Consumer protection, competition and privacy

Contract law assumes two parties bargaining on roughly equal terms. Consumer transactions rarely look like that: a business drafts standard terms, controls information and deals with thousands of customers who cannot negotiate. Legislatures have therefore added three bodies of regulation that apply to almost every business: consumer protection law, which limits unfair practices and gives consumers special rights; competition law, which protects markets from price-fixing, abuse of market power and deceptive marketing; and privacy and anti-spam law, which governs how businesses collect, use and protect personal information. Penalties in all three areas have risen sharply in recent years, and private class actions follow many enforcement actions.

Consumer protection statutes

Consumer protection is mainly provincial. Each province has a consumer protection statute, such as Ontario's Consumer Protection Act, 2002, British Columbia's Business Practices and Consumer Protection Act and Quebec's Consumer Protection Act, which apply to transactions between businesses and individuals acting for personal, family or household purposes. Ontario passed a new Consumer Protection Act in 2023 to replace the 2002 Act; it takes effect on proclamation with new regulations, so businesses should check its status. These statutes typically do four things: they prohibit unfair practices, such as false, misleading or deceptive representations and unconscionable representations; they impose disclosure and cancellation rules for particular types of agreement, such as internet, direct (door-to-door), remote and future performance agreements; they make certain terms void, such as those excluding implied warranties, waiving class actions or forcing consumers into arbitration; and they give consumers remedies, including rescission, recovery of payments, damages and, in some provinces, punitive damages. Consumers generally cannot waive these rights.

Quebec's Consumer Protection Act is the most protective in Canada. In Richard v. Time Inc., 2012 SCC 8, a consumer received a mailing that looked like a notice that he had won a large cash prize, but the fine print showed he had only been entered in a draw if he subscribed to a magazine. The Supreme Court held that whether a representation is misleading is judged from the general impression it gives to a credulous and inexperienced consumer, not a careful reader, and awarded punitive damages. The general impression test is now influential across Canada, including under the federal Competition Act.

Competition law

The federal Competition Act protects competition through criminal prohibitions, civil reviewable practices and merger review, enforced by the Commissioner of Competition, head of the Competition Bureau, and the Competition Tribunal. The most serious offences are criminal. Section 45 prohibits agreements between competitors to fix prices, allocate markets or customers or restrict output, and since June 23, 2023 also prohibits agreements between unaffiliated employers to fix wages or not to poach each other's employees. Penalties include fines at the court's discretion with no maximum and imprisonment for up to 14 years. Section 47 prohibits bid-rigging. Civil provisions address abuse of a dominant position, refusal to deal, price maintenance and deceptive marketing, with administrative monetary penalties for corporations of up to the greater of $10 million ($15 million for repeat conduct), three times the benefit derived or 3 % of worldwide gross revenues. Mergers above financial thresholds require advance notification, and the Bureau can challenge mergers that are likely to prevent or lessen competition substantially.

Competition law affects ordinary managers, not just executives negotiating mergers. Sales staff who exchange pricing plans with competitors at a trade show, purchasing managers who agree with other buyers to cap what they will pay suppliers, and HR managers who agree with nearby employers not to hire each other's staff can all expose their companies and themselves to criminal liability. Trade association meetings are a classic risk: legitimate discussion of industry standards or lobbying can drift into competitively sensitive topics. Companies manage the risk with compliance programs, training, agendas and minutes for association meetings, and clear instructions to leave any conversation about prices, bids, customers or wages and report it to counsel.

Misleading advertising and environmental claims

The Competition Act prohibits false or misleading representations to the public in any material respect, as a criminal offence if done knowingly or recklessly and as a civil reviewable practice otherwise. It also prohibits performance claims not based on adequate and proper testing, misleading ordinary selling price claims and drip pricing. Amendments in 2024 targeted greenwashing: representations about the benefits of a product for protecting the environment or mitigating climate change must be based on adequate and proper testing, and representations about the environmental benefits of a business or its activities must be based on adequate and proper substantiation in accordance with internationally recognized methodology. The general impression of an advertisement, together with its literal meaning, is considered. Since June 20, 2025, private parties can seek leave to bring deceptive marketing cases directly to the Competition Tribunal, which can order the business to pay an amount to be distributed to injured persons, so businesses should expect more litigation by competitors and advocacy groups.

Privacy and data protection

Private-sector privacy in Canada is governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to commercial activities in most provinces and to federally regulated businesses, and by substantially similar provincial statutes in Alberta, British Columbia and Quebec. PIPEDA is built on ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance. Organizations must obtain meaningful consent, collect only what is reasonably necessary for identified purposes, protect information with safeguards appropriate to its sensitivity and appoint someone accountable. Since 2018, organizations must report to the Office of the Privacy Commissioner, and notify affected individuals, any breach of security safeguards that creates a real risk of significant harm, and must keep records of all breaches for 24 months. Quebec's Law 25, phased in between 2022 and 2024, adds privacy impact assessments, privacy by default and penalties of up to $25 million or 4 % of worldwide turnover. In June 2026, the federal government introduced Bill C-36, which would replace PIPEDA's privacy provisions with a new Protecting Privacy and Consumer Data Act and much larger penalties; at the time of writing (October 2026) it had not been passed, and PIPEDA remains in force.

Commercial electronic messages

Canada's Anti-Spam Legislation (CASL) prohibits sending commercial electronic messages, such as marketing emails and texts, unless the recipient has consented, the message identifies the sender and includes contact information, and it contains a working unsubscribe mechanism that is honoured within 10 business days. Consent can be express (the recipient actively opted in, after being told the purpose and the sender's identity; pre-checked boxes do not count) or implied in limited cases, such as an existing business relationship from a purchase within the past two years or an inquiry within the past six months. Administrative monetary penalties can reach $10 million per violation for businesses and $1 million for individuals, and directors and officers can be personally liable if they directed or acquiesced in a violation. CASL's private right of action has never been brought into force.