General information, not legal advice. Laws and how regulators read them change. Confirm your own obligations with a lawyer who practises privacy, accessibility or language law in your province.
Ask five Canadian business owners what their website needs in order to be legal and you will get five partial answers. One will say a privacy policy, another a cookie banner, another an unsubscribe link. The fourth will say “we’re hosted in Canada, so we’re covered,” and the fifth will admit they have no idea. Each of the first four covers a piece of it, but none covers the whole thing.
Canadian website compliance is not one law. The website legal requirements in Canada come from at least five regimes that overlap on a typical business site. These are federal privacy law (PIPEDA), Québec’s privacy law (Law 25), the anti-spam law (CASL), accessibility law (the AODA in Ontario, plus a newer standard in Manitoba), and Québec’s French-language rules as reshaped by Bill 96. Competition and consumer protection rules sit on top of those for anyone who sells online. Which of them bind your site depends on four things: where your customers are, where your staff are, how many people you employ, and what your website does. Where your server sits matters much less than most hosting marketing suggests, although it does matter for a few specific obligations.
Two dates make 2026 a good year to sort this out. Ontario organizations with 20 or more employees must file their next accessibility compliance report by 31 December 2026, and a senior officer signs it. Federally, Bill C-36 was tabled on 15 June 2026. It would replace PIPEDA’s privacy rules with a new statute and a new regulator, but it is not law yet, so PIPEDA remains the rulebook you are measured against today.
The short answer
– Every site that collects personal information from Canadians falls under a privacy law: PIPEDA, or the provincial equivalent in British Columbia, Alberta or Québec. That means a privacy policy, meaningful consent, reasonable security and a breach plan.
– Every site that sends promotional email or texts falls under CASL. You need consent records, sender identification, and an unsubscribe that is processed within 10 business days.
– Québec-facing sites add Law 25 (privacy officer, published policies, tracking that starts switched off, assessments before data leaves Québec) and the Charter of the French language (a French site and French online contracts).
– Ontario employers with 50 or more staff must meet WCAG 2.0 Level AA. Manitoba employers of any size must meet WCAG 2.1 Level AA for new web content.
– Hosting in Canada doesn’t make a site compliant on its own. It does shorten and simplify several of the obligations above.
The five laws at a glance
The table below is the map. The sections that follow explain each row in terms of what it means for the pages, forms and scripts on your site.
| Law | Who it binds | What it means for your website | Penalty ceiling | Regulator |
|---|---|---|---|---|
| PIPEDA | Private-sector organizations handling personal information in commercial activity. Applies everywhere except purely in-province activity in BC, Alberta and Québec, and always to data crossing provincial or national borders | Privacy policy, meaningful consent, safeguards, access requests, breach reporting and breach records | Fines up to $100,000 for knowingly failing to report or record a breach | Office of the Privacy Commissioner of Canada |
| Law 25 | Enterprises collecting personal information in Québec | Privacy officer contact on the site, published governance policies, identification and profiling functions off until the user activates them, an assessment before data leaves Québec, incident reporting | Administrative penalties up to $10 million or 2% of worldwide turnover. Penal fines up to $25 million or 4% | Commission d’accès à l’information |
| CASL | Anyone sending commercial electronic messages to or from computers in Canada | Proof of consent, sender identification, an unsubscribe processed within 10 business days | Up to $10 million per violation for a business | CRTC |
| AODA | Organizations with employees in Ontario. The web rule starts at 50 Ontario employees | WCAG 2.0 Level AA. A compliance report from 20 employees | Up to $100,000 per day for a corporation on conviction | Accessibility Directorate of Ontario |
| Charter of the French language (amended by Bill 96) | Businesses doing business in Québec | A French website and French online contracts, with the French version offered on terms at least as favourable as any other language | Fines from $3,000 to $30,000 per offence for a business, rising for repeat offences | Office québécois de la langue française |
Which laws apply to your website, province by province
Compliance obligations attach to people and activities, not to servers. Four questions decide which laws reach your site:
- Whose personal information do you collect, and where are those people? This decides which privacy law applies.
- Where do your employees work, and how many are there? This decides accessibility obligations in Ontario and Manitoba.
- Do you do business in Québec? This triggers Law 25 and the French-language rules.
- Does your site send commercial email or texts? That brings in CASL, wherever you are.
Which privacy law in Canada governs your website?
Three provinces have private-sector privacy laws that Ottawa has declared substantially similar to PIPEDA: British Columbia’s PIPA, Alberta’s PIPA and Québec’s private-sector act, which Law 25 rewrote. Inside those provinces, the provincial law governs personal information that a business collects and uses there. Everywhere else, PIPEDA applies. PIPEDA also applies across the whole country when personal information crosses a provincial or national border in the course of commercial activity, and to federally regulated businesses such as banks, airlines and telecom carriers.
In practice, most websites trigger more than one privacy law. A Vancouver online store selling across Canada handles in-province data under BC’s PIPA. Its sales to Ontario customers, and the data it sends to a US email platform, involve PIPEDA. If it sells into Québec in a meaningful way, Law 25 is also on the table.
The province-by-province matrix
| Province or territory | Private-sector privacy law | Web accessibility rule for private businesses | Language rule for business websites |
|---|---|---|---|
| British Columbia | BC PIPA (PIPEDA for cross-border and interprovincial flows) | None in force | None |
| Alberta | Alberta PIPA, including mandatory breach notice to the commissioner and notice when a service provider outside Canada is used | None in force | None |
| Saskatchewan | PIPEDA | None in force | None |
| Manitoba | PIPEDA | WCAG 2.1 Level AA for new web content since 1 May 2025, for organizations with at least one employee | None |
| Ontario | PIPEDA (PHIPA for health information custodians) | WCAG 2.0 Level AA at 50 or more Ontario employees. Compliance report at 20 or more, due 31 December 2026 | None for businesses |
| Québec | Law 25 (the amended private-sector act) | None in force for private websites | Charter of the French language: French site and French online contracts |
| New Brunswick, Nova Scotia, PEI, Newfoundland and Labrador | PIPEDA (provincial health information laws for health custodians) | None in force for private websites | None for businesses |
| Yukon, Northwest Territories, Nunavut | PIPEDA | None in force | Check territorial language law. Nunavut’s Inuit Language Protection Act includes some private-sector duties |
| Federal layer (everywhere) | PIPEDA for cross-border data and federally regulated businesses | Accessible Canada Act for federally regulated organizations | Official Languages Act binds federal institutions, not private sites |
On top of the matrix, CASL and the Competition Act apply nationally to every business website, whatever the province.
Three quick scenarios
A 12-person Ottawa web agency building sites for clients on both sides of the river. Its own site is under PIPEDA and CASL. It sits below the AODA’s 20-employee reporting line, so it has the general accessibility duties but not the WCAG requirement or the report. Its Gatineau clients’ sites are another matter: those businesses carry Law 25 and the French Charter, and the agency builds the consent banner, the French version and the privacy-officer contact block for them. In practice the agency’s own compliance is light, but the compliance it delivers to clients is heavy.
An eight-person Winnipeg online retailer. PIPEDA covers its customer data and CASL covers its newsletter. Because Manitoba’s information and communication standard applies from the first employee, its new product pages and checkout need to meet WCAG 2.1 Level AA. That is a stricter version of the standard than the AODA asks of companies six times its size in Ontario.
A Calgary SaaS company with 60 staff, none in Ontario, and a growing Québec customer base. Alberta’s PIPA governs its in-province data. PIPEDA covers data that crosses borders. Law 25 applies to its Québec customers, including the rule requiring an assessment before their data is communicated outside Québec. That rule covers Calgary too. The AODA’s web rule counts Ontario employees, so it does not catch this company, even with thousands of Ontario users.
PIPEDA: the federal baseline
PIPEDA is built on ten fair information principles that turn into a short list of website artefacts.
- A privacy policy that is actually specific. It should say what you collect, why you collect it, who you share it with, where it is processed, how long you keep it, and how someone can see or correct their information. A generic template that lists data you don’t collect fails the openness principle as surely as a missing policy.
- Consent that matches the sensitivity. Contact forms, account sign-ups and checkouts need a clear statement of purpose at the point of collection. Using information for something new, such as feeding contact-form submissions into a marketing list, needs fresh consent.
- Collection limited to what you need. A quote form that demands a date of birth “just in case” is a compliance problem and a conversion problem at the same time.
- Reasonable safeguards. HTTPS everywhere, patched software, multi-factor authentication on admin accounts, and backups you have actually tested restoring.
- A way to handle access requests, plus a named person who is accountable for privacy.
Breach reporting: no, it is not 72 hours
One of the most repeated errors on Canadian compliance pages is that PIPEDA requires breach reports within 72 hours. That is the European GDPR. PIPEDA requires you to report a breach of security safeguards to the Privacy Commissioner, and to notify affected individuals, as soon as feasible after you determine that the breach creates a real risk of significant harm. Separately, you must keep a record of every breach, including the ones below that threshold, for 24 months. Knowingly failing to report or to keep records can bring fines of up to $100,000.
For a website, “breach” includes the boring cases: a misconfigured form that emails submissions to the wrong address, a database backup left in a publicly readable folder, or a compromised admin account. The 24-month log is the part most small businesses have never started.
Cross-border data under PIPEDA
PIPEDA does not prohibit sending personal information outside Canada. It makes you accountable for it. The Privacy Commissioner expects you to use contracts to secure comparable protection from any service provider, and to tell people that their information may be processed in another country and could be accessible to that country’s authorities. That expectation is the source of the “where is my data?” paragraph every Canadian privacy policy should contain.
What Bill C-36 would change
Bill C-36, tabled on 15 June 2026, would enact the Protecting Privacy and Consumer Data Act. It would replace PIPEDA’s privacy rules and give enforcement to a new Digital Safety and Data Protection Commission of Canada. As introduced, it allows administrative penalties of up to $10 million or 3% of global revenue. It is the third attempt in six years to modernize the federal law, and it has not passed second reading. Build for PIPEDA today and for C-36’s direction of travel tomorrow: documented privacy programs, clearer consent and fewer surprises in how data is used.
Québec’s Law 25: the strictest privacy rules on your site
Law 25 rebuilt Québec’s private-sector privacy act between 2022 and 2024. For a website, it adds obligations that PIPEDA only implies or doesn’t require at all.
- A visible privacy officer. By default, the person with the highest authority in the business is the person in charge of protecting personal information. They can delegate the role in writing. The title and contact information of whoever holds it must be published on the website.
- Published governance policies. The business must publish detailed information about its policies on keeping and destroying information, staff roles and complaint handling, in clear and simple language. If you collect information through technological means, you must also publish a confidentiality policy.
- Richer notices at collection. At the point of collection, people must be told the purposes, the means of collection, their rights of access and correction, and their right to withdraw consent. Where relevant, they must also be told that their information could be communicated outside Québec.
- Tracking that waits for the user. If you use technology with functions that can identify, locate or profile a visitor, you must tell them beforehand and explain how to activate those functions. That is why Québec-facing sites have moved to banners that keep non-essential analytics and advertising tags off until the visitor opts in. Law 25’s separate “highest privacy by default” rule for product settings excludes browser cookie settings, which is a frequent source of confusion. The opt-in expectation for tracking comes from the identification and profiling rule, not the default-settings rule.
- An assessment before data leaves Québec. Before personal information is communicated outside Québec, the business must carry out a privacy impact assessment. It must weigh the information’s sensitivity, the purposes, the protection measures and the legal framework at the destination, and it must put the transfer under a written agreement. “Outside Québec” includes Ontario and British Columbia, not just other countries.
- Confidentiality incidents. If an incident presents a risk of serious injury, the Commission d’accès à l’information and the affected people must be notified promptly. Every incident goes into a register that the Commission can ask to see.
- Access within 30 days. Written access and correction requests must be answered within 30 days, and computerized data supplied by the person must be available in a structured, commonly used format on request.
Penalties are the steepest in the country. Administrative monetary penalties reach $10 million or 2% of worldwide turnover, and penal fines reach $25 million or 4%. Whether Law 25 reaches a business with no physical presence in Québec is a question for counsel. If you actively sell to Québec residents, the safe working assumption is that it applies.
CASL: every commercial message your website sends
CASL is not only an email law. It covers any commercial electronic message (email, SMS, social direct messages) that is sent to or accessed from a computer in Canada. Your website is usually where that consent is captured, so the form design is where compliance succeeds or fails.
- Consent. Express consent means the person actively agreed. An unchecked box they tick themselves is the standard pattern, and a pre-checked box is not consent. Implied consent exists only in defined situations, such as an existing business relationship. It expires two years after a purchase and six months after an inquiry.
- Proof. The burden is on you. For each address, keep a record of when consent was given, through which form, with what wording.
- Identification. Every message names the sender and gives a mailing address plus a phone number, email address or web address.
- Unsubscribe. Every message includes a free, easy unsubscribe that keeps working for at least 60 days after sending. Requests must take effect within 10 business days.
Two website-specific traps are worth flagging. The first is an auto-reply to a contact form that tacks on a promotional offer, which can turn a transactional message into a commercial one. The second is a “refer a friend” form that sends a message to someone who never consented. Penalties run up to $10 million per violation for a business.
AODA and Manitoba: accessibility is a legal requirement
Ontario’s Accessibility for Ontarians with Disabilities Act sets its web rule through the Integrated Accessibility Standards Regulation. Since 1 January 2021, private and non-profit organizations with 50 or more employees in Ontario must make their public websites, and web content published after 1 January 2012, conform to WCAG 2.0 Level AA. Live captions and pre-recorded audio descriptions are exempt. Organizations with 20 or more employees must file an accessibility compliance report every three years, and the next one is due 31 December 2026. A senior officer attests to it, so “we assume the website is fine” is not a safe basis for signing. On conviction, a corporation can face fines of up to $100,000 for each day an offence continues.
Manitoba went further in one respect. Under its Accessible Information and Communication Standard Regulation, every private business and non-profit with at least one employee in Manitoba has had to meet WCAG 2.1 Level AA for new web content and web applications since 1 May 2025. BC, Nova Scotia and Québec have accessibility statutes, but none of them currently imposes a web standard on private businesses. Federally regulated organizations have duties under the Accessible Canada Act, and Ottawa has consulted on adding specific web accessibility rules for them.
The practical answer is to build to WCAG 2.1 Level AA, and to 2.2 where you can. That satisfies Ontario and Manitoba at once and holds up as standards move. Work through the basics first: text alternatives for images, sufficient colour contrast, full keyboard operation, visible focus states, labelled form fields, captions on video and a logical heading order. Then publish an accessibility statement with a way to report barriers. An automated overlay script won’t make an inaccessible template conform, and it won’t help a senior officer sign the report with a clear conscience.
Bill 96 and the Charter of the French language
The Charter of the French language has long treated commercial publications as French-first. The Office québécois de la langue française reads that to include business websites and social media aimed at Québec customers. Bill 96 tightened the rules in three ways that matter online.
- French, and at least as favourable. A website for Québec customers must be available in French. Other languages may accompany it, but the French version must be available on terms at least as favourable. A French site that lags behind the English one, or that is missing features or recent content, does not meet that test.
- Online contracts in French first. Since 1 June 2023, contracts of adhesion, meaning standard-form terms the customer can’t negotiate (terms of service, checkout terms, subscription agreements), must be presented in French first. The parties can choose another language only after the French version has been provided.
- Trademarks and generic terms. Since 1 June 2025, a non-French trademark can stay in its original language only within the limits of the registered or recognized trademark exceptions. Generic or descriptive words built into it need to be in French.
Penal fines for businesses run from $3,000 to $30,000 per offence, and they increase for repeat offences. For a website, the practical implications are concrete: a French version that matches the English one, French checkout and account flows, French terms presented first, and a French cookie banner and privacy policy, which Law 25 already pushes you toward.
The website compliance checklist for Canada: what must be on every site
Some items apply to nearly every Canadian business website. Others switch on with your province, size or activity. This checklist separates the two.
| Item on the site | Legal source | Applies to |
|---|---|---|
| Privacy policy specific to your actual data practices | PIPEDA openness principle; provincial PIPAs; Law 25 | Every site collecting personal information |
| Privacy contact (and, for Québec, the privacy officer’s title and contact) | PIPEDA accountability; Law 25 | Every site; mandatory wording for Québec |
| Purpose statement at each form | PIPEDA consent; Law 25 | Every form collecting personal information |
| Tracking notice, with non-essential tags off until opt-in for Québec visitors | PIPEDA consent; Law 25 | Sites using analytics, advertising pixels or session recording |
| Unticked consent box and stored consent records for marketing lists | CASL | Any site with a newsletter or SMS signup |
| Sender identification and working unsubscribe in every commercial message | CASL | Any business sending marketing email or texts |
| HTTPS, patching, multi-factor authentication, tested backups | PIPEDA safeguards; Law 25 | Every site |
| Breach response plan and a 24-month breach log | PIPEDA; Law 25 incident register; Alberta PIPA | Every business holding personal information |
| Inventory of every service that receives data, with locations | PIPEDA accountability; Law 25 assessment rule; Alberta PIPA | Every site |
| Accessibility statement and WCAG Level AA conformance | AODA; Manitoba standard | Ontario 50+ employees; Manitoba any employer; best practice elsewhere |
| French version on equal terms, French terms of service first | Charter of the French language | Businesses selling into Québec |
| All-in prices that include unavoidable fees | Competition Act drip-pricing rules | Every site that displays prices |
| Clear seller identity, total cost and cancellation terms before an online sale | Provincial consumer protection acts | Online stores selling to consumers |
The drip-pricing line catches many e-commerce sites. Since June 2022, the Competition Act treats an advertised price as misleading if it can’t be obtained without paying fixed mandatory extras, such as a “service fee” added at checkout. Only government-imposed charges such as sales tax can be added later.
How hosting location factors in: web hosting in Canada and data centers in Canada
This is the question most compliance guides skip and most hosting pages overstate. Start with the claim that circulates widely: PIPEDA does not require personal information to be stored in Canada. It allows transfers to service providers anywhere, and it holds you accountable for the protection they provide. Choosing web hosting in Canada is therefore a decision that makes compliance easier, not a legal requirement in itself.
Location does carry weight in four situations.
- Québec’s assessment rule. A Québec business that hosts its site in Toronto or Vancouver is communicating personal information outside Québec, so the privacy impact assessment and written agreement apply. A Canadian destination makes that assessment much simpler, because the legal framework on the other end is PIPEDA or a substantially similar provincial law rather than a foreign regime. Only infrastructure physically inside Québec avoids the rule for that data flow.
- Alberta’s notice rule. Alberta businesses that use a service provider outside Canada must tell people so, and must say in their policies which countries are involved and for what purposes. Keeping the provider in Canada removes that line from the notice.
- Contracts and the public sector. Some provincial public-sector and health-information laws restrict where certain data can be held, and many procurement contracts require Canadian residency. If you build or host sites for those clients, the requirement flows down to you.
- Foreign legal reach. The United States’ CLOUD Act lets US authorities compel a US-jurisdiction provider to produce data in its possession, custody or control, wherever that data is stored. The legal reach follows the provider’s corporate control, not the server’s postal code. A data center in Canada run by a US-controlled company can still receive a US demand. A Canadian-owned host operating in data centers in Canada narrows that exposure. You should still ask who runs the facilities, which sub-processors are involved, and where support staff connect from.
| Question | Does hosting in Canada change the answer? |
|---|---|
| Do I need a privacy policy, consent and a breach plan? | No. These apply wherever the server is |
| Do I need foreign-transfer language and contracts for my host? | Not for the host. It removes one foreign transfer to document |
| Does a Québec business still need an assessment before data leaves Québec? | Yes, unless the infrastructure is in Québec. The assessment becomes simpler |
| Is my data beyond the reach of foreign legal demands? | It depends on the provider’s ownership and control, not location alone |
| Will Canadian visitors get faster responses? | Usually. The network path is shorter than to an overseas server |
| Does it satisfy Alberta’s notice rule for that provider? | Yes. No outside-Canada notice is needed for a provider inside Canada |
Your server is one of a dozen data destinations
“Hosted in Canada” usually describes one machine. A typical small-business site sends personal information to many more places than that. These include the web server and database, backups (often held in a different facility), the email platform, the content delivery network, analytics, form processors, the payment gateway, the live-chat widget, the CRM, and increasingly the AI tools staff paste customer emails into. Each one has a location, an operator and a set of people who can reach it. Mapping them is the single most useful compliance exercise a small business can do, because the same map feeds the privacy policy, the Québec assessment, the Alberta notice and the breach plan.
4GoodHosting is Canadian-owned, and its core server banks are in data centers in Canada, in Vancouver and Toronto. That keeps the hosting layer of the map under one legal framework. The rest of the map is yours to document. Whichever host you use, ask these questions in writing and keep the answers:
- Where are the website files, databases, backups and mailboxes physically stored?
- Who owns the hosting company, and is there a parent company in another country?
- Which sub-processors or facility operators touch your data?
- Where are support staff located when they access your account?
- How quickly will you be told about a security incident that affects you?
- How and when is your data deleted after you cancel?
Canadian website compliance in 30 days: a practical plan for small businesses
You don’t need a compliance department. You need four focused weeks and a shared folder.
Week 1: Inventory. List every form, script, plugin, third-party service and mailing list on the site. Record what personal information each touches, where the provider is located, and who in your business is responsible for it. This is the data-flow map from the previous section, and nearly everything else builds on it.
Week 2: Privacy and consent. Rewrite the privacy policy against the inventory. Add a purpose line to every form and a privacy contact to the footer. If you have Québec customers, publish the privacy officer’s title and contact and set your consent banner so that non-essential tags stay off until the visitor opts in. Fix every newsletter signup so the consent box starts unticked, and start storing consent records.
Week 3: Accessibility and language. Run an automated WCAG scan, then do a manual keyboard-only pass through your key journeys: home, a product or service page, the contact form and checkout. Fix contrast, labels, focus and alt text. Publish an accessibility statement. If you sell into Québec, close the gaps between the French and English versions and put French terms first.
Week 4: Incidents and documentation. Write a one-page breach response plan: who decides, who calls the host, who notifies the regulator and customers. Start the 24-month breach log, even if it is empty. Send the hosting questions above to your provider. Put a reminder in the calendar to review all of this every six months.
A note for agencies and freelancers: if you build sites for clients, the compliance artefacts you deliver are part of the work you sell. A launch checklist that includes the consent configuration, the accessibility pass and the French version is a better product, and it protects you when a client’s regulator comes asking.
What’s changing next
Federal privacy reform. Bill C-36 is the item to watch. If it passes in roughly its current form, expect a stronger regulator, larger penalties and more formal privacy-management programs. Organizations that already document their data flows and consent practices will have the least to change.
Ontario’s reporting cycle. The 31 December 2026 compliance report closes this cycle. Commentators expect Ontario to move its web standard from WCAG 2.0 toward WCAG 2.2. Building to 2.1 or 2.2 now avoids doing the work twice.
Law 25 enforcement. The Commission d’accès à l’information now has its full penalty toolkit. Expect the published-policy, privacy-officer and consent-banner requirements to be the easiest things for regulators and complainants to check, because they are visible from outside.
Tracking and AI. As more sites add AI chat, session recording and personalization, more of them will cross into “identification, location or profiling” territory under Law 25 and “new purpose” territory under PIPEDA. Treat every new script as a data-flow change and update the map.
Frequently asked questions
What laws apply to a Canadian business website?
Most Canadian business websites fall under a privacy law (PIPEDA, or the provincial law in British Columbia, Alberta or Québec), CASL if they send commercial email or texts, and the Competition Act’s rules on pricing and advertising. Québec-facing sites add Law 25 and the Charter of the French language. Ontario employers with 50 or more staff must meet WCAG 2.0 Level AA, and Manitoba employers of any size must meet WCAG 2.1 Level AA for new web content.
Does PIPEDA require my website to be hosted in Canada?
No. PIPEDA allows personal information to be processed outside Canada and holds the business accountable for the protection it receives there, mainly through contracts and transparency. Web hosting in Canada is a choice that simplifies compliance rather than a legal requirement. Some public-sector rules, health-information laws and client contracts do require Canadian data residency, so check whether any of those apply to you.
Does Québec’s Law 25 apply if my business is outside Québec?
It can. Law 25 applies to enterprises collecting personal information in the course of carrying on business in Québec. Whether a business with no physical presence there is caught depends on the facts, and that is a question for a lawyer. If you actively sell to Québec residents, the prudent approach is to meet Law 25’s website requirements for that audience: a privacy officer contact, published policies, and tracking that stays off until activated.
Do I need a cookie banner on a Canadian website?
No Canadian law uses the word “cookie banner,” but the obligations behind one are real. PIPEDA requires meaningful consent for tracking, and the Privacy Commissioner accepts opt-out consent for non-sensitive advertising only under strict conditions. For Québec visitors, Law 25 requires you to inform people before using technology that can identify, locate or profile them and to let them activate it. In practice, that means non-essential tags stay off until the visitor opts in.
Is my small business required to follow the AODA?
Every organization with at least one employee in Ontario has some AODA duties, such as accessible customer service. The WCAG 2.0 Level AA website requirement applies at 50 or more Ontario employees, and the compliance report applies at 20 or more, with the next one due 31 December 2026. Smaller Ontario businesses are not bound by the web rule, but building accessibly is still good practice and protects against human rights complaints.
Does my website have to be in French?
If you do business with customers in Québec, yes. The Office québécois de la langue française treats business websites aimed at Québec customers as commercial publications that must be available in French. Other languages may accompany the French version, but since Bill 96 the French version must be available on terms at least as favourable. Standard-form online terms must also be presented in French first.
How fast must I report a data breach in Canada?
Under PIPEDA, you must report a breach of security safeguards to the Privacy Commissioner, and notify affected individuals, as soon as feasible after determining that it creates a real risk of significant harm. There is no fixed 72-hour deadline; that rule comes from Europe’s GDPR. You must also keep a record of every breach for 24 months. Québec requires prompt notice to its Commission when an incident presents a risk of serious injury.
Do data centers in Canada protect my website from the US CLOUD Act?
Not by location alone. The CLOUD Act reaches data in the possession, custody or control of providers subject to US jurisdiction, wherever the data is stored. A Canadian-owned host operating in data centers in Canada narrows that exposure, but you should still confirm who operates the facilities, which sub-processors are involved and where support staff access your account from.
What is Bill C-36 and does it change anything now?
Bill C-36, tabled on 15 June 2026, would replace PIPEDA’s privacy rules with a new Protecting Privacy and Consumer Data Act and create a new federal regulator, with administrative penalties of up to $10 million or 3% of global revenue as introduced. It is not law yet, so PIPEDA still applies. The sensible step now is to document your data flows and consent practices, which both laws reward.
What should every Canadian website have?
At a minimum: a specific privacy policy, a privacy contact, a purpose statement at each form, consent controls for tracking, CASL-compliant signup and unsubscribe if you send marketing email, HTTPS and basic security hygiene, a breach plan with a 24-month log, an inventory of where your data goes, and all-in pricing if you sell online. Add accessibility, French-language and Québec-specific items according to your province, size and customers.
Key takeaways
- Canadian website compliance is a stack of at least five regimes: PIPEDA or a provincial privacy law, Law 25, CASL, the AODA and Manitoba’s standard, and the Charter of the French language. Competition and consumer protection rules sit on top.
- Obligations follow your customers, staff, size and activities, not your server.
- PIPEDA requires breach reports as soon as feasible, not within 72 hours, plus a 24-month log of every breach.
- Law 25 puts the most visible requirements on the page itself: a privacy officer contact, published policies, and identification or profiling functions that stay off until the visitor activates them.
- CASL consent must be provable, and unsubscribes must take effect within 10 business days.
- Ontario’s 50-employee web rule and its 31 December 2026 report deadline, along with Manitoba’s one-employee WCAG 2.1 rule, make accessibility a legal duty for many businesses.
- Québec-facing sites need a French version on terms at least as favourable, and French-first online terms.
- PIPEDA does not require web hosting in Canada. Data centers in Canada simplify Québec assessments, Alberta notices and contract requirements, and a Canadian-owned host narrows foreign legal reach.
- Map every service that receives your visitors’ data. That one document feeds the privacy policy, the assessments and the breach plan.
Conclusion
Canadian website compliance looks unmanageable when you picture it as five statutes and a regulator for each. It becomes manageable when you work from your own website outward: what you collect, where it goes, who you send messages to, who can use the site, and which language your customers expect. Every law in this guide asks some version of those questions.
Most of the work is documentation and a handful of design decisions. That means a policy that describes reality, forms that ask honestly, a banner that waits for consent, a site that works with a keyboard, and a French version that is the equal of the English one. Hosting is one row in that inventory. It is an important row, because it is where the data sits, but it is still only one row. Choose a host whose answer to “where does our data live?” is short and specific, then spend your effort on the rest of the map.
Call to action
Hosting can’t make your website compliant. Your policies, forms and processes do that. What the right host can do is give you a short, documentable answer to the question every privacy policy, Québec assessment and Alberta notice asks: where does the data live?
4GoodHosting keeps its core servers in Vancouver and Toronto and supports Canadian businesses with Canadian staff. Start there, and you start your compliance map with the hosting row already filled in.
See plans for web hosting in Canada with servers in Vancouver and Toronto →