How PIPEDA and Quebec Law 25 change consent for Canadian social media users

What to take away

• Privacy scam verification in Canada turns on which law covers the platform: PIPEDA federally, Quebec Law 25 in Quebec, and Alberta PIPA or BC PIPA for provincially regulated organizations.
• Consent must be informed and tied to a stated purpose. Quebec Law 25 adds a requirement to ask in clear language and to destroy data once the purpose is met.
• You can file an access request for the personal information a platform holds on you, and the platform must answer within a set time, usually 30 days.
• Identity verification is legitimate when a platform must confirm you are the account holder, but it should collect the minimum needed.
• Minors get extra protection in Quebec, where parental consent rules apply to anyone under 14, and platforms must consider age assurance.
• Complaints go to the Office of the Privacy Commissioner of Canada, Quebec's Commission d'accès à l'information, or the Alberta and BC commissioners, depending on the organization.

Where PIPEDA consent ends and Quebec Law 25 begins

PIPEDA sets the floor for private-sector privacy in Canada. It applies to organizations that collect personal information in the course of commercial activity, including social media platforms, unless a province has its own substantially similar law.

The Office of the Privacy Commissioner of Canada explains how federal and provincial statutes fit together, which matters when you are comparing your rights across provinces (Privacy laws in Canada).

Quebec opted out of PIPEDA for provincially regulated organizations by passing Law 25, which modernized its private-sector statute. If you live in Montreal or Quebec City and deal with a Quebec-based organization, Law 25 is the rulebook, not PIPEDA.

Alberta and BC also have their own private-sector laws, both called PIPA. They were deemed substantially similar to PIPEDA, so they apply to organizations within those provinces instead of the federal act.

The practical effect: a platform can be covered by different consent rules depending on where it operates and where you live. That is why the same privacy setting can mean different things in Ontario, Quebec, Alberta, BC, Nova Scotia, Manitoba or Saskatchewan.

Consent under PIPEDA must be meaningful. The platform has to tell you what it collects, why, and who it may share it with. Consent can be express or implied, but it has to be reasonable in the circumstances.

Quebec Law 25 tightens that. It requires consent to be requested in clear and simple language, separately from other information, and it gives people the right to withdraw consent at any time.

If a company loses your data, the steps you take differ by regime. Our guide on PIPEDA steps to take walks through notification and complaint options.

Consent models compared: PIPEDA, Law 25, Alberta PIPA and BC PIPA

The four regimes share a common ancestor but diverge on detail. The table below sets out the main differences for a social media account.

Feature	PIPEDA	Quebec Law 25	Alberta PIPA	BC PIPA
Consent standard	Meaningful consent, express or implied	Clear, free, informed, separate request	Express or implied, opt-out for some uses	Express or implied, reasonable purposes
Privacy policy	Required, plain language	Required, clear and simple, plus privacy officer	Required	Required
Access request deadline	30 days	30 days	45 days	30 days
Breach notification	Mandatory if real risk of significant harm	Mandatory, plus register maintained by regulator	Mandatory if real risk of significant harm	Mandatory if real risk of significant harm
Minors	No specific age threshold	Parental consent under 14	Under 18, considered in consent	Under 18, considered in consent
Regulator	OPC	Commission d'accès à l'information	OIPC Alberta	OIPC BC

PIPEDA's consent model is flexible. It allows implied consent where the context makes the purpose obvious, such as a platform using your email to send a service notice.

Quebec Law 25 narrows that flexibility. A platform must ask for consent separately for each purpose and cannot bundle it into a single terms-of-service click if the purposes are unrelated.

Alberta PIPA allows implied consent but requires an opt-out mechanism for certain uses. It also treats personal employee information differently from customer data.

BC PIPA is similar to Alberta's in structure. It requires organizations to designate a privacy officer and to collect only what a reasonable person would consider appropriate.

The business-side obligations under PIPEDA are set out by the OPC for organizations that handle personal data (Privacy for businesses).

One difference that catches people out: Alberta PIPA gives organizations up to 45 days to respond to an access request, while PIPEDA, BC PIPA and Law 25 generally require 30 days.

What a social media platform must tell you before using your data

Before a platform uses your data for a new purpose, it has to tell you in a way you can understand. Under PIPEDA that means the purpose must be stated at or before collection.

Quebec Law 25 adds a timing rule. If the platform wants to use your data for a purpose it did not originally disclose, it must inform you and, in some cases, seek fresh consent.

Platforms must also name a privacy officer or contact point. In Quebec the person must be identified and their contact details published.

A typical platform will tell you about data used for advertising, recommendations, safety and analytics. What matters is whether those purposes are described separately or lumped into one clause.

If the description is vague, you can ask for more detail. The OPC's guidance for individuals covers how to raise a concern and what to expect (For individuals).

A proper social media privacy audit starts with reading the platform's privacy policy and comparing it to what the settings actually allow.

Watch for purposes that are described as future or unspecified. PIPEDA does not allow open-ended consent for uses that have not been defined.

Access requests: how to ask, and what each regulator expects back

An access request is your right to see the personal information a platform holds about you. You can make one under PIPEDA, Law 25, Alberta PIPA or BC PIPA.

Under PIPEDA the platform must respond within 30 days. It can extend that period in limited cases, but it must tell you why.

The OPC explains the access request process and what information you can ask for (Accessing personal information).

1. Write to the platform's privacy officer, not general support, and state that you are making an access request under the relevant law.
2. Describe the information you want: account data, login history, advertising profiles, or messages.
3. Ask for an explanation of how the data has been used and who it was disclosed to.
4. Keep a copy of the request and note the date, because the clock starts when the request is received.
5. If the deadline passes, follow up in writing and then consider a complaint to the regulator.

Quebec Law 25 requires the response to be in clear language and to include the source of the information where possible.

Alberta PIPA allows 45 days and permits the organization to charge a reasonable fee, provided it gives an estimate first.

BC PIPA requires a response within 30 days and limits fees to the actual cost of copying or transcribing.

If a platform refuses, it must give reasons. A refusal based on solicitor-client privilege or another listed exception is allowed, but the platform cannot simply ignore the request.

The federal statutes behind these rules are published on the Justice Laws Website, which is the authoritative source for PIPEDA's text.

Identity verification duties when a platform checks who you are

Platforms verify identity for several reasons: to stop impersonation, to comply with age rules, or to prevent fraud. The privacy question is whether the check is proportionate.

PIPEDA requires the platform to collect only the information necessary for the stated purpose. A platform that asks for a full SIN or a passport scan to let you post a comment is likely collecting too much.

Quebec Law 25 adds a requirement to destroy identifying information once the purpose is fulfilled, unless retention is required by law.

In Canada, Service Canada handles SIN issuance and verification, and the SIN is not a general-purpose identifier. You should not hand it to a social platform.

Identity verification is also a common hook in scams. A message that demands you verify your account through a link is a phishing attempt, not a legitimate check.

The area is changing. Our overview of the canadian anti-fraud centre report scam covers the direction of travel for platforms and regulators.

If a platform asks you to prove who you are, ask what it will store, how long it will keep it, and whether a third party will process it. The answers belong in its privacy policy.

Before you hand over documents, read our guidance on the facebook marketplace interac e-transfer scam and what safeguards to demand.

Age assurance and minors' consent under Canadian privacy law

Quebec Law 25 sets a clear age threshold. Anyone under 14 must have parental or guardian consent for their personal information to be collected.

That rule applies to Quebec-based organizations and to platforms that target Quebec users. It changes how a platform can onboard younger teenagers.

PIPEDA does not set a specific age. The OPC expects organizations to obtain meaningful consent and to consider whether a young person can understand what they are agreeing to.

Alberta and BC PIPA treat minors' information as sensitive and expect organizations to consider the capacity of the individual.

Age assurance is the technical side of this. A platform may ask for a date of birth, an ID check, or an estimate based on account signals.

Each method has a privacy cost. A date of birth is low friction but easy to falsify. An ID scan is accurate but collects sensitive data that must then be protected and deleted.

Quebec Law 25 pushes platforms toward collecting less identifying data for age checks where possible. That is a tension platforms have not fully resolved.

Complaints and enforcement: OPC, Quebec's regulator and provincial bodies

If a platform ignores your request or mishandles your data, you can complain. The right body depends on the law that covers the organization.

For federally regulated organizations, complaints go to the Office of the Privacy Commissioner of Canada. The OPC can investigate, issue findings, and in some cases take the matter to Federal Court.

In Quebec, the Commission d'accès à l'information oversees Law 25. It can investigate complaints and impose administrative penalties.

The Office of the Information and Privacy Commissioner of Alberta handles Alberta PIPA complaints. Its BC counterpart, the Office of the Information and Privacy Commissioner for BC, handles BC PIPA.

Breach notification matters too. If a platform suffers a breach that creates a real risk of significant harm, it must notify affected individuals and the OPC.

Quebec Law 25 requires organizations to keep a register of breaches and to report them to the Commission d'accès à l'information.

For fraud and scam reports, the Canadian Anti-Fraud Centre collects complaints that feed into law enforcement. The Competition Bureau Canada handles deceptive marketing claims, and the Canadian Centre for Cyber Security publishes threat advice.

Enforcement is uneven. The OPC has limited order-making power under PIPEDA, while Quebec's regulator can issue penalties. That difference is one reason some advocates want PIPEDA reformed.

Practical checklist for auditing your own social media consent settings

Use this checklist once per platform, and revisit it when the platform updates its policy.

• Read the privacy policy and note each purpose for which your data is used.
• Check whether advertising and analytics are described separately or bundled into one consent.
• Review your privacy settings for ad personalization, location and contact syncing.
• Turn off permissions you do not need, such as microphone, camera or contacts access.
• Submit an access request if you want to see what the platform holds on you.
• Check whether the platform names a privacy officer and how to contact them.
• Note the date you changed anything, so you can show a timeline if you complain later.

Worked example: a Quebec user under 14 wants an account. The platform must obtain parental consent under Law 25 before collecting any personal information. If the platform instead relies on a self-declared date of birth and no parental step, that is a gap worth reporting to the Commission d'accès à l'information.

For an Alberta user, the same platform might rely on implied consent under Alberta PIPA. The user can still withdraw consent and ask for deletion, and the organization has 45 days to answer an access request.

A BC user has 30 days for an access request and can complain to the BC commissioner if the platform charges an unreasonable fee.

Consent is not permanent. Under all four regimes you can withdraw it, though withdrawing may mean losing access to a feature that depends on the data.

Keep records. A screenshot of the setting, the date, and the platform's response are the evidence a regulator needs.

Common questions

Does PIPEDA or Quebec Law 25 apply to my social media account? It depends on where the organization is regulated. PIPEDA covers most federally regulated private-sector organizations, while Law 25 applies to provincially regulated organizations in Quebec. Many large platforms fall under PIPEDA.

How long does a platform have to answer an access request? Thirty days under PIPEDA, Quebec Law 25 and BC PIPA. Alberta PIPA allows up to 45 days. The platform must tell you if it needs an extension.

Can a platform ask for my SIN to verify my identity? It should not. The SIN is not a general-purpose identifier, and PIPEDA requires organizations to collect only what is necessary for the stated purpose. A social platform rarely has a legitimate need for it.

What age triggers parental consent in Quebec? Under 14. Quebec Law 25 requires parental or guardian consent before an organization collects personal information from a child under that age.

Where do I complain if a platform mishandles my data? Start with the platform's privacy officer. If that fails, complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information in Quebec, or the Alberta or BC privacy commissioner, depending on the law that applies.

Is identity verification on social media always a scam? No. Platforms sometimes need to confirm you are the account holder. The warning sign is a demand for documents through an unsolicited link, or a request for more data than the check requires.