Do I need a privacy policy on my website in Canada?

Which laws apply

PIPEDA is the federal privacy law for private-sector organizations collecting personal information in the course of commercial activity. Alberta, British Columbia and Quebec have their own private-sector privacy laws that apply instead within those provinces in many cases. Alberta’s is the Personal Information Protection Act, which expects reasonable policies and practices and written information about them on request. Quebec’s law was significantly strengthened by Law 25, which requires businesses collecting personal information by technological means to publish a confidentiality policy in clear terms on their website.

All of them share a principle: be open about what you collect, why, and how people can access or correct it. A website privacy policy is the usual practical way to do that.

What your website probably collects

• Names, emails and phone numbers from contact or booking forms.
• IP addresses and behaviour data through analytics.
• Cookies from embedded maps, videos, chat tools or ad pixels.
• Email addresses for newsletters, which also bring in CASL consent rules.

Many third-party tools, including Google Analytics, also require in their own terms that you disclose their use.

What a privacy policy should cover

In plain language: what you collect, why, which third parties receive it (your form provider, analytics, email platform), how long you keep it, where it’s stored, how people can ask to see or delete their information, and who to contact. A named contact person is expected under several of these laws.

Write it to match what your site actually does. A generic policy copied from another business can describe tools you don’t use and miss the ones you do.

Cookies and consent

If you use analytics or advertising cookies, think about cookie consent. Canada has no standalone cookie law like the EU’s; tracking that collects personal information falls under the general consent rules in privacy law. Quebec’s Law 25 adds rules for technology that can identify, locate or profile people, and how banners should work there is still debated. A simple approach is to keep tracking light, use only what you’ll actually look at, and be clear about it.

This is general information, not legal advice. For anything beyond a simple brochure site, or if you handle health or financial information, check with a privacy lawyer.

Every site I launch has a privacy page that lists the actual tools in use: the form handler, analytics and hosting. I keep tracking minimal by default, partly for privacy and partly because many small businesses only ever look at a few numbers anyway.

For clinics, financial firms or anyone serving Quebec, I’d have a lawyer review the policy. It’s a small cost for peace of mind.