Canadian Website Compliance Checklist for Small Businesses

Table of Contents

• Which Rules Apply to Your Website?
• What Are the Rules on Cookies and Tracking?
• Who Is Your Privacy Officer?
• Does Your Website Need to Be in French?
• Can You Email Canadian Businesses Without Asking?
• What About Accessibility?
• Your Website Compliance Checklist
• How Can I Help?
• Frequently Asked Questions

This is general information, not legal advice, and I’m a developer, not a lawyer. Quebec’s rules below come from the regulator’s guidance and a law firm’s summary, not from my own reading of the statutes. Please confirm the details with a lawyer before you rely on them.

Which Rules Apply to Your Website?

What Are the Rules on Cookies and Tracking?

Outside Quebec, the Office of the Privacy Commissioner’s guidelines on online behavioural advertising say opt-out consent can be reasonable if several conditions are met:

• The purpose is made obvious and isn’t buried in a privacy policy
• People are told at or before the time of collection
• They can easily opt out, and that choice takes effect immediately and lasts
• The data is limited to non-sensitive information as far as practicable
• The data is destroyed or de-identified as soon as possible

In Quebec, the rule is stricter. The Commission d’accès à l’information says that if you use technology that can identify, locate or profile someone, you must tell them from the start and explain how to activate those functions. It says you can’t turn those functions on by default. The person has to do it themselves.

In practice, that means a banner that actually controls your tracking, with non-essential tracking off for Quebec visitors until they say yes.

Who Is Your Privacy Officer?

According to the Commission d’accès à l’information, the person with the highest authority in a business is responsible for protecting personal information by default, though the role can be delegated in writing. The title and contact details of that person must be published on the company’s website.

The stakes aren’t small. The Commission’s summary of penalties lists administrative penalties of up to $10 million or 2% of worldwide turnover. Court fines for a business start at $15,000 and can reach $25 million or 4% of worldwide turnover, and they double for repeat offences.

Does Your Website Need to Be in French?

If you do business in Quebec, plan for it. Law firm Fasken says the website of a company doing business in Quebec must be accessible in French.

If you only serve customers outside Quebec, this may not affect you. If Quebec customers matter to your business, budget for proper French pages and ask a Quebec lawyer or the Office québécois de la langue française how the rules apply to you.

Can You Email Canadian Businesses Without Asking?

Often not. Canada’s Anti-Spam Legislation covers commercial emails and texts, and a business address isn’t an automatic exception. Here’s what matters:

• It reaches messages from abroad. The Act applies when a computer system in Canada is used to send or access the message.
• You generally need consent. That can be express, or implied in specific cases.
• A published address is only sometimes enough. Consent can be implied if the person conspicuously published the address, didn’t say they refuse unsolicited messages, and your message is relevant to their business or role.
• Every commercial message has rules. The government says it must include your business name, a current mailing address, a phone number, email or website, and an unsubscribe mechanism.
• Unsubscribes have a deadline. You must act on them within 10 business days.

The maximum penalty per violation is $1 million for an individual and $10 million for any other person.

What About Accessibility?

In Ontario, businesses and non-profits with 50 or more employees must make public websites meet WCAG 2.0 Level AA. Those with 20 or more have a compliance report due by December 31, 2026. My guide to AODA website requirements covers this in full.

Your Website Compliance Checklist

Work through this list with your team:

• A privacy policy that matches what your site actually collects
• The title and contact details of your privacy officer on your site
• A cookie banner that really controls tracking, with Accept and Decline both easy to find
• Tracking off for Quebec visitors until they opt in
• Forms that only ask for what you need
• A separate, unticked box for marketing email on your forms
• A record of who agreed to receive marketing from you, and when
• Your business name, mailing address, contact details and an unsubscribe link in every marketing email
• A way to act on unsubscribes within 10 business days
• French pages, if you do business in Quebec
• WCAG 2.0 Level AA, if you have 50 or more employees in Ontario
• An AODA compliance report, if you have 20 or more

How Can I Help?

I can build most of this into your website: the consent banner, the forms, the privacy officer details and accessible pages. I can’t give you legal advice, so I work from whatever your lawyer or accountant tells you.

If your site needs work, see my website design page.

Frequently Asked Questions

Do I need a cookie banner in Canada?

If you use tracking and you have visitors in Quebec, a banner that controls that tracking is the usual way to meet the rules. Elsewhere in Canada, you still need to be clear about tracking and give people an easy way to opt out.

Does Law 25 apply to businesses outside Quebec?

It can. Legal commentators say the law can reach businesses elsewhere that collect information from people in Quebec, so get advice if you have Quebec customers.

Does CASL apply to business-to-business email?

In general, yes. The Act covers commercial electronic messages, and business addresses aren’t automatically exempt. Some exceptions exist, so check before you send cold email to Canadian companies.

Is this legal advice?

No. This is a developer’s plain-English summary to help you ask the right questions. Rules change, so confirm the details with a lawyer.