Skip to content
safelaunch
← All markets

Americas · 4 laws · 17 requirements

Canada: the laws your website or app must follow

If your customers are in Canada, these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.

How a SafeLaunch audit checks each one
  • CheckedChecked automatically on every scan
  • AI reviewLooked for by the AI analysis, reported only with evidence
  • Your answersDecided from your answers to the audit questions
  • PreparedPrepared for you in the report's compliance pack
  • You confirmA scan can't see this; you need to confirm it

PIPEDA

In force (Bill C-27 died in Jan 2025; PIPEDA still applies).

Who it covers: Private-sector organisations collecting personal information in commercial activity.

What it requires of a website or app (5)

  • Openness: a privacy policy explaining practices and naming the accountable personCheckedSch. 1, 4.1 & 4.8
  • Meaningful consent, express for sensitive information; opt-out only for low-risk usesChecked4.3; OPC guidelines
  • Safeguards appropriate to sensitivityChecked4.7
  • Access and correction on request within 30 daysChecked4.9; s. 8
  • Record all breaches; report real-risk-of-significant-harm breaches to the OPC and individualsCheckeds. 10.1

Sources:OPC: PIPEDA

CASL

In force.

Who it covers: Anyone sending commercial electronic messages to or from Canada.

What it requires of a website or app (4)

  • Express or implied consent before sending commercial messages (if if you send marketing emails)Your answerss. 6, 10
  • Sender identification and contact details in every message (if if you send marketing emails)Prepareds. 6(2)(a)–(b)
  • A working unsubscribe, honoured within 10 business days (if if you send marketing emails)Your answerss. 11
  • Keep records of consent: you must be able to prove it (if if you send marketing emails)Checkeds. 13

Sources:CRTC: CASL

Quebec Law 25

Fully in force since 22 Sept 2024.

Who it covers: Businesses collecting personal information of people in Quebec.

What it requires of a website or app (6)

  • Publish a privacy policy in clear terms, and the title and contact of the person in charge of personal informationCheckedPrivate Sector Act s. 3.2, 3.1
  • Tell users about tracking technologies that identify, locate or profile them and how to turn them off; CAI expects consent before profiling cookiesCheckeds. 8.1
  • Highest confidentiality settings by default (other than browser cookies)AI reviews. 9.1
  • A privacy impact assessment before transferring data outside QuebecCheckeds. 17
  • Report confidentiality incidents with a risk of serious injury to the CAI and individuals; keep a registerCheckeds. 3.5–3.8
  • Access, correction, de-indexing and portability rightsCheckeds. 27–28.1

Sources:Commission d'accès à l'information

AODA (Ontario)

In force; web requirement since 1 Jan 2021.

Who it covers: Ontario organisations with 50+ employees, and public sector bodies.

What it requires of a website or app (2)

  • Public websites meet WCAG 2.0 AA (except live captions and pre-recorded audio description) (if 50+ employees in Ontario)CheckedIASR O. Reg. 191/11 s. 14
  • Accessible feedback processes (if 50+ employees in Ontario)CheckedIASR s. 11

Sources:Ontario: accessible websites

Licensed professionals in Canada

These regulators' advertising and conduct rules apply on top of the laws above, only to sites of that profession.

Check your site against Canada's rules

A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.

Check my site free

One free fix in your inbox each week

A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.

By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.

A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.