Canada

One of the strictest anti-spam laws globally, requiring express or implied consent before sending commercial electronic messages, installing software, or altering transmission data. Penalties can reach $10 million per violation. Applies to any organization sending commercial electronic messages to or from Canada.

Canada's proposed overhaul of federal privacy law, currently before Parliament. It would replace PIPEDA with the Consumer Privacy Protection Act and create a new AI regulatory framework. Companies operating in Canada should monitor its progress as it will substantially change Canadian privacy obligations.

Canada's federal private-sector privacy law, built on ten fair information principles. It requires meaningful consent for data collection, use, and disclosure, and gives individuals the right to access and challenge the accuracy of their personal data. Applies to private-sector organizations collecting personal information in the course of commercial activity across Canada.

Quebec's modernized privacy law introducing mandatory privacy impact assessments, breach notification, enhanced consent requirements, and the right to data portability. It is notably stricter than the federal PIPEDA. Applies to all private organizations collecting personal information in Quebec.