Bill C-36: A New Proposal to Modernize Canada’s Private-Sector Privacy Law

On June 15, 2026, the federal government introduced Bill C-36, which proposes the most significant update to Canada’s private-sector privacy law in more than 25 years.

If passed, the bill would enact the Protecting Privacy and Consumer Data Act (PPCDA), replacing the privacy provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA). This is the federal government’s third major attempt at private-sector privacy reform in recent years, following Bill C-11 in 2020 and Bill C-27 in 2022, both of which died on the order paper before becoming law.

Bill C-36 carries forward several ideas from those earlier proposals but also introduces a new regulatory structure and places greater emphasis on children’s privacy, data transfers outside Canada and responsible data use.

 

Key Features

The proposed law would:

  • Recognize privacy as a fundamental right while continuing to acknowledge organizations’ legitimate need to use personal information for appropriate commercial purposes.

  • Require organizations to maintain privacy management programs proportionate to the volume and sensitivity of the personal information under their control.

  • Strengthen meaningful consent requirements. Organizations would need to explain, in plain language, what personal information will be collected, how it will be used or disclosed, foreseeable consequences and the names or types of third parties receiving it.

  • Treat children’s personal information as sensitive and require the new regulator to consider children’s best interests when exercising its powers.

  • Give individuals rights to request the disposal of their personal information in certain circumstances and to move their information between organizations where an approved data-mobility framework applies.

  • Establish clearer requirements for de-identified and anonymized information, automated decision systems and transfers of personal information outside Canada.

  • Permit the approval of codes of practice and certification programs designed to help organizations implement the law.

 

Consent and Interest-Based Advertising

Bill C-36 would continue to require valid consent for the collection, use and disclosure of personal information unless a specific exception applies. Express consent would be the default, although implied consent could remain appropriate depending on an individual’s reasonable expectations and the sensitivity of the information involved.

The bill includes exceptions for certain necessary business activities and activities in which an organization has a legitimate interest. Importantly for digital advertising, neither exception would be available where personal information is collected or used for the purpose of influencing an individual’s behaviour or decisions.

This wording will require close attention as the bill proceeds through Parliament. Interest-based advertising relies on data to infer interests and select advertising that is likely to be more relevant to an individual. The proposed consent rules, together with the bill’s transparency, accountability and appropriate-purpose requirements, will therefore be particularly important for organizations operating in the digital advertising ecosystem.

 

A New Enforcement Structure

Bill C-36 would establish a new Digital Safety and Data Protection Commission of Canada, replacing the Office of the Privacy Commissioner of Canada’s long-held duties overseeing private sector enforcement. A designated Privacy and Consumer Data Commissioner within that Commission would oversee and enforce the PPCDA.

The Commission would have order-making powers and could impose administrative monetary penalties of up to the greater of $10 million or 3% of an organization’s gross global revenue. The most serious offences could result in fines of up to the greater of $25 million or 5% of gross global revenue.

 

What DAAC Program Participants Should Know

Bill C-36 is only at the beginning of the legislative process and may change as it moves through Parliament. Important implementation details would also be established later through regulations and regulatory guidance.

The DAAC is reviewing the proposed law closely, including its potential implications for the AdChoices program, guidance, and tools. The AdChoices program already helps participating organizations provide consumers with transparency, choice, and accountability in interest-based advertising. As Canada’s private-sector privacy framework evolves, these practical mechanisms will remain important, but aspects of the program may need to evolve alongside the law.

We will continue to monitor Bill C-36 and keep program participants informed of material developments.

Organizations interested in learning how the AdChoices program can help facilitate compliance and strengthen consumer trust can contact the DAAC at info@daac.ca.

 

References & Suggested Readings

DAACBill C-36, privacy reform, privacy law, Canadian privacy