Featured · client work
Lunarlink Solutions, Toronto
See it live
No Canadian law requires a cookie banner by name. A banner becomes necessary when a site loads tracking or advertising cookies and either falls under Quebec's Law 25, which requires that technology be off by default, or serves visitors in the EU or UK. A brochure site with no tracking needs no banner.
This is a plain-language summary, not legal advice. Rules change and thresholds get revised, so confirm anything you are relying on against the regulator's own page.
PIPEDA requires meaningful consent for collecting and using personal information, and the Privacy Commissioner has long accepted implied consent for non-sensitive uses where the purpose is clearly explained and an opt-out exists. Under that reading, a privacy policy that names the analytics tool and explains what it records does more work than a banner does.
What PIPEDA does not tolerate is a policy that describes a different site from the one running. If the page loads an advertising pixel and the policy mentions only analytics, the consent is not meaningful no matter how the banner is worded.
Section 8.1 of Law 25 requires that any technology which identifies, locates, or profiles a person be deactivated by default, and Quebec's regulator reads that as express consent before the cookie is set. In practice that means the tracker cannot load until the visitor clicks, refusing has to be as easy and as visible as accepting, and each category has to say what it is for.
A business anywhere in Canada that takes enquiries from Quebec is inside this. Geolocating the banner so only Quebec visitors see it is technically possible and usually more trouble than showing everyone the same compliant banner.
A business running Google Ads or Analytics against visitors in the EEA or the UK has had to send consent signals through Consent Mode since 2024, or lose conversion measurement and remarketing audiences. That is an advertising platform policy rather than Canadian law, and it is the reason a great many Canadian sites carry a banner.
It is worth knowing which of the two reasons applies, because they call for different things. A legal requirement needs a defensible record of consent. A platform requirement needs the signal to reach the tag.
One that fires the trackers before the visitor clicks anything, which is the default configuration of several popular tools and makes the banner decorative. One where Accept is a button and Refuse is a grey link three levels into a settings panel. One that covers the phone number on a mobile screen, which costs real calls on a trades site.
And on a site that loads nothing but a session cookie for the contact form, a banner is a conversion tax paid for a rule that does not apply. Audit what the pages actually load before adding one.
| What the site loads | Visitors outside Quebec, the EU and the UK | Visitors in Quebec | Visitors in the EU or UK |
|---|---|---|---|
| A session cookie for the contact form and nothing else | No banner | No banner | No banner |
| Analytics | Name it in the privacy policy | Consent before it loads | Consent before it loads |
| Advertising or remarketing pixels | Privacy policy and a working opt-out | Consent, off by default | Consent, off by default |
Send the link. We read the site by hand and write back inside five business days.
No call, no commitment
