Face Match App Privacy Law in Canada: What PIPEDA Actually Covers

What to take away

PIPEDA covers face match apps used in commercial activity, and a face template is personal information because it identifies a person.
Quebec, British Columbia and Alberta each have their own private-sector law that applies inside the province instead of PIPEDA.
Consent must be meaningful before the app collects a face image, not buried in a sign-up screen.
The Privacy Commissioner can take a company to Federal Court to force compliance, and the court can order damages.
A face match app that scrapes public photos faces a harder consent problem than one that only processes photos a user uploads.

A face match app is not a camera trick. It builds a numeric template from your face's geometry, stores it, and compares it with others.

Under section 2 of the Personal Information Protection and Electronic Documents Act, that template is personal information because it can identify an individual. The Act covers organizations engaged in commercial activity, so it applies to almost every app a Canadian downloads.

Which law applies to which province

Federal law does not cover the whole country for private-sector data. Three provinces have been declared substantially similar, so their own statutes govern intra-provincial collection.

Table comparing Quebec, BC, Alberta and federal private-sector privacy laws (Face Match App Privacy Law in Canada: What PIPEDA Actually Covers) — The table shows which statute and regulator govern a face match app in each province. Image: Privacy Scam Verification

Private-sector law

Quebec: Act respecting the protection of personal information in the private sector
British Columbia: Personal Information Protection Act
Alberta: Personal Information Protection Act
Ontario, Manitoba, Saskatchewan, Atlantic provinces: PIPEDA applies to private-sector activity

Regulator

Quebec: Commission d'acces a l'information
British Columbia: Office of the Information and Privacy Commissioner for BC
Alberta: Office of the Information and Privacy Commissioner of Alberta
Ontario, Manitoba, Saskatchewan, Atlantic provinces: Office of the Privacy Commissioner of Canada

A Toronto-based developer with customers only in Ontario answers to PIPEDA. The same app sold into Quebec falls under the provincial statute for those users, and Quebec's rules on biometric data are stricter. The Office of the Privacy Commissioner of Canada explains the federal scope in its PIPEDA overview.

What consent has to look like

Consent under PIPEDA must be informed and tied to a stated purpose. A checkbox that says "I agree to the terms" does not meet that bar for biometric data. The company has to say what it does with the face template, how long it keeps it, and who else receives it.

Checklist of five PIPEDA consent requirements for biometric face templates (Face Match App Privacy Law in Canada: What PIPEDA Actually Covers) — A checkbox alone fails; these five steps are what informed consent for a face template requires. Image: Privacy Scam Verification

Identify the purpose before or at the moment of collection.
Name the third parties who will receive the template.
State the retention period in plain terms.
Offer a real withdrawal path, not just account deletion buried in settings.
Record the consent, including the version of the notice the user saw.

Withdrawal matters because a face template cannot be reset the way a password can. Once a template is shared with a partner, the original user has no way to pull it back. That is the practical difference between biometric data and an email address.

Where the claims stop matching the results

A privacy policy that promises "bank-level security" tells a regulator nothing. What counts is whether the template was encrypted at rest, who held the key, and whether the company could delete a single user's template on request.

Several apps advertise deletion while keeping derived vectors in a training set. The user deletes the account, the template stays in the model. Under PIPEDA that is a retention problem, and the company has to justify why the data is still needed.

Example: a small Canadian app that scrapes public photos

Suppose a Montreal developer builds an app that matches your selfie against public images of celebrities. The celebrity is not the customer and never consented.

PIPEDA does not give a blanket exemption for publicly available personal information collected for commercial purposes, and Quebec's law is tighter still. The developer may argue the images are public, but the derived template is new personal information created by the app.

For comparison, the Illinois rule on biometric identifiers is far more prescriptive than anything in Canada, which is why the biometric question to ask first is a useful stress test for any app's consent flow.

Enforcement and consequences

A finding under PIPEDA goes to the Privacy Commissioner first. If the company refuses to comply, the Commissioner can apply to the Federal Court for a hearing. The court can order the organization to change its practices and can award damages to complainants. There is no fine schedule in the statute itself, unlike Quebec's law, which allows administrative penalties.

The exposure is not only legal. A face match company that mishandles templates loses the enterprise customers it needs, because those buyers run their own privacy reviews. The cost gap between a lookalike and a real celebrity shows how quickly a compliance failure eats a marketing budget.

Common questions

Does PIPEDA cover a face match app made outside Canada?

Yes, if the app collects or uses personal information of individuals in Canada in the course of commercial activity. The organization's location does not decide the question.

Can a company rely on implied consent for face data?

Only in narrow cases. The Office of the Privacy Commissioner expects express consent for sensitive information, and biometric templates are treated as sensitive.

What happens if a company refuses to delete a face template?

The individual can complain to the Privacy Commissioner, who can investigate and, if needed, seek a Federal Court order requiring compliance and damages.

Do provincial laws give more protection than PIPEDA?

Quebec's statute does, particularly on biometric data and penalties. British Columbia and Alberta have their own consent and breach rules that differ in detail from the federal model.