's DPA
Server-side tagging — Consider for enhanced privacy

Consent Mode v2 Configuration

Google Consent Mode allows GA4 to respect user consent:

analytics_storage: Controls analytics cookies
ad_storage: Controls advertising cookies
ad_user_data: Controls sending user data to Google for advertising
ad_personalization: Controls personalized advertising

Default state for Canadian users: Denied (until consent given)

Mobile App Cookie Equivalents

App Tracking and Consent

Mobile apps use tracking technologies similar to cookies:

SDKs — Third-party analytics and advertising SDKs
Device identifiers — IDFA (iOS), GAID (Android)
Local storage — Similar to cookies for web

Canadian Requirements for App Tracking

Disclose all SDKs and their data practices
Obtain consent before enabling tracking SDKs
Respect iOS App Tracking Transparency
Provide in-app privacy dashboard
Allow users to reset or opt out of tracking

Frequently Asked Questions

Q: Do I need a cookie banner for a Canadian-only website? If you use analytics or advertising cookies, yes. PIPEDA requires knowledge and consent for tracking, and Law 25 requires you to inform people before using technologies that can identify, locate or profile them and of how to activate those functions.

Q: Can I use "implied consent" for all cookies in Canada? No. The OPC accepts opt-out consent for online behavioural advertising only under strict conditions, and sensitive information requires express consent. In Quebec, the CAI states that identification, location and profiling functions must be deactivated by default.

Q: What happens if I don't have a cookie banner? You risk complaints to the OPC or CAI, potential investigations, and penalties. Quebec penal fines for businesses can reach the greater of $25 million or 4% of worldwide turnover.

Q: Do strictly necessary cookies need consent in Canada? No. Cookies essential for the basic functioning of your website do not require consent.

Q: Should my cookie banner be in French? If your website targets Quebec users, yes. The Charter of the French Language requires French versions of consumer-facing notices.

Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Related Articles:

Cookie Consent Requirements Canada: Complete Guide for Websites in 2026