PIPEDA / Law 25 Compliance Guide

Canada has two overlapping privacy frameworks. The federal PIPEDA (Personal Information Protection and Electronic Documents Act) applies to private-sector organisations across Canada. Quebec's stricter Law 25 (Bill 64 / Act 25) — fully in force since September 2023 — is GDPR-aligned and supersedes PIPEDA for Quebec residents. Consenti's regulation: 'pipeda' mode implements the stricter Law 25 baseline, which also satisfies PIPEDA.

Official references

• PIPEDA — full statute text (Justice Canada)
• Office of the Privacy Commissioner of Canada (OPC)
• Commission d'accès à l'information du Québec — Law 25

Key requirements

Law 25 vs. GDPR

Enabling PIPEDA / Law 25 mode

Frontend widget

new ConsentiSetup({
  compliance: { type: 'general-privacy-consent' },
})

Profile configuration (dashboard)

{
  "regulation": "pipeda"
}

Unlike DPDPA (which has a dedicated dpdpa profile block rendered automatically), PIPEDA has no dedicated metadata field yet. Add your privacy officer contact and a link to your privacy policy directly in preferenceModal.htmlText or as a 'link'-action button in mainBanner.buttons, via profileOverride or the dashboard's text editor.

What Consenti does — and what it doesn't

Everything above is the consent-collection UX layer: the opt-in/implied-consent model, per-category records, withdrawal, and erasure. PIPEDA and Law 25 impose organisational obligations beyond what a consent widget can satisfy on its own. Consenti does not:

• Designate a Privacy Officer — Law 25 requires that person's name be made public; that's an organisational appointment, not a widget feature
• Author or host your privacy policy — Law 25 requires publishing one before collection; Consenti can link to it from a banner button, but doesn't write or serve the policy itself
• Judge whether your disclosure text satisfies the OPC's "meaningful consent" guidance (plain language, purpose-specific, contextually appropriate) — Consenti renders whatever htmlTextyou configure, it doesn't evaluate the wording
• Detect British Columbia or Alberta specifically — the callout above notes Consenti's PIPEDA/Law-25 baseline also satisfies PIPA BC and PIPA AB, but the geo-resolver applies the same Canada-wide default to those provinces rather than treating them as their own rule

Operator checklist

Beyond configuring Consenti's consent group, an operator with PIPEDA/Law 25 exposure still needs to:

1. Designate a Privacy Officer and make their name public, per Law 25's disclosure requirement
2. Publish a privacy policy and link to it from the banner or modal (e.g. a 'link'-action button) before any collection occurs
3. Review category htmlText against the OPC's meaningful-consent guidance rather than generic legal boilerplate
4. Enable the under-14 age gate if you knowingly serve minors in Quebec
5. Follow the OPC's (or CAI's, for Quebec) mandatory breach-notification process if a security incident meets the reporting threshold — separate from Consenti's audit log, which records consent actions, not security incidents

Right to access and erasure

PIPEDA and Law 25 grant individuals the right to access and correct their data. Use:

GET  /consenti/api/v1/consent/:visitorId
DELETE /consenti/api/v1/consent/:visitorId

For the widget-side "Forget me" button and the events both sides fire, see the Right to Erasure guide.