Website legal requirements in Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA) sets federal rules for how private-sector organizations collect, use and disclose personal information in commercial activity. Alberta, British Columbia and Quebec have their own substantially similar private-sector privacy laws. When planning forms and app features, consider what personal information you collect and how you will use and disclose it.

Since 1 January 2021, Ontario's Accessibility for Ontarians with Disabilities Act (AODA) has required businesses and non-profits with 50 or more employees to make public websites and web content posted after 1 January 2012 meet WCAG 2.0 Level AA, except live captions and pre-recorded audio descriptions. If this applies to you, include those requirements in your site build.

The Accessible Canada Act, in force since 11 July 2019, applies to federally regulated organizations, including private-sector banks, broadcasting and telecommunications providers and interprovincial or international transportation providers. It aims to make Canada barrier-free by 1 January 2040. Check the requirements for your organisation when planning its website.

Canada's GST is 5%. The harmonized sales tax (HST) is 13% in Ontario, 14% in Nova Scotia and 15% in New Brunswick, Newfoundland and Labrador and Prince Edward Island. Nova Scotia's rate was reduced from 15% on 1 April 2025. Your checkout needs to handle the rate that applies to the sale.

Interac runs Interac Debit for paying with debit cards and Interac e-Transfer for sending and receiving money. Consider which payment methods your checkout needs to support.

Article 52 of Quebec's Charter of the French language requires commercial publications to be in French, including those published on a website. Plan French content for those publications when building your site.

The Canadian Internet Registration Authority (CIRA) runs the .ca domain. Registrants must meet its Canadian Presence Requirements, for example as Canadian citizens, permanent residents or corporations incorporated in Canada. Check your eligibility before choosing a .ca address.

Canada's Anti-Spam Legislation (CASL) requires businesses to obtain consent before sending commercial electronic messages, identify the sender with a current mailing address and include an unsubscribe mechanism. Unsubscribe requests must be actioned within 10 business days. Plan your consent forms and message templates around those requirements.

For sales tax, check the place of supply: the province or territory where the sale is considered to be made, such as where goods are delivered. The GST/HST rate a business charges depends on it.

• Review the personal information collected by your forms and app features.
• Check which privacy law applies to your business.
• Include applicable accessibility requirements in the site build.
• Set up checkout to handle the applicable sales tax.
• Choose the payment methods your checkout will support.
• Plan French content for commercial website publications in Quebec.
• Check your eligibility before registering a .ca domain.
• Collect consent before sending commercial electronic messages and include the required sender details and unsubscribe mechanism.