Does Canada require cookie consent?

Canada does not require express opt-in consent simply because a website uses cookies. The key question is whether a cookie or similar technology collects, uses, or discloses personal information and which privacy law applies.

Under PIPEDA, consent must be meaningful. Express consent is generally appropriate for sensitive information, unexpected uses, or processing that creates a meaningful risk of harm, while implied consent may be acceptable in more limited, lower-risk situations.

Quebec goes further for technologies that can identify, locate, or profile individuals. These functions must not be activated by default; users must be informed and given a way to activate them themselves.

For more detail, see the Office of the Privacy Commissioner’s PIPEDA consent guidance. A proper PIPEDA consent process should therefore reflect the purpose, sensitivity, and expected use of the data rather than treating every cookie the same way.