How do Alberta and BC privacy laws apply to advertising?
Part of US and Canada targeting
The short answer
Alberta and British Columbia each have a Personal Information Protection Act (PIPA) recognized as substantially similar to PIPEDA, so covered organizations are generally exempt from PIPEDA for personal information handled within the province. Both acts require notice and consent for advertising uses of personal information, allow opt-out consent under set conditions, and are enforced by provincial commissioners.
Key takeaways
- Federal exemption orders exempt organizations covered by the Alberta and BC acts from PIPEDA Part 1 for activity within each province, except federal works, undertakings or businesses.
- PIPEDA still applies to personal information transferred across borders, and the OPC says the applicable law is decided case by case.
- Both acts allow opt-out consent only after an understandable notice, a reasonable chance to decline, and a use that is reasonable given the sensitivity.
- A contextual campaign selects pages, not people, but its pixels, lists and measurement can still involve personal information.
Which privacy laws apply to businesses in Alberta and British Columbia?
Each province has a private sector law named the Personal Information Protection Act. The Alberta commissioner (opens in a new tab) says Alberta's act came into force on January 1, 2004, and lists corporations, unincorporated associations, trade unions, partnerships and any individual acting in a commercial capacity among covered organizations. The BC commissioner (opens in a new tab) says BC's act came into effect in January 2004 and applies to private sector organizations, including businesses, unions, political parties and not-for-profits, that handle personal information of individuals in BC.
The BC commissioner adds a reach that matters for advertisers based in the province: "PIPA also applies to any organization located within BC that collects, uses, or discloses personal information of any individual inside or outside of BC." The BC act (opens in a new tab) does not apply where the federal Act applies (section 3(2)(c)).
| Situation | Law named by the official source | Source |
|---|---|---|
| Activity within Alberta by a covered organization | Alberta PIPA, with an exemption from PIPEDA Part 1 | SOR/2004-219 |
| Activity within BC by a covered organization | BC PIPA, with an exemption from PIPEDA Part 1 | SOR/2004-220 |
| Personal information transferred across borders | PIPEDA continues to apply | OPC |
| Federal works, undertakings or businesses, such as banks | PIPEDA continues to apply | OPC and both orders |
How do the Alberta and BC acts relate to PIPEDA?
Definition
- Substantially similar
- The federal status that lets a provincial private sector privacy law apply in place of PIPEDA within that province. The OPC (opens in a new tab) says the Alberta, BC and Quebec laws "have been deemed substantially similar to PIPEDA."
The status works through two federal regulations registered on October 12, 2004. The Alberta order (opens in a new tab) exempts an organization, "other than a federal work, undertaking or business," from Part 1 of PIPEDA "in respect of the collection, use and disclosure of personal information that occurs within the Province of Alberta." The BC order (opens in a new tab) uses the same wording for British Columbia.
The exemption covers activity, not the company as a whole. A Calgary retailer that sends customer email addresses to a platform outside Canada has a flow that crosses from the provincial act to PIPEDA.
Alberta is reviewing its act. The Government of Alberta engagement page (opens in a new tab), last updated March 3, 2026, says a legislative committee completed a review in February 2025 with 12 recommendations and that an online survey ran from February 2 to February 17, 2026. No amending bill was listed there when checked in October 2026.
What consent do the Alberta and BC acts require for advertising uses?
Neither act has a chapter on advertising. Building an email audience, matching a customer list or logging app locations for offers fall under the general rules on consent, notice and reasonable purposes.
| Rule | Alberta PIPA | BC PIPA |
|---|---|---|
| Consent is the default | s. 7(1) | s. 6 |
| No consent beyond what the product or service needs | s. 7(2) | s. 7(2) |
| Notice of purposes before collection | s. 13(1), plus a person who can answer questions | s. 10(1), plus a contact on request |
| Deemed consent | s. 8(2): information provided voluntarily, and reasonable that a person would | s. 8(1): purpose obvious to a reasonable person, information provided voluntarily |
| Opt-out consent | s. 8(3): understandable notice, reasonable opportunity to decline or object, no response, reasonable given sensitivity | s. 8(3): understandable notice, reasonable opportunity to decline, no decline, reasonable given sensitivity |
| Withdrawal | s. 9: withdraw or vary on reasonable notice | s. 9: withdraw on reasonable notice; no prohibiting withdrawal |
| Reasonable purposes | ss. 11 and 16 | ss. 11 and 14 |
The Government of Alberta's guide (opens in a new tab) puts it plainly: "Organizations may use personal information for reasonable purposes, to the extent reasonably necessary." BC section 7(3) adds that consent obtained through false or misleading information or deceptive practices "is not validly given."
The federal and both provincial commissioners jointly issued Guidelines for obtaining meaningful consent (opens in a new tab), last modified August 11, 2025, which set out when organizations must generally obtain express consent. Quebec's commission is not a signatory.
What have the Alberta and BC commissioners found about data collected for targeted ads?
The clearest advertising case is PIPEDA Findings #2022-001 (opens in a new tab), a June 1, 2022 joint investigation by the OPC, Quebec's Commission d'accès à l'information and the Alberta and BC commissioners into the Tim Hortons app. The offices found the company collected granular location data "for purposes of delivering targeted advertising" but "never used the data for this identified purpose."
Our Offices have found, in previous cases, that targeted advertising can be an appropriate purpose for the collection, use and/or disclosure of personal information, depending on the circumstances. However, in our view, a reasonable person would not consider Tim Hortons' purpose to be appropriate in the circumstances of this case.
The offices found the collection breached PIPEDA subsection 5(3), section 5 of Quebec's private sector act, section 11 of PIPA-AB and section 11 of PIPA-BC. The company stopped that collection in August 2020 and agreed to delete the data and set up a privacy management program for the app.
Who enforces the Alberta and BC privacy acts?
The OPC's oversight overview (opens in a new tab), modified January 28, 2026, names the Alberta and BC information and privacy commissioners as each "responsible for overseeing and enforcing" its province's laws, including PIPA. BC section 36 lets the commissioner initiate investigations and audits, and both acts end an inquiry with a commissioner's order under section 52.
| Provision | Alberta PIPA | BC PIPA |
|---|---|---|
| Maximum fine | s. 59(2): $10,000 for an individual, $100,000 otherwise | s. 56(2): $10,000 for an individual, $100,000 otherwise |
| Damages after a final order | s. 60(1) | s. 57(1) |
| Breach notice to the commissioner | s. 34.1: where there is a real risk of significant harm | No such section as consolidated to October 13, 2026 |
The fines attach to listed offences, such as obstructing the commissioner or failing to comply with an order, and in Alberta collecting, using or disclosing personal information in contravention of Part 2.
How do the Alberta and BC acts affect contextual campaigns?
Alberta defines personal information as "information about an identifiable individual", and BC uses the same words while excluding contact information and work product information. The OPC's policy position on online behavioural advertising (opens in a new tab) describes contextual advertising as delivered "based on the content of a particular webpage," and behavioural advertising as based on "tracking data collected across multiple unrelated websites."
The provincial acts still reach the parts of a contextual campaign that touch people: a conversion pixel, an uploaded customer list, a promotional newsletter, an app location prompt, or a study linking exposure to sales.
Facts a media team can record for its privacy lead before an Alberta or BC flight
- The province where the advertiser is located, and whether it is federally regulated.
- Each piece of personal information the campaign touches, with the system that holds it.
- Any transfer outside the province or Canada, and the receiving company.
- The notice text shown before collection, and where it appears.
- The consent basis the advertiser has recorded for each use.
- Which parts of the plan use no personal information.
What does an Alberta and BC brief look like in practice?
Fictional example
A touring theatre company in the East Kootenay and southern Alberta
A fictional nonprofit theatre company in Cranbrook, British Columbia, sells season tickets for shows in Cranbrook, Fernie and Lethbridge, Alberta. Its agency plans fall display beside arts and local events coverage read in both regions.
The site list is built from page content alone. The team then records the flows around it: newsletter addresses held by an email platform outside Canada, a pixel on the thank you page, and box office records. Because the company is located in BC, the BC commissioner's statement on individuals inside or outside the province goes into the file, with the OPC's note on cross-border transfers. No results or performance figures are implied.
How does PlacementGraph select sites for an Alberta or BC brief?
PlacementGraph's site selection reads page content.
Frequently asked questions
Does Alberta's PIPA cover nonprofits that advertise?
Section 56 of Alberta's act says it does not apply to a non-profit organization, as the act defines one, except for personal information collected, used or disclosed in connection with a commercial activity. The act's definition of commercial activity includes selling, bartering or leasing membership lists or donor or other fundraising lists.
Does BC's PIPA follow a BC company's customers in other provinces?
The BC commissioner says PIPA applies to any organization located within BC that collects, uses or discloses personal information of any individual inside or outside of BC. The OPC adds that personal information transferred across borders falls under PIPEDA, and that the applicable law is determined case by case.
Must an Alberta advertiser report a breach at an ad vendor?
Section 34.1 of Alberta's act requires an organization having personal information under its control to notify the commissioner without unreasonable delay of a loss, unauthorized access or disclosure where a reasonable person would consider there is a real risk of significant harm. The duty attaches to information under the organization's control, which can include data held by a vendor.
Is a work email address personal information under BC's PIPA?
BC's act excludes contact information from personal information. It defines contact information as information to enable an individual at a place of business to be contacted, including a name, position name or title, business telephone number, business address, business email or business fax number. A personal email address used to sign up for offers is not in that exclusion.
Sources
- Provincial laws that may apply instead of PIPEDA (opens in a new tab)Office of the Privacy Commissioner of Canada
- Personal Information Protection Act, SBC 2003, c. 63 (current to October 13, 2026) (opens in a new tab)BC Laws, King's Printer
- Personal Information Protection Act, SA 2003, c. P-6.5 (current as of September 1, 2025) (opens in a new tab)Alberta King's Printer
- Organizations in the Province of Alberta Exemption Order (SOR/2004-219) (opens in a new tab)Justice Laws Website, Government of Canada
- Organizations in the Province of British Columbia Exemption Order (SOR/2004-220) (opens in a new tab)Justice Laws Website, Government of Canada
- Personal Information Protection Act (opens in a new tab)Office of the Information and Privacy Commissioner of Alberta
- Legislation (opens in a new tab)Office of the Information and Privacy Commissioner for British Columbia
- Using personal information (opens in a new tab)Government of Alberta
- Personal Information Protection Act engagement (opens in a new tab)Government of Alberta, March 3, 2026
- Guidelines for obtaining meaningful consent (opens in a new tab)OPC, OIPC Alberta and OIPC British Columbia
- PIPEDA Findings #2022-001: Joint investigation of The TDL Group Corp. (Tim Hortons app) (opens in a new tab)Office of the Privacy Commissioner of Canada, June 1, 2022
- Provincial and territorial privacy laws and oversight (opens in a new tab)Office of the Privacy Commissioner of Canada
- Policy position on online behavioural advertising (opens in a new tab)Office of the Privacy Commissioner of Canada
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.