How PIPEDA and Quebec's Law 25 split platform privacy duties for Canadians

What to take away

Where PIPEDA stops and Quebec's Law 25 begins

PIPEDA governs how private-sector organizations collect, use and disclose personal information in the course of commercial activity. It applies to platforms operating in Canada, including those based outside the country that target Canadian users. The federal privacy laws in Canada framework explains how it sits alongside provincial statutes.

Quebec's Law 25, formally the Act to modernize legislative provisions as regards the protection of personal information, amends the Act respecting the protection of personal information in the private sector. It has applied in stages: new rules on communicating personal information without consent from September 2022, the new consent rules and the privacy impact assessment required before communicating personal information outside Quebec from September 2023, and the right to data portability from 22 September 2024. For platforms, the practical effect is that Quebec residents get rights and protections that go beyond the federal baseline.

PIPEDA is principle-based and technology-neutral. It does not prescribe consent forms or retention schedules. Law 25 is more prescriptive: it names privacy officers, sets breach timelines and creates a right to data portability and de-indexing.

Constitutional division of power explains the split. Quebec can legislate on property and civil rights within the province, and it has done so for private-sector privacy. PIPEDA covers the residual federal space, including interprovincial and international commercial activity.

The OPC has recognized Quebec's law as substantially similar to PIPEDA in some respects, which affects how complaints flow. Where a matter is purely within Quebec, the provincial regulator takes the lead. Cross-border platforms can face both.

For a platform manager, the operating question is simple: does your service touch people in Quebec? If yes, Law 25 applies to that data regardless of where your servers sit. The Justice Laws Website is the place to pull the actual statutory text for PIPEDA, rather than relying on summaries.

Quebec's justice ministry publishes the civil status and legal context behind these reforms. The Quebec justice and civil status pages are useful when you need to cite the legal basis for Law 25 duties in a compliance memo.

The substantial similarity question

Substantial similarity findings let provinces handle their own private-sector complaints. Quebec's regime has been treated as substantially similar for certain purposes, but Law 25's newer obligations, penalties and portability rights go further than PIPEDA.

That means a platform cannot assume that complying with PIPEDA satisfies Quebec. The stricter rule wins for Quebec residents. Build to Law 25 and you generally clear PIPEDA; build to PIPEDA alone and you likely fall short in Quebec.

Consent rules compared: express, implied and the Law 25 upgrade

PIPEDA allows consent to be express or implied where the context makes it reasonable. A user who signs up for a newsletter and then receives related product updates is the classic implied-consent example. The OPC's privacy for businesses guidance sets out how to assess whether implied consent is appropriate.

Law 25 narrows that room. It requires consent to be clear, free and informed, and it demands that requests be presented separately from other information. Bundled consent in a long terms-of-service document does not meet the standard.

Purpose specificity is the sharpest difference. Under Law 25, a platform must state the specific purpose for each collection, and it cannot repurpose data for a new use without fresh consent, subject to narrow exceptions.

Dark patterns are a live risk under both regimes, but Law 25 gives the Quebec regulator explicit grounds to act. Consent screens that make refusal hard, or that pre-tick boxes, invite scrutiny.

For minors, Law 25 sets a higher bar. Platforms that knowingly collect data from users under 14 in Quebec need parental or guardian consent, and the threshold for what counts as a minor's data is broad.

Consent withdrawal must be as simple as giving consent. If a user can subscribe in one tap, they should be able to unsubscribe in one tap. Building that into the product early is cheaper than retrofitting it after a complaint.

Practical consent design

A Social Media Giveaway in Canada that collects entrant data is a consent event, not just a marketing tactic. The entry form needs its own purpose statement and a clear opt-in for any follow-up marketing.

Breach reporting duties under PIPEDA and Law 25

PIPEDA requires organizations to report breaches of security safeguards involving personal information to the OPC when there is a real risk of significant harm. They must also notify affected individuals and keep records of every breach, not only the reportable ones.

The real risk of significant harm test considers sensitivity of the data, the probability of misuse and whether the information could lead to identity theft, financial loss, humiliation or reputational damage. A breach of login credentials plus payment data usually crosses the threshold.

Law 25 uses a different trigger. It requires notification to the CAI and to affected individuals when a breach presents a risk of serious injury. The Quebec regulator must be notified with reasonable promptness.

Record-keeping is mandatory under both. Under PIPEDA, the Breach of Security Safeguards Regulations require an organization to maintain a record of every breach of security safeguards for 24 months after the day it determines that the breach occurred. The OPC can ask to see those breach logs, so a platform that reports only the serious incidents but keeps no log of the minor ones is exposed. Under Law 25, organizations must also keep a register of confidentiality incidents and send it to the CAI on request.

Timelines matter. PIPEDA does not set a fixed hour count, but the expectation is prompt reporting once you determine the threshold is met. Delay during an active incident is the fastest route to an adverse finding.

Third-party processors complicate the picture. If your cloud provider or ad partner suffers a breach affecting your users' data, you still carry the reporting duty. Contracts need clauses that require notification to you within hours, not days.

Breach response steps

A platform that mishandles a breach response can expect a complaint. Readers dealing with a platform that has exposed their data can File a Complaint with the relevant regulator.

Powers of the OPC and the Quebec privacy regulator

The OPC investigates complaints, audits organizations and publishes findings. It can also pursue matters in Federal Court to enforce compliance, but it does not issue binding orders directly in the way a tribunal does.

The OPC's published actions and decisions show how it has handled platform complaints, including cases about consent, retention and disclosure to third parties. Reading them is the cheapest way to anticipate how a similar complaint would be assessed.

Quebec's regulator has sharper teeth. The CAI can issue orders, impose administrative monetary penalties and, in serious cases, refer matters for penal prosecution. The CAI's overview of the main Law 25 changes gives the scale: administrative monetary penalties could reach 2% of worldwide turnover or $10 million. After a failure that could draw such a penalty, a business can instead undertake to the CAI to take the measures needed to remedy it or mitigate its consequences.

Law 25 also creates a private right of action in limited circumstances, which raises the litigation risk for platforms that ignore consent or breach duties. Class actions in Quebec are procedurally easier to launch than in most provinces.

The OPC and the Quebec regulator cooperate on cross-border matters through formal agreements. A single incident affecting users in several provinces can draw parallel inquiries, so a coordinated response is better than answering each regulator separately.

For platforms, the practical asymmetry is this: the OPC is more likely to negotiate a fix, while the Quebec regulator is more likely to order one and attach a penalty. Budget legal resources accordingly.

What platform privacy obligations mean for data handling in practice

Data mapping is the foundation. You cannot meet purpose-specific consent or retention limits if you do not know what you collect, where it sits and how long you keep it. Most platform compliance failures trace back to an incomplete map.

Retention limits are explicit under Law 25. Personal information must be destroyed or anonymized once the purpose is fulfilled, unless a law requires retention. A platform that keeps dormant account data indefinitely for no stated purpose is non-compliant in Quebec.

Access and correction rights must be honoured within set timeframes. Under section 8(3) of PIPEDA, an organization must respond to an access request with due diligence and not later than thirty days after receipt; section 8(4) allows an extension of a maximum of thirty days in defined cases, with a notice to the individual. Quebec's private-sector act sets its own response clock, so a single national process should be built to whichever clock is shorter for each kind of request.

Data portability and de-indexing are Law 25 additions. Users can request their data in a structured, commonly used format, and in some cases ask that links to their information be de-indexed. Platforms need a technical path to fulfil both.

Privacy impact assessments are mandatory for certain projects under Law 25, including transfers outside Quebec and new systems that involve personal information. Build the assessment into product planning, not launch week.

Transfers outside Quebec require an assessment that the data will receive adequate protection. For a platform using US or EU infrastructure, that means documenting the legal regime and contractual safeguards for Quebec user data.

Automated decision-making gets its own duty. Law 25 requires that individuals be told when a decision is based exclusively on automated processing, and be given a chance to submit observations. Recommendation and moderation systems can fall within scope.

Worked example: a Toronto platform with Quebec users

A Toronto-based social platform stores account data in Ontario, uses a US analytics vendor and serves users across Canada. Under PIPEDA, it needs a privacy policy, consent for collection, breach reporting to the OPC and a breach log.

For its Quebec users, the same platform faces extra duties. It must designate a privacy officer, get express consent for analytics and advertising, assess the US transfer, honour access requests on the Quebec clock and report breaches to the provincial regulator.

One codebase, two rulebooks. The simplest fix is to apply the Law 25 standard to all Canadian users, since it satisfies PIPEDA in most respects and removes the risk of a Quebec user receiving the weaker flow.

Content regulation overlaps with privacy. The Online News Act affects how platforms deal with news content and publishers, and the data involved in those arrangements is still personal information subject to PIPEDA and Law 25.

Account deletion requests are a privacy event. When a user asks to Delete a Social Media Account, the platform must destroy or anonymize the data within the applicable retention rules, not simply deactivate the profile.

Sector-specific and provincial privacy laws that overlap

Several provinces have private-sector privacy laws that the OPC has deemed substantially similar to PIPEDA. Alberta's Personal Information Protection Act, British Columbia's Personal Information Protection Act and Quebec's private-sector law are the main examples.

Where a substantially similar provincial law applies, it governs intra-provincial activity, and PIPEDA covers the rest. A platform with users in Alberta or British Columbia may therefore face a provincial regulator rather than the OPC for purely local matters.

Health information has its own statutes in Ontario, British Columbia, Alberta and other provinces, such as Ontario's Personal Health Information Protection Act and Alberta's Health Information Act. A platform that touches health data, even through a wellness feature, may fall under a health privacy law with stricter rules and different regulators.

Manitoba, Saskatchewan, Newfoundland and Labrador and Nova Scotia have their own public-sector or health privacy laws. They rarely govern a private platform directly, but they matter when a platform contracts with a provincial government or health authority.

Employment data is a separate track. Employee information collected by a platform's Canadian operation may fall under provincial employment privacy rules rather than PIPEDA, depending on the province.

Child-focused services face additional scrutiny across all provinces. Quebec's heightened minor protections plus the OPC's focus on children's privacy mean age assurance and parental consent are now standard expectations, not optional features.

Sector regulators add another layer. The CRTC oversees telecommunications and certain online content rules, and the Competition Bureau Canada examines deceptive marketing practices that can include misleading privacy claims.

How the layers stack

When two laws apply, the stricter requirement usually governs in practice. Build the control once and document which law drives it, so an auditor can follow the reasoning.

Compliance checklist for platforms operating in multiple provinces

Use this as a working list. Items that touch Quebec are the ones most often missed by platforms built to a federal-only model.

Review the list each quarter. Law 25 guidance and OPC findings continue to develop, and a control that passed last year may not pass now.

What a platform's catalog entry should show

The same split is what a reader checks when comparing platforms in a directory. Each of these can be read from the platform's own privacy policy and help pages, without asking anyone:

A platform that answers all five in its own documents is easier to hold to its obligations than one that answers none.

Common questions