Privacy policy, cookies and CASL: what Canadian sites need

A Canadian small business website needs three things: a privacy policy if it collects any personal information (even a name and email through a contact form), a clear cookie notice with a choice if it uses analytics or ad tracking, and CASL-compliant consent before you send marketing emails or texts. Those are the privacy policy requirements Canada small business owners run into most, and they apply whether your site is one page or fifty.

The rest of this post explains each piece in plain language. It is not legal advice, and if your business handles sensitive information, talk to a lawyer.

Which privacy law applies to a small business website?

For most private-sector businesses in Canada, the federal law is PIPEDA, the Personal Information Protection and Electronic Documents Act. It applies to personal information collected in the course of commercial activity. The Office of the Privacy Commissioner of Canada explains who it covers and what it expects.

Some provinces, including Quebec, British Columbia and Alberta, have their own private-sector privacy laws. If you do business in those provinces, check how they apply to you. Quebec's rules in particular are stricter than the federal baseline.

What should a privacy policy actually say?

Keep it specific to what your site does. A good small-business privacy policy covers:

• What you collect. Names, emails, phone numbers, messages, order details, analytics data.
• Why you collect it. To reply to enquiries, fulfil orders, send invoices, improve the site.
• Who else sees it. Your hosting provider, email service, payment processor, analytics or ad platforms.
• How long you keep it and how it is protected.
• How someone can see, correct or ask you to delete their information.
• Who to contact with privacy questions, with a real email address.

A copied template that mentions services you don't use, or misses ones you do, is worse than a short, accurate one. If your site runs Meta ads tracking or Google Analytics, say so.

Does a Canadian website need a cookie banner?

Canada doesn't have a dedicated cookie law the way the EU does. But PIPEDA is built on meaningful consent, and tracking tools like analytics and ad pixels collect information about visitors. A clear banner that explains what is being tracked and lets people choose is the straightforward way to handle that.

It also matters if you have visitors from Quebec or from outside Canada, where consent rules for tracking are tighter. A banner that works properly covers you in more places at once.

What a cookie banner should do:

• Explain in a sentence what the site tracks and why.
• Link to the privacy policy.
• Let visitors accept or decline non-essential tracking.
• Actually respect the choice, so declined tracking doesn't load.

That last point is where many sites fall down. A banner that says "decline" but loads the tracking anyway is decoration, not consent.

What does CASL cover?

CASL, Canada's anti-spam legislation, covers commercial electronic messages: marketing emails, promotional texts and similar messages sent to an electronic address. The CRTC's CASL guidance is the official reference.

The core rules are simple to state:

• Consent. You need permission to send commercial messages. Express consent is someone actively opting in. Implied consent can come from an existing business relationship, but it expires after a set period.
• Identification. Each message says who it is from and how to reach you.
• Unsubscribe. Each message includes a working way to opt out, and opt-outs are honoured promptly.

A pre-ticked "send me offers" box doesn't count as express consent. Neither does buying an email list.

Does someone contacting you mean you can market to them?

Not automatically. A customer who fills in your quote form has asked for a reply about their enquiry. Replying is fine. Adding them to a monthly newsletter is a different purpose, and under CASL it needs its own consent.

The cleanest fix is an unticked checkbox on your form: "Send me occasional updates and offers." Then keep a record of who ticked it and when.

A short compliance check for your site

• Is there a privacy policy linked in the footer, and does it match what the site actually uses?
• Does the cookie banner block tracking until someone accepts?
• Do your forms separate "reply to my enquiry" from "send me marketing"?
• Does every marketing email include your business details and an unsubscribe link?
• Do you know where form submissions are stored and who can see them?

If you can answer yes to all five, you are in better shape than most small business sites.

Where Papaya fits

A privacy policy, terms and conditions and a cookie consent banner are on our 20-item launch checklist, so every site we build goes live with them in place. If your current site is missing any of these, our website services page covers rebuilds for businesses across Ontario, with fixed prices on pricing, or you can ask us to check your site.

Common questions

Does a small business website in Canada need a privacy policy?

If the site collects personal information, such as names, emails or phone numbers through a form, then yes, in practice it should have one. PIPEDA expects businesses to be open about what they collect and why.

Is a cookie banner legally required in Canada?

Canada has no cookie-specific law like the EU, but PIPEDA requires meaningful consent and some provinces have stricter rules. A banner that lets visitors accept or decline tracking is the practical way to meet that.

Can I add website enquiries to my email newsletter?

Not without separate consent. Under CASL, replying to an enquiry is fine, but sending marketing messages needs permission, so use an unticked opt-in checkbox and keep a record of who agreed.