Website privacy policy in Canada
What a small business website privacy policy needs in Canada: the core sections under PIPEDA, the Quebec Law 25 additions and how to describe your real tools.
A website privacy policy in Canada should explain, in plain language, what personal information your business collects through the site and beyond it, why you collect it, who you share it with, where it is stored, how long you keep it, and how people can access or correct it or complain. PIPEDA's principles of accountability and openness are the federal basis for this. If you serve customers in Quebec, Law 25 adds specific requirements: a published privacy policy in clear terms, the title and contact details of the person in charge of personal information, and information about tracking technologies and how to switch them on.
The most common problem I see is not a missing policy. It is a policy that does not match the website: copied text that mentions tools the business never used and leaves out the ones it does. This guide shows what to include and how to make it true. It is general information, not legal advice, so have a lawyer review your final text, particularly if you handle health, financial or children's information.
Start with an inventory, not a template
Before writing anything, list where personal information enters your business through the website:
- Contact and quote forms.
- Booking systems and online payments.
- Newsletter and SMS sign-ups.
- Chatbots and live chat.
- Analytics (GA4), Tag Manager, Meta Pixel, Google Ads tags, other pixels.
- Call tracking and recorded calls.
- Embedded maps, videos and review widgets.
- Your CRM, email platform and any tool that receives form data.
For each, note what data is collected, why, which company processes it and in which country. That inventory becomes the backbone of the policy. If you are not sure what scripts your site loads, someone technical can list them in an hour; it is part of what I check in an analytics audit.
Ten sections a Canadian privacy policy usually needs
- Who you are and how to reach you. Business name, contact email and mailing address, and the person responsible for privacy.
- What you collect. Grouped plainly: contact details from forms, booking details, payment information (usually processed by the payment provider), technical data from analytics, messages from chat.
- Why you collect it. Answering enquiries, delivering services, sending newsletters with consent, measuring and improving the website, advertising.
- Consent. How you obtain it, including for marketing emails and texts under CASL, and how people can withdraw it.
- Cookies and tracking. Categories, purposes and how to change choices. Many businesses keep the detail in a separate cookie policy and link to it. See cookie consent in Canada.
- Sharing and service providers. Types of providers that receive data (hosting, CRM, email platform, payment processor, analytics, ad platforms) and why.
- Storage outside Canada. If any provider stores data outside Canada, or outside Quebec for Quebec residents, say so and note that it may be accessible under foreign laws.
- Retention. How long you keep different kinds of data, or the criteria you use.
- Safeguards. A plain description of how you protect data: access controls, secure providers, limited staff access.
- Individual rights and complaints. How to request access or correction, how to withdraw consent, and that people can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
Add the date of the last update at the top.
Extra points for Quebec Law 25
If you collect personal information from people in Quebec, Law 25 generally expects:
- A person in charge of the protection of personal information, by default the person with the highest authority in the business, with their title and contact details published on the website.
- A privacy policy written in clear and simple terms, published on the website.
- Information about technologies that identify, locate or profile visitors, and how to activate them, with privacy-protective defaults.
- Transparency about transfers outside Quebec, supported internally by an assessment of the protection the data will receive.
- Information about automated decisions, if you make decisions about people based only on automated processing.
There are also internal obligations that do not appear on the website but matter: governance policies, a register of confidentiality incidents and privacy impact assessments in some situations. My article on Quebec Law 25 for websites and marketing goes into those.
Describing marketing tools honestly
Marketing tools are where policies most often fall short. Some examples of plain wording:
- Analytics: "We use Google Analytics to understand how visitors use our site, such as which pages are viewed. It uses cookies only if you allow analytics cookies." (Your own policy can use "we" for the business; that is normal in legal text.)
- Advertising pixels: "If you accept advertising cookies, we use the Meta Pixel and Google Ads tags to measure our ads and show ads to people who visited our site."
- CRM: "Enquiries from our forms are stored in our customer management system, hosted by [provider] in [country]."
- Chatbot: "Messages sent through our chat assistant are stored by [provider] and used to answer your questions."
If you use AI tools on customer data, say so, and check whether the provider uses that data for training.
Where to put it and how to link it
- A dedicated page, linked in the footer of every page.
- Linked next to every form that collects personal information, in a short line such as "How I use your information".
- Linked from your cookie banner.
- Linked in email footers if you send newsletters.
For reference, you can see how this site handles it on my own privacy policy page.
Mistakes to avoid
- Policies written for the GDPR in Europe and pasted unchanged; they reference laws and authorities that do not apply to you.
- Promising things you do not do, such as "we never share data with third parties" while running ad pixels.
- Listing no contact person, or an email address nobody monitors.
- Forgetting tools added after launch: a chat widget, a booking plugin, a new pixel.
- Policies only in English when you actively serve Quebec.
How I can help
I am not a lawyer and do not write legal documents for clients. What I do is the technical side: an inventory of every form, tag, pixel and integration on your site, where the data goes, and a consent setup that matches what your policy promises. When I build a website, forms, consent checkboxes and tracking are designed with this in mind from the start; see website form and CRM integrations.
Let’s talk
about your business
Before the call I review your website and ads. After the call you get an action plan and a price range in writing.
12+ years in online marketing, 100+ clients. I build websites, Google Ads and Meta ads campaigns, CRMs and automations for small and mid-sized businesses. About me →
Privacy policies:
questions owners ask
Can I copy a privacy policy from another website?
Copying is risky. Another site's policy describes their tools, their data flows and their purposes, not yours. If your policy says you do not use advertising pixels and your site does, or omits that your CRM is hosted abroad, it misleads visitors. Templates are fine as a structure, but every section should be checked against what your website and business actually do.
Who should be named as the privacy contact?
Someone who can actually answer privacy questions and requests: often the owner in a small business. Under Quebec Law 25, the person with the highest authority is the person in charge of protecting personal information by default, unless that role is delegated in writing, and their title and contact information must be published on the website.
Does my privacy policy need to be in French?
If you do business with customers in Quebec, documents provided to them should generally be available in French under the Charter of the French Language, and Law 25 expects the policy to be clear and accessible. Outside Quebec, French is optional, but a bilingual policy makes sense if you serve French-speaking customers anywhere in Canada.
How often should I update the privacy policy?
Whenever your data practices change: a new CRM, a new ad pixel, a chatbot, a booking tool, a move to a different hosting provider. Also review it once a year even if nothing seems to have changed, since small additions to a website often add new tracking. Put the date of the last update at the top.
Not sure what your website
actually collects?
I'll list the forms, tags, pixels and tools on your site and where the data goes, so you or your lawyer can write an accurate policy. Start with a free 30-minute call.