Cookie Banners Are Everywhere in Canada—Just as Cookies Are Dying
Disclaimer The information provided in this post is for general informational purposes only and does not constitute legal advice. Laws and regulations vary by jurisdiction, and the application of legal principles depends on specific facts and circumstances. You should consult a qualified lawyer for advice regarding your individual situation. No lwayer-client relationship is created by your use of this material.
If you’ve been online lately, you’ve probably noticed an explosion of cookie consent banners on Canadian websites. Ironically, this surge comes at a time when third-party cookies are on their way out.
The sudden proliferation is the result of Quebec’s Law 25.
Quebec’s Act to modernize legislative provisions respecting the protection of personal information (Law 25) is Canada’s most significant privacy reform in recent years. Fully in force as of September 2024, it amended private and public sector privacy laws in Quebec.
In the private sector, it introduced GDPR-style requirements into the Act respecting the protection of personal information in the private sector (“Quebec PPIPS”), including, among other things:
Explicit, informed consent for technologies the profile, locate or identify an individual.
Serious penalties for non-compliance (up to $10 million or 2% of worldwide turnover for the preceding year)
Private right of action – a private right of action with minimum statutory punitive damages of $1,000 for intentional misconduct.
Section 9.1 of the Privacy Act explicitly excludes “browser cookies” from the requirement for organizations to default to the most privacy protective settings.
However, section 8.1 of the Quebec Privacy Act now defines “profiling” as the collection and use of personal information to assess certain characteristics of a natural person, in particular for the purpose of analyzing that person’s work performance, economic situation, health, personal preferences, interests or behaviour.
How these two sections interact has not yet been reconciled by the Commission d’accès à l’information (CAI). However, the CAI was clear in a recent joint investigation report of findings with other Canadian Privacy Commissioners that profiling requires “an active gesture to activate these specific functions”. PIPEDA Findings #2025-003: Joint investigation of TikTok Pte. Ltd. by the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, and the Office of the Information and Privacy Commissioner of Alberta - Office of the Privacy Commissioner of Canada
While there might still be room to argue that function and analytics cookies can be on by default under section 9.1, it seems likely that profiling cookies require explicit consent, notwithstanding section 9.1. With potential class actions, punitive damages, and administrative monetary penalties, it seems that organizations are not taking any chances.
Get used to the cookie banner.