Using Cookiebot for PIPEDA compliance

If your company has customers in Canada and you collect, use or disclose personal information in the course of commercial activities, you need to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA).

This guide is focusing solely on providing the tools needed to make your website’s use of cookies and online tracking compliant with PIPEDA. Other aspects of PIPEDA are therefore not covered or addressed in the checklist.

The checklist is not intended as legal advice - if in doubt, seek advice from a trusted legal source or your Data Protection Authority.

Configure your CMP for PIPEDA

✔ Check 1: Create a new domain group

New to Cookiebot?

Don’t already have a Cookiebot account? Sign up for a free trial today and see how we can help you with your website compliance. Follow our guide here to get started!

Already have a Cookiebot account?

Please note: If you are already using Cookiebot for GDPR and ePR compliance, you can most likely use the existing banner configuration in the domain group you set up for GDPR compliance.

Alternatively, you can create a new domain group for your PIPEDA setup. Want to use our solution to cover GDPR, PIPEDA and maybe even CCPA as well? No problem! See our guide on how to setup multiple banners on the same domain with no additional cost to cover different regions.

If this is part of a multi-legislation setup with a domain already configured for GDPR/ePR, please leave this field empty!

✔ Check 2: banner type

Navigate to Settings > Dialog. For PIPEDA compliance, make sure to have the following configurations added;

✔ Check 3: Add your geo configurations

If you'd like to limit the banner to be displayed only to visitors from Canada, you can do so by configuring "Distribution" at the bottom of the page:

✔ Check 4: Set your banner language

✔ Check 5: Check your monthly scan report

With Cookiebot you receive monthly scan reports with detailed information on cookies and other tracking found on your website. Your report will currently only highlight compliance towards the GDPR adequacy list. This information should be manually assessed in relation to PIPEDA.

Make sure to check your report for these 3 things;

Unclassified cookies
Cookie not blocked prior consent
Data is sent to adequate countries^*

^*GDPR introduced the notion of data protection “adequacy”, where certain countries outside of the EU are deemed to have “GDPR-adequate” levels of personal data rights and protection measures in place. Data transfer can happen to these countries without the need for additional safeguards and similar to intra-EU transmissions of data. The list of adequate countries can be found here: the GDPR Adequacy decision list.

PIPEDA takes a similar approach, however the list of PIPEDA-adequate countries has not yet been published. It is known however, that the countries operating under GDPR (EU plus Norway, Liechtenstein and Iceland) are deemed PIPEDA-adequate.

Limitations in the Cookiebot compliance test and scan: Currently the Cookiebot compliance test does not fully support PIPEDA as a separate legislation from GDPR. We’re working on this.
Our current compliance test will scan your website and assess your compliance against the GDPR ruleset. This has no effect on Cookiebot’s ability to comply with PIPEDA.

✔ Check 6: Get your scripts

Navigate to the "Your scripts" pane
Follow the instructions to insert your banner and cookie declaration on your website.
If you intend to implement Cookiebot CMP by other means than manually adding the script(s) to your template, please refer to our implementation section in the Help Center.

Check out our blog post: PIPEDA: Canada’s data privacy law explained

How to setup coexisting configurations