Canada and Québec privacy enforcement

Order or finding

Clearview AI

Commission d'accès à l'information du Québec, 16 October 2026 Final

The Court of Quebec upheld the CAI's December 2021 order requiring Clearview AI to stop collecting Quebecers' images scraped from the internet and to destroy their images and biometric identifiers. The court rejected Clearview's arguments that Quebec law did not apply to it and that the consent rules unjustifiably limited free expression.

• Biometric data and facial recognition
• No lawful basis for processing
• Selling or brokering personal data

Quebec Private Sector Act

Order or finding

X Corp. and X.AI LLC (Grok)

Office of the Privacy Commissioner of Canada, 11 June 2026 Final

After reports that the Grok chatbot generated sexually explicit deepfakes of real people, the OPC opened its own complaints and found that X Corp. and xAI had no valid consent for this use of personal information and that a reasonable person would see the practice as inappropriate. The matter was found well-founded and not resolved, with the companies disagreeing with the conclusions.

• AI systems and chatbots
• No lawful basis for processing

PIPEDA, s 5(3), s 11(2)

Order or finding

OpenAI OpCo, LLC

Office of the Privacy Commissioner of Canada, 6 May 2026 Final

A joint federal and provincial investigation examined how OpenAI collected personal information from public websites, licensed datasets and user chats to train and run the GPT-3.5 and GPT-4 models behind ChatGPT. The OPC found the complaint well-founded and conditionally resolved on the basis of mitigation measures OpenAI described, while the BC and Alberta commissioners found the training-data issue well-founded and unresolved under their laws.

• AI systems and chatbots
• No lawful basis for processing
• Missing or unclear privacy information

PIPEDA; Quebec Private Sector Act; PIPA (BC); PIPA (Alberta)

Order or finding

Loblaw Companies Limited (PC Optimum)

Office of the Privacy Commissioner of Canada, 5 March 2026 Final

Following complaints from loyalty members who closed their PC Optimum accounts during a consumer boycott, the OPC found that Loblaw took too long to handle deletion requests and had not shown that purchase histories it kept after account closure were truly anonymised. The findings were well-founded, with Loblaw agreeing to a third-party re-identification assessment.

• Keeping data too long
• Failing to answer privacy requests

PIPEDA, Schedule 1 Principle 4.5.3, Principle 4.10

Order or finding

Bell Canada

Office of the Privacy Commissioner of Canada, 9 January 2026 Final

The OPC found that Bell missed the 30-day deadline to answer a customer's access request without seeking an extension, and wrongly refused him his own phone line's call logs because the account was held by his former spouse. Both issues were found well-founded, with Bell committing to update procedures, training and its privacy policy.

• Failing to answer privacy requests

PIPEDA, s 8(3), Schedule 1 Principle 4.9

Order or finding

TikTok Pte. Ltd.

Office of the Privacy Commissioner of Canada, 23 September 2025 Final

A joint investigation by the federal, Quebec, BC and Alberta privacy regulators found that TikTok relied on a self-declared age gate that let many under-age children onto the platform, and used their data for ad targeting and content recommendations without meaningful consent. The regulators found the matter well-founded and conditionally resolved after TikTok committed to stronger age assurance and other fixes.

• Children's data
• No lawful basis for processing
• Missing or unclear privacy information

PIPEDA; Quebec Private Sector Act; PIPA (BC); PIPA (Alberta)

Order or finding

23andMe Inc.

Office of the Privacy Commissioner of Canada, 20 June 2025 Final

In a joint investigation with the UK ICO, the OPC found that 23andMe lacked adequate safeguards against a months-long credential stuffing attack that exposed genetic, health and ethnicity data linked to almost 7 million customers, including about 319,000 people in Canada, and that its breach notifications were deficient. Both issues were found well-founded and resolved after the company improved its security.

• Weak security leading to a breach
• Health data shared or exposed

PIPEDA, Schedule 1 Principle 4.7, s 10.1, Breach of Security Safeguards Regulations ss 2 and 3

Order or finding

Metro Inc.

Commission d'accès à l'information du Québec, 18 February 2025 Under appeal

The CAI barred Metro from putting into service a biometric database for a facial recognition pilot meant to spot past shoplifters and fraudsters in Metro, Super C and Jean Coutu stores, because identity verification by biometrics needs express consent it did not plan to obtain. It was the first order under section 45 of the IT framework act.

• Biometric data and facial recognition
• No lawful basis for processing

Act to establish a legal framework for information technology (LCCJTI); Quebec Private Sector Act, LCCJTI s 44, LCCJTI s 45

Order or finding

LifeLabs

Office of the Information and Privacy Commissioner for British Columbia, 25 November 2024 Final

The BC and Ontario commissioners published their 2020 joint report finding that LifeLabs did not take reasonable steps to protect the health and personal information of millions of Canadians before a 2019 cyberattack. Publication followed the failure of LifeLabs' court bid to keep the report private on privilege grounds; LifeLabs had already complied with the orders.

• Weak security leading to a breach
• Health data shared or exposed

PIPA (BC); PHIPA (Ontario)

Order or finding

Aylo (formerly MindGeek), operator of Pornhub

Office of the Privacy Commissioner of Canada, 29 February 2024 Final

The OPC found that Aylo relied on uploaders to vouch for consent instead of getting consent from the people shown in intimate content, and did not give those people an effective way to have the content taken down. The complaint was found well-founded and unresolved, and on 3 March 2025 the Commissioner applied to the Federal Court for an order requiring compliance.

• No lawful basis for processing
• Failing to answer privacy requests
• Governance, DPO or impact assessment

PIPEDA, Schedule 1 Principle 4.3, Principle 4.10, Principle 4.10.2, Principle 4.1

Order or finding

Home Depot of Canada Inc.

Office of the Privacy Commissioner of Canada, 26 January 2023 Final

The OPC found that Home Depot sent hashed email addresses and in-store purchase details of e-receipt customers to Meta through the Offline Conversions tool, which Meta could also use for its own advertising, without the express consent customers would expect. The complaint was well-founded and resolved after Home Depot stopped using the tool in October 2022.

• Advertising pixels sharing visitor data
• No lawful basis for processing
• Missing or unclear privacy information

PIPEDA

Order or finding

The TDL Group Corp. (Tim Hortons)

Office of the Privacy Commissioner of Canada, 1 June 2022 Final

A joint federal and provincial investigation found that the Tim Hortons app, through a third-party SDK, tracked users' location as often as every few minutes even when the app was closed, to infer home, work and visits to competitors, without valid consent or an appropriate purpose. The matter was well-founded and conditionally resolved after the company committed to delete the data and set up a privacy management programme.

• Advertising pixels sharing visitor data
• No lawful basis for processing
• Collecting more data than needed

PIPEDA; Quebec Private Sector Act; PIPA (BC); PIPA (Alberta), s 6.1

Law and guidance

Les interfaces truquées : un obstacle à la protection des renseignements personnels

Commission d'accès à l'information du Québec, 22 October 2026 In force

The CAI published a web page on deceptive design in digital services, warning that interfaces that steer people into sharing more data can invalidate their consent and make later use or disclosure of the data unlawful. The page covers types of dark patterns, legal obligations and good practice for organisations.

• Misleading design (dark patterns)

Quebec Private Sector Act

Law and guidance

C-36 (45-1) - LEGISinfo - Parliament of Canada

Parliament of Canada, 15 June 2026 Coming up

The federal government introduced Bill C-36 on 15 June 2026 to enact the Protecting Privacy and Consumer Data Act and amend PIPEDA, the latest attempt to replace Canada's private sector privacy law. As of this check the bill is at second reading in the House of Commons and is not law.

Bill C-36, Protecting Privacy and Consumer Data Act

Law and guidance

C-27 (44-1) - LEGISinfo - Parliament of Canada

Parliament of Canada, 6 January 2025 In force

Bill C-27, which would have enacted the Consumer Privacy Protection Act and the Artificial Intelligence and Data Act, never passed: the parliamentary session ended on 6 January 2025 while it was still in committee in the House of Commons. PIPEDA therefore remained the federal private sector law.

Bill C-27, Digital Charter Implementation Act, 2022 (Consumer Privacy Protection Act, AIDA)

Law and guidance

Entrée en vigueur des dispositions sur la portabilité

Commission d'accès à l'information du Québec, 22 September 2024 In force

The data portability right under Quebec's Law 25 came into force on 22 September 2024, the last phase of the reform. Individuals can now ask businesses and public bodies for computerised personal information they provided in a structured, commonly used technological format.

• Failing to answer privacy requests

Quebec Law 25

Law and guidance

Critères de validité du consentement : la Commission adopte ses lignes directrices

Commission d'accès à l'information du Québec, 31 October 2023 In force

The CAI published the final version of its guidelines on the criteria for valid consent under Law 25, revised after a public consultation held from May to July 2023. The guidelines are the regulator's reference point for how organisations should obtain consent, including online.

• No lawful basis for processing

Quebec Law 25

Law and guidance

Des dispositions de la Loi 25 qui entrent en vigueur aujourd'hui

Commission d'accès à l'information du Québec, 22 September 2023 In force

The main business obligations of Quebec's Law 25 took effect on 22 September 2023, as part of a phased rollout that began in 2022 and ended in 2024. From the same date the CAI gained the power to impose administrative monetary penalties on businesses and published its framework for applying them.

Quebec Law 25