Analytics and Canadian privacy law
Published 27 October 2026 · 8 min read
If people in Canada use your website, extension or app, the question is usually: can I measure how it is used, and do I need their consent? Canada's answer depends less on cookies than on one idea: whether the data you collect is personal information. If it is, the federal law and the provincial laws ask you to have a reasonable purpose, collect no more than you need, and get consent in a form that fits how sensitive the data is and what people expect. The anti-spam law, often mentioned in the same breath, is mostly about something else.
This is not legal advice. For a decision about your product, ask someone qualified.
Which law applies
The federal law is the Personal Information Protection and Electronic Documents Act (PIPEDA). It applies to personal information an organization collects, uses or discloses "in the course of commercial activities" (Justice Laws: PIPEDA, s. 4).
Alberta, British Columbia and Quebec have their own private-sector laws, deemed substantially similar, and organizations under them are "generally exempt from PIPEDA with respect to the collection, use or disclosure of personal information that occurs within that province". PIPEDA still applies, even there, to "transactions involving personal information transferred across borders" and to federally regulated businesses such as banks and telecommunications companies (OPC: provincial laws that may apply instead of PIPEDA). The regulator adds that this is decided case by case, and that sometimes both apply.
Quebec's Act, as amended by Law 25, adds rules of its own and is not covered in this article. If your business is in Quebec, ask someone qualified about it.
Bill C-36, which would enact a new private-sector law and amend PIPEDA, is before Parliament (LEGISinfo: C-36). It is not law, and PIPEDA applies as it stands.
When analytics data is personal information
PIPEDA defines personal information as "information about an identifiable individual". The Privacy Commissioner reads that through a test from the Federal Court: information is about an identifiable individual "where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other information". An IP address "can be considered personal information" if it can be associated with an identifiable individual (OPC: Interpretation Bulletin, Personal Information).
Context decides. In a 2020 joint investigation of a shopping-mall operator, the federal, Alberta and British Columbia commissioners found that "device identifiers can constitute personal information", and that a serious possibility "must be beyond mere speculation, but does not need to reach the level of 'more likely than not'". In that case, hashed device identifiers not tied to anyone's account did not meet the test, but would have once associated with a user account (OPC: PIPEDA Findings #2020-004).
For analytics, that means a random identifier, a country and a browser family are not automatically personal information, and are not automatically safe either. What you join them to matters: an account, an email address in an event property, a customer record.
Consent under PIPEDA
Consent is valid only if "it is reasonable to expect that an individual to whom the organization's activities are directed would understand the nature, purpose and consequences" of what they are consenting to (s. 6.1). Whatever the consent, the purpose must be one "a reasonable person would consider are appropriate in the circumstances" (s. 5(3)). Collection is limited to "that which is necessary to fulfil the purposes identified" (Schedule 1, 4.4.1). And the form of consent can vary: "Implied consent would generally be appropriate when the information is less sensitive" (Schedule 1, 4.3.6) (Justice Laws: PIPEDA).
The Guidelines for obtaining meaningful consent, issued by the federal, Alberta and British Columbia commissioners, say you should generally get express consent when the information is sensitive, when the use is "outside of the reasonable expectations of the individual", or when it "creates a meaningful residual risk of significant harm". They also ask you to put four things up front: what is collected, with whom it is shared, for what purposes, and the risk of harm (OPC: Guidelines for obtaining meaningful consent).
Two more points matter for analytics:
- Tracking for advertising is treated differently. The Commissioner's guidelines on online behavioural advertising say such data "will generally constitute personal information", allow opt-out consent only under conditions, and say techniques people cannot decline, including "device fingerprinting", should not be used for it (OPC: Guidelines on privacy and online behavioural advertising). They are about advertising, not product measurement, but show where the line is drawn.
- A provider does not take the responsibility from you. "An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing" (Schedule 1, 4.1.3).
PIPEDA does not say "analytics needs consent" or "analytics does not". It asks whether what you collect is personal information and, if so, whether the people concerned would expect it.
British Columbia and Alberta
Both provinces define personal information as information about an identifiable individual (BC Laws: PIPA; Alberta King's Printer: PIPA). Both allow consent by notice and opt-out in some cases: you tell people the purpose, give them a reasonable opportunity to decline, and the use is reasonable given how sensitive the information is (BC s. 8(3), Alberta s. 8(3)). Alberta has been consulting on possible updates to its Act (Alberta: PIPA engagement).
CASL: what it covers, and what it does not
Canada's anti-spam legislation (CASL) prohibits sending a commercial electronic message without consent, and installing "a computer program on any other person's computer system" in the course of a commercial activity without express consent (Justice Laws: S.C. 2010, c. 23, ss. 6 and 8). It is not a law about collecting personal information; that is PIPEDA's job.
- Analytics events are not marketing messages. CASL matters for analytics only if you use what you learn to send commercial emails or texts, and then it is the emails it governs.
- Websites. A person "is considered to expressly consent" to the installation of "a cookie", "HTML code" or "Java Scripts" where their conduct makes it reasonable to believe they consent (s. 10(8)).
- Extensions and apps. The government's guidance says CASL "doesn't apply in situations where a person or business installs software on their own computer", such as an app from an app store, but lists an update "pushed" to a device as a case where it does (ISED: how CASL applies to software). How that applies to updates delivered by a browser's extension store is worth asking about.
What to check for your own product
- Is what you collect personal information, alone or joined to accounts, emails or other records you hold?
- Would your users expect it? If not, or if it is sensitive, plan on express consent.
- Do you tell them, in plain words, what is collected, why, and who receives it?
- Who processes it for you, and on what terms? You stay responsible for what a provider does with it.
How AnalyticsTrend does it
AnalyticsTrend is designed to measure use without collecting anything about who people are. It sets no cookies on the people it measures. Its identifier is random, not derived from anything about the device or the person, and scoped to one site, extension or app. The IP address is turned into a country, and in some countries a region, then discarded. It records browser, operating system and device families, never versions, and does not fingerprint. Raw events are deleted after 90 days, and daily totals are kept. A browser that sends Global Privacy Control is not counted on a website unless you turn that off; extensions honour it where the browser lets them see it. The data is not stored in Quebec.
None of this decides your obligations. Events tied to a random identifier are not anonymous, and you remain responsible for what you send in event properties and for whether your use needs consent. The complete list is in What it collects. To set it up, see Install on a website, Install in a Chrome extension, Install in a Firefox extension or, for mobile, desktop and server apps, Install in an app. For users elsewhere, see Analytics and the GDPR and Analytics and US privacy laws.
Checked against the sources linked above on 27 October 2026.