Cookie banner in Canada
Canada doesn't have a single GDPR-style law — it's two layers: PIPEDA at the federal level (reasonable consent, more flexible) and Quebec's Law 25, the strictest regime in North America, which requires non-essential cookies to be off by default until the visitor decides.
Last updated:
What Quebec's Law 25 requires
- Tracking and profiling cookies off by default (real opt-in, not just a notice).
- Consent expires after 6 months; it must be requested again.
- Administrative fines up to CAD $10M or 2% of global turnover, and penal fines up to CAD $25M or 4%.
PIPEDA (rest of Canada)
Outside Quebec, PIPEDA requires "meaningful" consent to collect personal data, including tracking. It's more flexible than Law 25 (implied consent is allowed in more cases), but a banner with real opt-in satisfies both laws at once without needing to differentiate by province.
Cookie banner by platform
Alternatives to other CMPs
This guide is informational and not legal advice. For specific questions, consult a professional.