PIPEDA: Personal Information Protection and Electronic Documents Act (Canada)

What PIPEDA covers, and what it means for your website analytics

Official name: Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5. Phased in from 2001 and fully in force since 2004, it governs how private-sector businesses in Canada handle personal information.

See all privacy laws

At a gkance

Canada's private-sector privacy law

PIPEDA is built on ten fair information principles, from accountability to openness. In most cases, businesses need meaningful consent to collect, use or share personal information, and people can access and correct what's held about them.

Who it covers

Private-sector firms handling personal data in commercial activity in Canada

What it means for websites

Implied consent can work for some tracking, if clearly explained and easy to refuse

Who enforces it

The Privacy Commissioner investigates, and the Federal Court can order remedies

Maximum fines

Up to CAD 100,000 for some offenses, such as not reporting data breaches

Everything you need on this law

PIPEDA

The current text of Canada’s Personal Information Protection and Electronic Documents Act.

Read the official text

OPC guidance on PIPEDA

Canada’s privacy regulator on who PIPEDA covers, what it requires and how to comply.

Read the guidance

OPC guidelines on meaningful consent

How the Canadian regulator expects businesses to obtain consent under PIPEDA.

Read the guidelines

More privacy laws

Guides to 14 more laws, from the GDPR to the CCPA, and what each one asks of your website.

See all privacy laws

Privacy by default

Less data, the same insights

TWIPLA’s default Maximum Privacy Mode keeps what you collect to a minimum, wherever your visitors are:

Visitors are counted with a one-way hash, the only identifier stored
Reports show trends across your audience, never one person’s page history
All data is hosted in Germany, under a Data Processing Agreement that lists every subprocessor
An optional opt-out link lets visitors switch off TWIPLA tracking entirely

Every privacy law sets its own rules. Custom Country Data lets you choose the privacy mode for visitors from each country, so you can match it to the law that applies there.

Proof, not promises

How TWIPLA respects your Canadian visitors’ privacy

Privacy modes and country settings

How to choose one of four privacy modes, and set a different one for visitors by country.

Read the guide

Visitor opt-out

Where any visitor can switch off TWIPLA tracking for themselves, at any time.

See the opt-out

What to put in your privacy policy

Ready-to-use wording for describing TWIPLA in your privacy policy.

Get the wording

Our Data Processing Agreement

The processing agreement every TWIPLA customer signs, with all subprocessors listed.

Read the agreement

Legal disclaimer

Helpful guidance, not legal advice

This page explains the law in general terms. Laws change, and how they apply depends on your business, your visitors and how you configure TWIPLA.

Unless another mode is named, statements about compliance refer to Maximum Privacy Mode, our default setting. For advice on your situation, please consult a qualified legal professional.

Questions about how TWIPLA fits this law? Email our team at consentless@twipla.com.