What the law says, in plain terms
PIPEDA (the Personal Information Protection and Electronic Documents Act) applies to private-sector organizations across Canada that collect, use or disclose personal information in commercial activities, with Alberta, British Columbia and Quebec having their own substantially similar laws for businesses within those provinces. Its principles include accountability, identifying the purpose of collection, consent, and openness: you must make your privacy practices readily available. A website that collects names, emails, phone numbers, IP addresses or behaviour data through forms, cookies or analytics is collecting personal information, so the openness requirement applies, and a privacy policy page is the standard way to meet it.
Quebec's Law 25 (in force in stages from 2022 to 2024) goes further: an enterprise that collects personal information through technological means must publish a confidentiality policy on its website in clear and simple terms, and must inform users of cookies and similar technologies. If you have customers in Quebec, that applies to you even if you are based elsewhere.
Who else requires it
- Google Analytics and Google Ads terms require a privacy policy that discloses their use of cookies and data collection.
- Payment processors and app stores require one before approving an account or an app.
- Facebook/Meta pixels, email marketing tools and booking systems generally require disclosure in your policy.
- Visitors from the EU and UK are covered by GDPR, which requires a policy and consent for non-essential cookies, if you market to them.
- Canada's anti-spam law (CASL) governs the marketing emails you send; your policy should explain how people are added to lists and how they unsubscribe.
What a privacy policy should contain
What personal information you collect (forms, cookies, analytics, payments), why, how it is used, who it is shared with (processors, analytics, email providers), how long it is kept, how it is protected, how someone can access or correct their information or withdraw consent, and who to contact. Name the specific tools you use. Write it in plain language and keep it current when you add a tool. Templates and generators give you a starting point; a lawyer should review it if you handle health, financial or children's data. Link to it from the footer of every page; it is one of the pages every small business website needs. Whether you also need a cookie banner depends on your audience: Quebec and the EU effectively require consent for non-essential cookies, and the rest of Canada currently requires clear notice. What Google Analytics is covers the analytics side.