Does a Canadian website need a cookie banner?

What PIPEDA asks for instead

PIPEDA requires meaningful consent for collecting and using personal information. The Privacy Commissioner accepts implied, opt-out consent for non-sensitive uses such as analytics and interest-based advertising, but only when the purpose is made obvious at or before the point of collection rather than buried in a privacy policy, and the opt-out is easy to use and lasts. A short, visible notice with a link to the opt-out does that job.

What PIPEDA does not tolerate is a policy that describes a different site from the one running. If the page loads an advertising pixel and the policy mentions only analytics, the consent is not meaningful no matter how the banner is worded.

Quebec is the exception, and it changes the build

Section 8.1 of Law 25 requires telling a visitor about any technology that can identify, locate, or profile them, and how to switch it on. Quebec's regulator reads that as off by default, with the visitor taking a positive step to turn it on. In practice the tracker cannot load until the visitor clicks, refusing has to be as easy as accepting, and each category has to say what it is for. Plain aggregate counting that cannot identify or profile anyone falls outside the rule, though it still belongs in the privacy policy.

A business operating in Quebec is inside this, and one elsewhere that actively serves Quebec customers very likely is too. Geolocating the banner so only Quebec visitors see it is technically possible and usually more trouble than showing everyone the same compliant banner.

Google's rules are not law, and still decide this

A business using Google's advertising tools with visitors in the European Economic Area has to collect their consent and pass it to Google through Consent Mode, and Google's user consent policy extends the consent requirement to the UK and Switzerland. Without it, conversion measurement and remarketing audiences stop working. That is an advertising platform policy rather than Canadian law, and it is the reason a great many Canadian sites carry a banner.

It is worth knowing which of the two reasons applies, because they call for different things. A legal requirement needs a defensible record of consent. A platform requirement needs the signal to reach the tag.

The banner that is worse than no banner

One that fires the trackers before the visitor clicks anything, which is the default configuration of several popular tools and makes the banner decorative. One where Accept is a button and Refuse is a grey link three levels into a settings panel. One that covers the phone number on a mobile screen, which costs real calls on a trades site.

And on a site that loads nothing but a session cookie for the contact form, a banner is a conversion tax paid for a rule that does not apply. Audit what the pages actually load before adding one.