PIPEDA Compliance for Facebook Ads (Canada)

Quick Answer

The Personal Information Protection and Electronic Documents Act (PIPEDA), enforced by the Office of the Privacy Commissioner of Canada (OPC), requires meaningful consent before collecting personal data via the Meta Pixel, a clear privacy notice, and a documented purpose. Quebec advertisers must also follow Loi 25 (Law 25), which is closer to GDPR and now imposes its own fines through the CAI (Commission d'acces a l'information).

What the rule actually says

PIPEDA applies to private-sector organisations collecting personal data in the course of commercial activity across Canada (except in provinces with substantially similar legislation — Alberta, BC and Quebec). The OPC's 2018 guidance on meaningful consent and 2024 update on online tracking require:

• Plain-language disclosure of purposes, recipients and consequences.
• Opt-in for sensitive information; opt-out acceptable for less sensitive data subject to context.
• Just-in-time notices for surprising or non-obvious processing (such as cross-context advertising).
• A complaints mechanism with a privacy officer named and contactable.

Quebec Loi 25, fully in force since 2024, layers GDPR-style requirements: consent must be express, clear and granular; sensitive data needs explicit consent; cross-border transfers need a privacy impact assessment; and the CAI can fine up to CAD 25 million or 4% of global turnover.

What is allowed and what is banned

Allowed: Facebook ads to Canadian users with meaningful consent, retargeting based on disclosed purposes, Custom Audiences uploaded under consent or contract, and Lookalikes built from a consented seed.

Banned: firing the Pixel without notice, processing children's data without parental consent, transferring data outside Canada without informing users (Quebec) or a PIA, ignoring the OPC's investigative requests, and using bundled consent for unrelated purposes.

Step-by-step compliance setup

1. Update your privacy policy in English and French with PIPEDA and Loi 25 disclosures.
2. Install a CMP that supports both opt-in and opt-out flows and logs decisions.
3. Configure Meta's Conversions API server-side with the consent state in the event payload.
4. For Quebec users, default to opt-in and provide a 'reject all' option.
5. Appoint a Privacy Officer and publish contact details on your site.
6. Conduct a PIA for any cross-border transfer or large-scale Quebec processing.
7. Sign Meta's regional addendum and store it.
8. Build a DSAR portal with a 30-day SLA.
9. Document a breach response plan with the OPC notification rule and the CAI's similar requirement.
10. Train staff on the difference between PIPEDA and Loi 25.

Frequently asked questions

Is PIPEDA opt-in or opt-out?
PIPEDA uses a contextual standard: opt-in for sensitive or surprising processing, opt-out for less sensitive data. The OPC has signalled that cross-context advertising tilts toward opt-in.

What is Quebec Law 25?
A major amendment to Quebec's private-sector privacy law that took effect 2022-2024, introducing GDPR-style consent, transparency and enforcement.

Can the OPC fine me?
Federally, no — the OPC investigates and can refer to the Federal Court for orders. Quebec's CAI can fine directly up to CAD 25 million.

Does PIPEDA apply outside Canada?
It applies to organisations collecting Canadian personal data in the course of commercial activity, regardless of where they are based.

Is Meta a service provider or controller in Canada?
The OPC has indicated that Meta is a joint controller for Pixel processing because it uses the data for its own purposes.

Real fine examples

• Tim Hortons — OPC investigation and class-action settlement (2022) for excessive location tracking.
• Home Depot Canada — OPC investigation (2023) for sharing customer data with Meta without consent.
• Equifax Canada — Compliance agreement (2019) following the breach.
• A Quebec retailer — CAD 1.5 million (CAI, 2025) for inadequate consent under Loi 25.
• A Toronto fintech — Class-action settlement of CAD 4.2 million (2024) over Pixel-based tracking without consent.

How Pix-Vu helps

Canadian agencies use Pix-Vu to mock Facebook ad creatives, run client review cycles and avoid firing the Pixel on Canadian users. It is a clean way to comply with PIPEDA's data minimisation principle and Quebec's Loi 25 expectations. https://pix-vu.com.