What does PIPEDA guidance say about online advertising, and what does it mean for contextual plans?
Part of US and Canada targeting
The short answer
The Office of the Privacy Commissioner of Canada says information used for online behavioural advertising will generally be personal information under PIPEDA, so meaningful consent is required. Opt-out consent can be reasonable only under six stated conditions, sensitive information should be avoided, and tracking people cannot decline should not be used. The OPC describes contextual advertising as a separate model.
Key takeaways
- The OPC defines online behavioural advertising as tracking people's online activities across sites and over time to serve ads tailored to their inferred interests.
- Its policy position lists contextual and webpage contextual advertising as their own models and addresses behavioural advertising only.
- Opt-out consent for behavioural advertising can be reasonable only when six conditions are met, and the OPC rules out techniques such as zombie cookies, super cookies and device fingerprinting.
- Past OPC findings on health based remarketing in 2014 and a carrier's ad program in 2015 turned on sensitive information and the form of consent.
- PIPEDA remained the federal private sector law in October 2026; Bill C-36, which would enact a new act, was at second reading in the House of Commons.
How does the OPC tell behavioural advertising apart from contextual advertising?
The Office of the Privacy Commissioner of Canada (OPC) has published two core documents on the subject: a policy position on online behavioural advertising (opens in a new tab) and shorter guidelines on privacy and online behavioural advertising (opens in a new tab). Both pages show a date modified of August 11, 2025. The policy position opens by sorting online ads into five models, which is the clearest way to see where a contextual plan sits.
| Model | How the OPC describes it | OPC example |
|---|---|---|
| Random advertisements | Ads placed randomly, not based on website content or user preferences | None given |
| Contextual advertisements | Uses information about a user's current visit to a site to serve a targeted ad on that site | Pet ads on a website about pets |
| Webpage contextual advertisements | An ad is delivered based on the content of a particular webpage | Dog ads on a puppy page, cat ads on a kitten page of the same site |
| First party targeted ads | The first party a person has a relationship with builds a profile and serves ads from it; the user is not tracked over different unrelated websites | None given |
| Online behavioural advertising | An advertising service places an ad based on tracking data collected across multiple unrelated websites | Pet ads on an online newspaper for someone who visited pet sites earlier |
Why does the OPC treat behavioural advertising data as personal information?
PIPEDA defines personal information as information about an identifiable individual. The OPC applies the Federal Court's test: information is about an identifiable individual where there is a serious possibility that a person could be identified through it, alone or combined with other available information.
The policy position walks through the simplest case, a third party cookie holding only a seemingly random serial number. Because that number follows a person from site to site, the OPC says it can quickly be associated with an IP address, browser type and technical settings, websites visited, search terms and form entries, transactions, and usernames on web services. The OPC accepts that a cookie, an IP address or browser settings may not be personal information in and of themselves, but says that when combined and used to profile a user for targeted ads, the information can become information about an identifiable individual.
As such, we take the position that the information involved in online tracking and targeting for the purpose of serving behaviourally targeted advertising to individuals will generally constitute personal information.
When does the OPC say opt-out consent can be reasonable for behavioural ads?
PIPEDA requires knowledge and consent, and the OPC notes that the form of consent can vary: express consent, or opt in, for sensitive information, and implied consent, or opt out, when information is less sensitive. For behavioural advertising, the guidelines set six conditions under which opt-out consent could be considered reasonable. A footnote adds that section 6.1 of PIPEDA, added after the guidance was written, makes consent valid only if it is reasonable to expect the person to understand the nature, purpose and consequences of what they agree to.
The OPC's six conditions for opt-out consent to behavioural advertising
- People are made aware of the purposes in a clear and understandable way, and the purposes are not buried in a privacy policy.
- People are told the purposes at or before the time of collection, along with information about the various parties involved.
- People can easily opt out, ideally at or before the time the information is collected.
- The opt-out takes effect immediately and is persistent.
- The information collected and used is limited, as far as practicable, to non-sensitive information.
- The information is destroyed as soon as possible or effectively de-identified.
Two restrictions sit on top of the conditions. First, if a person cannot decline the tracking because there is no viable way to control the technology, or if declining makes a service unusable, the OPC says organizations should not use that technology for behavioural advertising, naming zombie cookies, super cookies and device fingerprinting as examples. Second, as a best practice, organizations should avoid tracking children and tracking on websites aimed at children.
Definition
- Sensitive information, in the OPC's list
- Health and financial data, ethnic and racial origins, political opinions, genetic data, uniquely identifying biometric data, a person's sex life or sexual orientation, and religious or philosophical beliefs. The OPC adds that sensitivity also depends on the context of collection, use or disclosure.
What have OPC investigations found about ad targeting?
OPC reports of findings apply the guidance to real programs. The two below concern targeted advertising directly, and both turned on what kind of information was used and how consent was obtained, not on whether ads were shown at all.
| Finding | What the OPC examined | What the OPC concluded |
|---|---|---|
| PIPEDA Report of Findings 2014-001 (opens in a new tab), January 14, 2014 | Ads about a medical device that followed a person to unrelated websites after they searched for information on sleep apnea, which the OPC treated as remarketing | The information was sensitive personal health information, so implied consent was not acceptable for ads based on that online behavior |
| PIPEDA Report of Findings 2015-001 (opens in a new tab), April 7, 2015 | A carrier's targeted ad program built customer profiles from internet, phone and television usage plus account and demographic information | The OPC recommended opt-in consent; the carrier withdrew the program, said it would delete existing profiles, and said a future similar program would use express opt-in consent |
The OPC's separate guidance on inappropriate data practices (opens in a new tab) sets out no-go zones under subsection 5(3) of PIPEDA, which limits collection, use and disclosure to purposes a reasonable person would consider appropriate. One no-go zone is profiling or categorization that leads to unfair, unethical or discriminatory treatment contrary to human rights law. The OPC says no-go zones may evolve over time.
What does the OPC's guidance imply for a contextual media plan?
The OPC's own taxonomy draws the line a planner needs: behavioural advertising depends on tracking across unrelated sites, while webpage contextual advertising depends on the content of the page. Two cautions follow from the OPC's wording. Its definition of contextual advertising refers to information about a user's current visit, so contextual does not automatically mean no data. And the scope note says other uses of browsing information may also raise privacy issues.
In practice, a contextual plan has two layers. The site list itself is built from publisher pages and articles. The delivery layer, which includes measurement tags, frequency caps, location settings and any audience segment added on top, is where personal information can enter. Keeping the two layers apart in the plan makes the review simpler, because the questions the OPC raises attach to the second layer.
Four steps to document a contextual plan for privacy review
- Describe the selection method. State that sites and pages were chosen by content, and list the inputs used, such as article text, page language and public country popularity data.
- List every delivery tag. Name each pixel, tag or measurement script, who receives its data, and whether it tracks people across unrelated sites.
- Mark any audience layer. Note retargeting, customer lists or interest segments separately, since these are where the OPC's behavioural advertising guidance applies.
- Flag sensitive topics. Record whether the plan touches health, financial or other categories on the OPC's sensitive list, which the OPC links to express consent.
Fictional example
An eyewear retailer in Canada's North
Lumivane Optical, a fictional online eyeglasses and contact lens retailer, wants English display ads for customers in Yukon, the Northwest Territories and Nunavut. The brief asks for placements beside reading, travel and local news content, plus retargeting of visitors who viewed prescription lens pages.
The planner builds the site list from article content and documents it as webpage contextual selection. The retargeting request is recorded as a separate audience layer and flagged, since prescription browsing relates to health, the category in the OPC's 2014 finding. The client's privacy counsel reviews that layer before anything goes live.
Is PIPEDA about to be replaced?
Not yet, as of October 21, 2026. Parliament's LEGISinfo page for Bill C-36 (opens in a new tab) shows a government bill titled An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts. It was introduced and read a first time on June 15, 2026, and its current status is at second reading in the House of Commons.
An earlier reform, Bill C-27 (opens in a new tab), introduced on June 16, 2022 to enact the Consumer Privacy Protection Act, was referred to committee after second reading on April 24, 2023 and did not become law. Until a new act passes and comes into force, PIPEDA and the OPC's guidance remain the federal reference points.
How does PlacementGraph keep site selection apart from behavioural data?
PlacementGraph works on the site selection layer of a plan and leaves delivery to the buying platform.
Frequently asked questions
Is an IP address personal information under PIPEDA?
The OPC says items such as third party cookies, IP addresses and browser settings may not be personal information in and of themselves. It also says that when they are combined and used to profile a person for targeted ads, the information can become information about an identifiable individual, and should generally be considered personal information in that context.
Can a website require visitors to accept behavioural ads?
The OPC's position is that behavioural advertising may be an appropriate purpose under subsection 5(3) of PIPEDA but should not be a condition for using the Internet generally. It cites Principle 4.3.3, under which an organization shall not require consent beyond what is needed for the explicitly specified, legitimate purposes as a condition of supplying a product or service.
Does the OPC give advance rulings on advertising practices?
The policy position says the OPC does not provide advance rulings, and that complaints about behavioural advertising are assessed case by case on their specific facts. Its documents give general guidance on likely compliance and non-compliance, which is why findings such as the 2014 and 2015 reports are read closely.
When does the OPC expect express consent?
The OPC's guidelines for obtaining meaningful consent say organizations must generally obtain express consent when the information is sensitive, when the collection, use or disclosure is outside the person's reasonable expectations, or when it creates a meaningful residual risk of significant harm. Consent should generally be express and can be implied only in strictly defined circumstances.
Sources
- Guidelines on privacy and online behavioural advertising (opens in a new tab)Office of the Privacy Commissioner of Canada
- Policy position on online behavioural advertising (opens in a new tab)Office of the Privacy Commissioner of Canada
- Guidelines for obtaining meaningful consent (opens in a new tab)Office of the Privacy Commissioner of Canada
- Guidance on inappropriate data practices: interpretation and application of subsection 5(3) (opens in a new tab)Office of the Privacy Commissioner of Canada
- PIPEDA Report of Findings 2014-001 (opens in a new tab)Office of the Privacy Commissioner of Canada
- PIPEDA Report of Findings 2015-001 (opens in a new tab)Office of the Privacy Commissioner of Canada
- Bill C-36 (45th Parliament, 1st session) (opens in a new tab)LEGISinfo, Parliament of Canada
- Bill C-27 (44th Parliament, 1st session) (opens in a new tab)LEGISinfo, Parliament of Canada
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.