The framework
Canada's framework rests on the PIPEDA + CASL + Quebec Law 25 (provincial), adopted in 2000, with the Office of the Privacy Commissioner as the supervisory authority.
That puts Canada in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
PIPEDA
Consent-based federal private-sector law: knowledge and consent for collection, use and disclosure, with implied consent acceptable for non-sensitive purposes. OPC investigates but cannot fine directly.
CASL (Anti-Spam Legislation)
Express opt-in consent for commercial electronic messages, with limited implied consent (existing business relationship, 2-year window; inquiries, 6 months). Identification and unsubscribe requirements. CRTC penalties to CAD 10M.
Quebec Law 25
GDPR-grade provincial law: express consent standards, privacy by default, transfer impact assessments, automated decision disclosure, portability (from Sept 2024), fines to CAD 25M or 4% of turnover.
Marketing and advertising
Consent is required for collection, use and disclosure; implied consent works for non-sensitive contexts, but CASL makes commercial email and SMS strictly opt-in with limited implied-consent windows. That single sentence decides most channel plans here.
The practical trap for US marketers is that a CAN-SPAM playbook is illegal in Canada. No purchased lists, no opt-out-only sends, and the implied-consent clocks expire. Quebec adds French-language and consent-design duties on top.
Cross-border transfers
Accountability-based: the transferring organization stays responsible; Quebec adds transfer impact assessments.
Enforcement and penalties
CASL penalties reach CAD 10M per violation; Quebec Law 25 fines reach CAD 25M or 4% of worldwide turnover. PIPEDA itself still lacks direct fining power after Bill C-27 died in January 2025.