Bugrahan Unsal, home

AnalyticsBy 6 min read

Tracking after cookies in Canada: what PIPEDA and Quebec’s Law 25 require, and a setup that works

Google and Meta now offer ways to send conversion data from your own server, while Canadian privacy law asks for clear notice and real choices. Here is what PIPEDA and Quebec’s law require, what the tools do and the setup I recommend for a store that sells in Ontario and Quebec.

A website consent banner with Accept, Reject and Choose, and the consent signals that stay denied until a visitor says yes

Which privacy law covers your website

PIPEDA, the federal law, covers the personal information private-sector businesses handle in commercial activity across Canada. Alberta, British Columbia and Quebec have their own substantially similar laws, and PIPEDA does not apply to businesses operating entirely within those provinces unless the information crosses provincial or national borders. Ontario’s similar law covers only health information, so an Ontario store answers to PIPEDA.

If you sell from Ontario into Quebec, plan for both, and design for the stricter Quebec rules. This guide is general information, not legal advice, so have a privacy lawyer review your setup.

What PIPEDA asks of a website

The Office of the Privacy Commissioner of Canada (OPC) set out what meaningful consent takes in guidelines published in May 2018. Your notice has to emphasize four things: what you collect, who you share it with, why, and the risk of harm. Consent should generally be express when the information is sensitive, when the use falls outside what people would reasonably expect, or when it creates a meaningful residual risk of significant harm. You cannot require consent to more than the product or service needs, other choices must be clear and easy to reach, and people can withdraw consent later.

For ad tracking, the OPC’s policy position on online behavioural advertising accepts opt-out consent only when these conditions are met:

  • People learn the purposes clearly, at or before the time of collection.
  • They can opt out easily, and the opt-out takes effect immediately and persists.
  • The information is non-sensitive where practical, avoiding health information.
  • It is destroyed or effectively de-identified as soon as possible.

Tracking people cannot control, such as device fingerprinting, should not be used at all, and websites aimed at children should not carry tracking. PIPEDA’s openness principle adds a public duty: publish the name or title and contact information of the person accountable for privacy, how people can access their information and how they can complain.

What Quebec’s Law 25 adds

Quebec’s private-sector act, as updated by Law 25, is stricter. The Commission d’accès à l’information du Québec (CAI) set out the rules that matter in the joint TikTok investigation it published with the OPC and the BC and Alberta commissioners on September 23, 2025:

  • Tell people at collection why you collect their information and by what means, in clear and simple language.
  • Keep profiling off by default. Before you use technology that can identify, locate or profile a person, tell them about it and how to activate those functions. The functions must be deactivated by default, and the person must make a specific active gesture to turn them on.
  • Publish a privacy policy in clear and simple language on your website if you collect personal information through technological means.

The act defines profiling as collecting and using personal information to assess certain characteristics of a person. Remarketing lists and interest-based ads fit that description, so the cautious reading is opt-in for Quebec visitors. The CAI found that TikTok’s functions that could identify, locate or profile users ran without an active gesture from them, and the investigation found its privacy policy was not available in French.

Consent Mode passes a visitor’s choice to Google’s tags so they adjust what they collect. It does not provide a consent banner, and Google’s developer guide says it is up to you to make sure the correct values are set. It uses four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. There are two ways to run it:

  • Basic: Google tags stay blocked until the visitor uses the banner. If they decline, no data is sent to Google, not even the consent status.
  • Advanced: tags load with consent denied and send cookieless pings while it stays denied. Google lists what these may include: a timestamp, the user agent, the referrer, whether an ad click identifier was in the URL, the consent state and a random number for each page load.

Advanced mode buys better modeling: Google builds an advertiser-specific conversion model instead of a general one. GA4 models visitors who decline only after a property collects at least 1,000 events a day with analytics_storage denied for at least 7 days, and at least 1,000 daily users with it granted on 7 of the previous 28 days. Even then it isn’t guaranteed, so a small store shouldn’t pick advanced mode for modeling it won’t get.

Consent Mode also doesn’t collect consent or control other vendors: the Meta Pixel and every non-Google tag need their own rule to wait for consent.

Server-side tagging is first-party, not consent-free

Server-side tagging moves your measurement tags from the website to a tagging server you control. Point a subdomain of your site at it and the server can read and write cookies that scripts on the page cannot see. Google says a single-server setup is free in most cases; once you upgrade Cloud Run, expect $30 to $50 per server per month, with at least three instances per container recommended.

It doesn’t change your consent duties. The Google tag adds the visitor’s choices to each request, and Google’s tags in the server container adjust what they send, so Consent Mode is set up in the web container only. Anything else you forward, such as events for Meta, should leave the server only when the visitor said yes.

Meta’s Conversions API and the Home Depot lesson

The Conversions API sends events from your server to Meta. Meta recommends using it in addition to the Pixel and sending the same events through both, since the server can capture events the Pixel may miss. Give both versions the same event_name and event_id so a purchase is counted once. Adding customer information parameters can raise Event Match Quality, which Meta scores out of 10, and Meta asks you to hash that information if you don’t use its Business SDK.

Hashing is not consent. In January 2023, the OPC found that Home Depot had sent Meta, through its Offline Conversions program, encoded email addresses and high-level details of in-store purchases from customers who chose an e-receipt. Meta’s terms also let it use that information for its own purposes, such as profiling and targeted advertising. Customers were never told, and the OPC recommended express opt-in consent if Home Depot resumed the sharing. Treat Conversions API events the same way: send them only for visitors who accepted advertising.

A setup for a store that sells in Ontario and Quebec

This is the order I would follow. One banner and one set of rules for both provinces is simpler than splitting by region.

  1. List every tag. Note each pixel, script and app, what it collects, where the data goes and why.
  2. Name the person accountable for privacy, and publish their title and contact details in the privacy policy.
  3. Rewrite the privacy policy in plain English and French. Name Google and Meta, say what each receives and why, and explain how to withdraw consent.
  4. Set the banner to off by default for analytics and advertising, with accept and reject equally easy, and a footer link to change the choice at any time.
  5. Default Consent Mode to denied for all four signals and update them when the visitor chooses. If you want a Quebec-only rule, Google’s region setting takes ISO 3166-2 codes such as CA-QC. Use basic mode if your lawyer wants nothing sent before consent.
  6. Add the server path. Run a tagging server on your own subdomain and forward Conversions API events only for visitors who accepted advertising, with the same event_id the Pixel uses.
  7. Test before launch in Google Tag Assistant and Meta’s test events tool: nothing should fire before consent, and declining should stop it.

On the Bloor West Medspa website I built, Google Analytics loads only after a visitor accepts, declining removes the cookies and the site respects the browser’s Global Privacy Control signal. For Glass Railing Store, which runs separate Ontario and Quebec Shopify stores, I join Shopify orders with Google Ads, Meta Ads and GA4, so budget decisions start from real orders. Conversion tracking and GA4 setup are part of my Google Ads and Meta Ads management, and tracking is checked before launch on every website I build. For the ad side, read Meta Advantage+ and the Conversions API.

Sources

Bugrahan Unsal is a B2B and B2C marketing director in Toronto. He leads marketing for Glass Railing Store and RF Transparent and builds AI tools and websites. More about Bugrahan.

Follow on LinkedIn (opens in a new tab)

More from the blog

Want tracking that measures sales and respects consent?

Tell me about your business and what you want to change. A few sentences are enough, and I reply by email.

Get a free quoteSchedule an interview