Privacy Law Reform

Privacy Law Reform

Issue at a Glance

Canada is facing the most significant changes to its private sector privacy laws since our current privacy law came into effect at the turn of the century.

For decades, the CMA has been a leading voice on privacy, ensuring the marketing perspective is central to the conversation. Our advocacy is focused on shaping a modern privacy framework that protects consumers, fosters trust, and supports a thriving digital economy. We advocate for harmonized laws across Canada to avoid a complex patchwork of rules that would increase costs and complexity for business without adding any additional benefits to consumers.

The CMA, in consultation with our Privacy and Data Committee, is engaged with governments at all levels on important issues related to privacy law reform.

On this page, you can find more information about changes to the law, and the CMA’s advocacy initiatives.

For information on privacy compliance and best practices, including our guides and resources for the marketing community, please see our Privacy Protection webpage.

The federal government introduced Bill C-36 on June 15, 2026, to establish modern rules governing the collection, use and disclosure of personal information in commercial activities. Bill C-36, if passed, would replace the privacy provisions of PIPEDA with the Protecting Privacy and Consumer Data Act (PPCDA).

It will take time for the bill to go through the full legislative process and take effect. Until then, our existing privacy law, PIPEDA remains in effect.

Key proposals impacting marketing activities include:

  • Transparency: Organizations would be required to provide information in plain language about their privacy practices, including the personal information they hold, how the information is being used, the use of automated decision systems to make predictions, recommendations or decisions about individuals that could have a legal or similarly significant effect on them, and whether the organization transfers or discloses personal information interprovincially or outside of Canada.
  • Consent: Consent would remain the primary basis for the collection, use and disclosure of personal information. Express consent would be the default approach, but organizations could rely on implied consent under certain circumstances, taking into account the sensitivity of the information and an individual's reasonable expectations.
  • Consumer rights: Consumers would have the right to have their personal information deleted or transferred to another organization. They would also have the right to claim damages in court.
  • Children: The personal information of children under age 18 would be considered sensitive, and their best interests would need to be considered.
  • Regulation and enforcement: One member of a new regulatory body – the Digital Safety and Data Protection Commission of Canada – would be named Privacy and Consumer Data Commissioner. This commissioner would investigate complaints, initiate complaints, issue notices of contravention including penalties. The maximum penalty for any one investigation would be the greater of $10 million and 3% of gross global revenue.
  • Public sector privacy law: Privacy for public sector bodies is governed by a separate law known as the Privacy Act. This Act is currently under review.


As the bill makes its way through Parliament, the CMA will be actively involved in the legislative process, making submissions and meeting with officials to support the bill and press for any needed changes.

The CMA is actively monitoring developments in privacy law across the country. Now that a federal law has been introduced, we anticipate that most provinces will align their approach to ensure it is substantially similar to federal Bill C-36. We are continuing to monitor developments and will update the marketing community regularly.

British Columbia: British Columbia intends to update its private sector privacy law, the Personal Information Protection Act (BC PIPA). The BC Privacy Commissioner is calling for reform to strengthen rights in the digital age, including mandatory privacy breach reporting. While the timeline is uncertain, reform is on the agenda.

Alberta: Alberta’s reform of its Personal Information Protection Act (AB PIPA) is well underway. Key proposed changes marketers should be aware of include stronger enforcement and higher penalties. 

Quebec: Quebec’s Law 25 is in effect and includes significant enforcement penalties, GDPR-like rights for consumers, and stringent consent and transparency requirements, which impact companies that do business in Quebec and those that handle the personal information of Quebec residents.

CMA members can access an English version of the Quebec privacy regulator (the CAI’s) consent guidelines (electronically translated) here. You can also access our Application of Quebec Law 25 to Marketing Activities Guide.

Ontario and other provinces and territories: For Ontario and all other provinces and territories, the federal law would continue to apply as they do not currently have their own general private-sector privacy laws in force.

The GDMA Global Privacy Principles serve as an ethical framework and best practice guidance for the global data and marketing industry.

A key aim of the principles is to establish best practice guidance that the global data and marketing industry can use to strengthen existing self-regulatory privacy initiatives and codes worldwide. The principles will help organizations cultivate consumer trust and deliver a better customer experience by adhering to strong privacy principles – from being clear and transparent to respecting individual choices with respect to personal information.

The CMA is a champion of Data Privacy Week, an international effort to empower individuals and encourage businesses to respect privacy, safeguard data and enable trust.

For questions or comments about privacy law reform, marketers are encouraged to reach out.

Major Sponsors