Cookie consent in Canada

Cookie consent in Canada is governed by privacy law rather than a dedicated cookie law. Federally, PIPEDA requires meaningful consent for collecting personal information, and the federal privacy regulator has accepted that some low-risk tracking can rely on clear notice with an easy opt-out. Quebec's Law 25 goes further: technology that can identify, locate or profile visitors should be off by default, and visitors must be told about it and how to turn it on. For most small businesses with customers across Canada, the practical answer is a banner with real accept and reject choices, analytics and ad tags that obey those choices, and a clear cookie policy.

Google Consent Mode v2 is the technical piece that connects the banner to Google Analytics and Google Ads. Here is how the three fit together. This is a practical overview, not legal advice; for your specific situation, especially in health, finance or services to children, confirm with a privacy lawyer.

What counts as a cookie problem

Cookies and similar technologies (pixels, local storage, device fingerprints) fall into rough groups:

• Strictly necessary: keep the site working, remember a shopping cart, protect a login. These generally do not need consent.
• Preferences: remember language or region choices.
• Analytics: measure visits and behaviour, for example GA4.
• Advertising and remarketing: Meta Pixel, Google Ads tags, TikTok pixel, used to target and measure ads.

The last two raise the consent questions, because they collect data about visitors' behaviour, often shared with third parties.

The PIPEDA baseline

PIPEDA applies to private-sector organizations in most provinces when they collect personal information in commercial activity. Online identifiers and browsing data can count as personal information. The key ideas:

• Meaningful consent: people should understand what is collected, why, and with whom it is shared.
• Form of consent depends on sensitivity and expectations. For non-sensitive information that people would reasonably expect, implied consent with clear notice and an easy opt-out may be acceptable. For sensitive information, express consent is expected.
• Online behavioural advertising: the federal privacy commissioner's guidance has allowed an opt-out approach in some circumstances, provided people are told clearly and can easily opt out, and that sensitive information and children are excluded.

Alberta and British Columbia have their own private-sector privacy laws with similar principles.

What Quebec Law 25 changes

Law 25 modernized Quebec's private-sector privacy law in stages between 2022 and 2024. For websites, the relevant points include:

• Disclosure of tracking technology. If you use technology that allows a person to be identified, located or profiled, you must inform them and explain how to activate those functions.
• Privacy by default. Settings should offer the highest level of confidentiality by default. In practice, non-essential tracking is generally expected to stay off until the visitor agrees.
• Clear, separate consent for each specific purpose, in simple terms.
• A published privacy policy in clear language. More in what your website privacy policy needs in Canada.

Penalties under Law 25 can be significant, which is why many businesses outside Quebec apply its approach to all visitors rather than maintaining two setups. My article on Quebec Law 25 covers the broader marketing impact.

Where Google Consent Mode v2 fits

Consent Mode is a Google framework that tells Google tags (GA4, Google Ads, Floodlight) what the visitor agreed to. It has several signals, including analytics_storage, ad_storage, ad_user_data and ad_personalization. When a visitor declines, tags adjust their behaviour instead of firing normally.

Two setups exist:

• Basic: Google tags do not load until the visitor consents. Simple and conservative.
• Advanced: tags load but send cookieless pings when consent is denied, which Google can use to model missing conversions. More data, but it requires you to be comfortable that this approach suits your legal position.

Google requires Consent Mode v2 for using ad personalization and remarketing with users in the European Economic Area and the UK. In Canada it is not a Google requirement as of this writing, but it is the cleanest way to make your banner actually control Google tags, and it keeps your setup ready if rules tighten.

Other platforms, such as Meta, have their own consent controls, and your banner or tag manager must handle those too.

A six-step setup for a small business website

1. List what you load. Every script, pixel and embedded tool. You may find old tags from previous agencies or plugins.
2. Choose a consent tool that supports Google Consent Mode v2, English and French, and categories you can describe in plain language.
3. Set defaults by region if needed: off by default for Quebec visitors at minimum; many businesses choose off by default everywhere.
4. Connect it to Google Tag Manager so tags fire only with the right consent signals.
5. Write or update your cookie policy listing categories, purposes and how to change choices later. A link to reopen the banner should be on every page, usually in the footer.
6. Test it. Decline everything and confirm no analytics or ad cookies are set. Accept and confirm tracking works. Repeat on mobile.

Design choices that matter

• Make reject as easy as accept. Two equally visible buttons. Hiding "reject" behind a settings screen is increasingly seen as manipulative.
• Speak plainly. "We"-style legal boilerplate copied from another site often describes tools you do not use. Describe yours.
• Bilingual. For Quebec visitors, the banner and policy should be in French, at least as available as English.
• Do not block the whole site. A banner at the bottom that lets people read is friendlier than a wall.

What happens to your data

Expect fewer tracked sessions and conversions once consent is enforced. That is not a failure. Advanced Consent Mode and server-side measurement can recover part of the picture, and your CRM still knows exactly how many enquiries and customers you got. Compare platform numbers with real leads, as I explain in GA4 for small business owners.

How I can help

I set up consent banners, Consent Mode v2 and Tag Manager rules as part of analytics work; a GA4, Tag Manager and pixels setup costs $650. I am not a lawyer, so for the legal wording of your policies I recommend a privacy professional, while I make sure the technical side does what the policy says.