Website privacy policy in Canada: what small businesses must include

If your website has a contact form, you are collecting personal information, and Canadian privacy law expects you to explain what you do with it. That is the short answer to whether you need a website privacy policy in Canada. The longer answer depends on where you operate and who you serve. Most private businesses in Alberta answer to Alberta's own law, PIPA, rather than the federal PIPEDA, and Quebec has stricter rules that reach anyone doing business there.

Below: which law applies to you, the website features that create obligations, a section-by-section outline for a policy that matches your actual site, what Canadian law says about cookie banners, and where privacy reform stands in October 2026. We build websites; we are not lawyers. This is general information, not legal advice, so check anything important against the regulators' guidance linked throughout.

Does a small business website in Canada need a privacy policy?

Neither PIPA nor PIPEDA contains a sentence saying "every website must publish a privacy policy." What they do say adds up to the same thing. Alberta's Personal Information Protection Act requires an organization to "develop and follow policies and practices" that meet its obligations and to make written information about them available on request (section 6). It also requires you to tell people, before or at the time you collect their information, why you are collecting it and who can answer their questions (section 13). The federal openness principle says your practices must be clear and "readily available". A page on your website meets all of that at once. Quebec skips the inference and requires the page.

So the real question is whether your site collects personal information. A contact form does. So do quote requests with job addresses and photos, booking widgets, newsletter signups, analytics cookies, embedded maps and videos (which receive each visitor's IP address), and your host's server logs. Even a five-page site for a roofer in Airdrie usually has three or four of these.

Which privacy law covers your website: PIPA, PIPEDA or Law 25

Canada has a federal private sector privacy law, PIPEDA, and three provinces with laws treated as substantially similar: Alberta, British Columbia and Quebec. The Office of the Privacy Commissioner of Canada says organizations covered by those provincial laws "are generally exempt from PIPEDA" for collection, use and disclosure within the province. Everywhere else, PIPEDA is the private sector law. Clinics and other regulated health providers may also have health-specific rules, so check with your college too.

Alberta: PIPA is the law most of you answer to

PIPA applies to "every organization," which includes corporations, partnerships, unincorporated associations and "an individual acting in a commercial capacity," so a sole proprietor counts. Non-profits incorporated under the Societies Act are mostly outside it, but section 56 brings them back in for information handled in connection with a commercial activity, such as selling membership or donor lists.

The sections that shape a website:

• Section 5(3): designate at least one person responsible for compliance. On a small team that is usually the owner.
• Section 6(2): if a service provider outside Canada collects, uses, discloses or stores personal information for you, your policies must name the countries and the purposes.
• Sections 13 and 13.1: at or before collection, tell people the purpose and who can answer questions, including questions about providers outside Canada.
• Section 35: keep personal information only as long as you reasonably need it for legal or business purposes.
• Section 34.1: notify the Information and Privacy Commissioner "without unreasonable delay" of a breach that creates a real risk of significant harm. Our website security guide covers the prevention side.

Section 6(2) is the one most Alberta policies miss. Your form service, email platform, booking tool and analytics provider may well process data in the United States, and PIPA expects your policy to say so and why. Our small business hosting guide covers the hosting side.

Under section 59, offences carry fines of up to $10,000 for an individual and $100,000 for an organization, though the more likely cost for a small business is the time spent answering a complaint.

PIPEDA: when the federal law applies anyway

The OPC says federally regulated organizations, such as banks, airlines and telecom companies, are "always subject to PIPEDA." So is any business whose personal information crosses provincial or national borders in commercial activity, "regardless of the province or territory in which they are based."

So a Calgary company with BC customers and a US-based email platform has both laws touching its website. They ask for broadly the same things, so write one policy that satisfies both. PIPEDA's openness principle sets the federal floor: publish the name or title and contact details of the person accountable for privacy, how people can access their information, how to complain, and what you disclose to other organizations and why.

Quebec's Law 25: if you do business in Quebec

Quebec rewrote its private sector privacy law through Law 25, passed in 2021, with the changes phased in over the following years. Section 8.2 of the Act now says anyone collecting personal information through technological means must publish a policy on their website "drafted in clear and simple language." The Commission d'accès à l'information confirms this has applied since September 22, 2023, and gives an email address, a website and an app as examples. Section 3.1 adds that the title and contact details of the person in charge of privacy must be on your website.

Section 8.1 covers technology that can identify, locate or profile someone: you must tell people you use it and how to turn those functions on, and the CAI's guide states they must be off by default. Section 9.1 requires privacy settings to default to the highest level of confidentiality, but expressly "does not apply to privacy settings for browser cookies."

The penalties are on a different scale from Alberta's: administrative penalties up to $10 million or 2 per cent of worldwide turnover, and penal fines for businesses from $15,000 up to $25 million or 4 per cent of worldwide turnover, whichever is greater.

The Act does not spell out how far it reaches into an Alberta business with a few Quebec clients. Our practical view: if you actively serve Quebec (French pages, Quebec service areas, clients there), plan as if it applies and get advice. A policy written to Quebec's standard will comfortably satisfy PIPA and PIPEDA too, and the CAI's short guide (in French) is the most practical advice on writing one we have seen from any Canadian regulator.

What triggers privacy obligations on your website

Every feature that collects or passes on information needs a line in your policy.

Embeds catch people out. An embedded Google Map or YouTube video loads from Google's servers when the page opens, so Google receives the visitor's IP address even if nobody touches the map. Keep the map; mention it.

Booking tools are the other blind spot. The widget belongs to a separate company that now holds your customers' names and notes about why they are booking, which for a physiotherapy clinic or a family lawyer can be sensitive. Name the tool, and ask whether you need a free-text "reason" field at all. Collecting less is the cheapest privacy measure there is, a point we also make in our contact form best practices.

Email marketing also has its own law, Canada's Anti-Spam Legislation, which governs consent for commercial emails and texts. Your privacy policy explains how you use signup data. It does not replace CASL consent.

How to write a website privacy policy for Canada, section by section

Write the inventory before you write a word, the same way our website launch checklist does before go-live. List every form, every script in the site header, every embed and every tool that sends email for you, then ask whoever maintains the site to confirm it, because plugins and tag managers add scripts nobody remembers installing. The policy is only as accurate as that list.

Then write these sections, in roughly the order a reader looks for them.

Section 5 deserves the most care. Our own privacy policy uses a four-column table for it: the service, what it does for us, what it receives and where it is. Our site uses Cal.com for bookings, Resend to deliver form emails and Cloudflare Turnstile to filter spam, and all three are listed. It is the most useful part of the page and the part that goes stale fastest, because every new tool should add a row.

For section 7, pick real numbers. "We keep enquiries for up to two years unless you become a client" is a commitment someone can check. "As long as necessary" says nothing.

Put a short notice at the form as well

PIPA's notice applies "before or at the time" of collection, and a footer link is not really at the time. There is a nuance: section 13(4) exempts information someone volunteers for an obvious purpose under section 8(2), which arguably covers a plain "contact us" form. Don't lean on it. Section 13.1, the notice about providers outside Canada, has no such carve-out, and one line under the submit button costs nothing:

We use these details only to reply to your enquiry. Our form provider stores them in the United States. Questions? Contact [name or title] or read our privacy policy.

Keep it short. One line scares nobody off; a grey block of legal text above the button might.

Mistakes that make a policy worse than useless

• A copied US or European template. Sections on California residents or "lawful bases for processing," and nothing about PIPA, tell a reader the owner never read it.
• "We never share your information with third parties" on a site running analytics, a pixel and a booking widget. Using service providers is normal; claiming you don't is a false statement on your own website.
• No named contact. All three laws expect a name or title people can reach.
• A "last updated" date from two redesigns ago, missing the chat widget you added last spring.

If you handle health, financial or children's information, run targeted ads at scale, or serve Quebec, a lawyer's review is money well spent. For a five-page trades site with a form and analytics, a careful policy written from the outline above is a reasonable start.

Cookie banners in Canada: do you need one?

No Canadian statute says "show a cookie banner." What Canada does have is consent rules, and they decide whether a banner makes sense for you.

The OPC's guidelines on online behavioural advertising accept opt-out consent for ad tracking only when people are told the purposes clearly at or before collection (purposes that "cannot be buried in a privacy policy"), opting out is easy, immediate and lasting, the information is limited where practicable to non-sensitive data, and it is destroyed or de-identified as soon as possible. The OPC also says not to use tracking people cannot decline, such as device fingerprinting, and to avoid tracking children. Quebec goes further: as covered above, profiling and tracking functions stay off until the visitor turns them on.

Here is how we would decide:

• Basic analytics, mostly Alberta visitors. Explain the analytics cookies in your policy and link to an opt-out, or use a cookieless analytics tool and skip the question. A banner is optional.
• Advertising pixels or remarketing. Show a short first-visit notice that says you use cookies for advertising and offers a one-click opt-out. A line in the policy alone does not meet the OPC's test.
• Visitors or clients in Quebec. Use a real consent banner where "Reject" is as easy as "Accept," and hold advertising and profiling tags until someone accepts.

What not to do: a banner that says "by using this site you agree to cookies" while every script loads anyway. You get the annoyance of a pop-up and none of the protection.

Federal privacy reform: where things stand in October 2026

You may have read that PIPEDA was being replaced by a Consumer Privacy Protection Act. That was Bill C-27, tabled June 16, 2022 and bundled with a tribunal and an artificial intelligence act. It went to the House industry committee on April 24, 2023 and was still there when the parliamentary session ended on January 6, 2025. Bills that have not passed die with the session, so C-27 never became law.

On June 15, 2026, the government tabled Bill C-36, the Protecting Privacy and Consumer Data Act, a narrower bill that would replace Part 1 of PIPEDA. As of late October 2026, LEGISinfo lists it at second reading in the House of Commons, with no committee study yet.

Alberta is reviewing PIPA as well. The province ran an online survey on possible updates from February 2 to 17, 2026, with meetings with the Information and Privacy Commissioner planned for the spring. No amending bill has been introduced as of this writing.

So what should you do about it? Nothing different. PIPEDA and PIPA are the law today, and a policy that is specific, honest and current is what they, Quebec and every reform bill so far have asked for. We would be surprised if the next law asked for less transparency.