Consent is the cornerstone of Canadian privacy law. Under PIPEDA, organizations must obtain meaningful consent before collecting, using, or disclosing personal information.
What Makes Consent Valid
For consent to be meaningful, individuals must understand what they are consenting to. Valid consent requires:
- Clear explanation of what information is being collected
- Clear explanation of why it is being collected
- Clear explanation of how it will be used and who it will be shared with
- The ability to say no without penalty
Express consent is explicit: the individual actively agrees, such as by checking a box or signing a form. Implied consent is inferred from actions or context: providing a business card implies consent to be contacted for business purposes. The more sensitive the information, the more explicit the consent should be.
Withdrawing Consent
Individuals have the right to withdraw consent at any time, subject to legal or contractual restrictions. Organizations must have a process for handling consent withdrawal and must stop using the information for the purpose the individual has withdrawn consent for.
Consent for Children
Special care is required when collecting personal information from or about children. Parental consent is generally required for children under 13, and organizations should use age-appropriate language and processes.
When Consent Is Not Required
PIPEDA allows collection without consent in limited circumstances: for journalistic, artistic, or literary purposes; for law enforcement; for emergency situations; and for certain business transactions. These exceptions are narrow and should not be used as a general workaround.
Learn how long to keep data in Retention.