Try to answer this question yourself and you will hit the problem fast.
Search “do I need a privacy policy on my website” and you get American advice. Add “Canada” and you get articles about PIPEDA. Add “BC” and you get a template company selling you a $49 document.
Five searches in, you still have no straight answer. That is because the answer depends on where your business is. Almost nobody writing these articles says so.
So I read the actual legislation. Here is what I found. That includes one thing I had wrong on my own website until last week.
Before we start: I build websites. I am not a lawyer, and this is not legal advice. This is a plain-English summary with links to the real sources, so you can read them yourself or hand them to someone who is.
The thing almost every article gets wrong
Nearly every “Canadian website law” article says PIPEDA applies to you.
For most BC businesses, it does not.
The federal Privacy Commissioner is clear on this. Alberta, British Columbia and Quebec have their own private-sector privacy laws. Each has been declared substantially similar to the federal one. Businesses covered by those provincial laws are generally exempt from PIPEDA for information handled inside that province.
Say you run a bakery in Courtenay. A customer fills in your contact form. The law that applies is BC’s Personal Information Protection Act, or PIPA. Not PIPEDA.
That is not a technicality. The two laws ask for different things. If you copied a policy that names PIPEDA, your document cites the wrong statute.
PIPEDA does still cover some BC businesses. It applies to federally regulated ones, like banks, airlines and telecom companies. It also covers information that crosses provincial or national borders. But for a local trade, shop or service business, PIPA is the one to read.
What PIPA actually asks of you
I pulled these straight from the Act on BC Laws. Three obligations affect your website directly. They are more specific than most people expect.
One: name someone, and make their contact details public.
Section 4 says you must designate at least one person responsible for compliance. It then says you must make public that person’s position name or title, along with their contact information.
Read that twice. This is the part people skip. Quietly appointing someone is not enough. The title and contact details have to be public. Your website is the obvious place.
Two: have real policies, and a way to complain.
Section 5 says you must develop and follow policies and practices needed to meet your obligations. That includes a process for handling complaints. You also have to share information about those policies on request.
Three: say why you are collecting, before you collect.
Section 10 says you must tell someone why you are collecting their personal information. The Act’s words are “on or before” collecting it, so at the moment of collection counts. On request, you also have to point them to someone who can answer questions about it.
In website terms, your contact form should say what you will do with the name and email. And it should say it where the person sees it before they hit send. Not buried in a policy nobody opens.
Where I had this wrong
My own privacy page named PIPEDA. It had no designated contact person. It had no complaint process.
I write about local SEO for a living. I have read more Google documentation than is healthy. And I had still never read the privacy Act that governs my own business. I fixed the page after writing this piece.
I am telling you because I suspect this is normal, not an embarrassing exception. Most small business privacy policies came from a template. Most templates are American or federal.
Email: the rule that catches people out
Canada’s anti-spam law is stricter than the American version. The difference trips up a lot of small businesses.
In the United States, you can email someone and offer a way to opt out. In Canada it works the other way round. You generally need consent before you send a commercial message.
Innovation, Science and Economic Development Canada sets out what your message needs:
- Consent, either express or implied. Express consent has no time limit unless the person withdraws it. Implied consent does expire. If it comes from an existing business relationship it can last up to two years, and only six months after an inquiry.
- Identification. The message must name your business. It needs a current mailing address, plus a phone number, email or website. That contact information has to stay valid for at least 60 days.
- An unsubscribe option. If someone asks to stop, you have 10 business days to action it. That applies however they ask, not just through your unsubscribe link.
The penalties are not symbolic. Section 20(4) of the Act sets the maximum penalty for a violation at $1,000,000 for an individual and $10,000,000 for anyone else, which includes an incorporated business.
Two practical notes. A newsletter checkbox should never be pre-ticked, because a pre-ticked box is not a choice. And replying to a customer who emailed you first is not what this law targets. It targets commercial messages sent to people who never asked.
Is website accessibility legally required in BC?
This one has a surprising answer. It is the second thing most articles get wrong.
The Accessible British Columbia Act is real. But right now it applies to prescribed public sector organizations. The government lists local governments, school districts, health authorities and public libraries, and says the regulation currently names over 750 of them. A private bakery or plumbing company is not one.
It is also worth knowing what those organizations actually have to do. The duties are to set up an accessibility committee, publish an accessibility plan, and provide a way for the public to give feedback. Not one of them is a website standard.
So no. Right now, a small private business in BC has no legal duty under that Act to meet a web accessibility standard. Articles telling you otherwise are describing Ontario’s rules, or guessing.
Here is why I would still do the work.
The Act is written to allow accessibility standards to be developed over time, and it says so directly. The direction of travel is obvious.
There is also a simpler reason. Statistics Canada found that 27% of Canadians aged 15 and older, or 8.0 million people, had one or more disabilities that limited them in their daily activities in 2022. A site a screen reader cannot use quietly loses some of those customers.
The work is not exotic either. Use real text instead of text baked into images. Label your form fields. Use enough colour contrast to read in sunlight. Make the site work with a keyboard. Most of that is just building it properly the first time.
Do it because it wins you customers, not because someone will fine you. That reason holds up better.
What this looks like on a real website
Here is the short version:
- A privacy policy naming PIPA if you are a BC business operating in BC
- The job title and contact details of whoever handles privacy, publicly visible
- A stated complaint process, covering how someone raises a concern and what happens next
- On your contact form, one plain sentence about what you do with the information
- If you email customers: consent first, your business name and mailing address in the message, and an unsubscribe you honour within 10 business days
- Accessibility because it is good business, not because of a BC deadline
None of that needs a lawyer. None of it costs more than an afternoon. The hard part was never the work. It was finding out which rules were yours.
Would rather not spend the afternoon? That is a thing we do. Or run the free site check to see where your site stands today.
Sources: Office of the Privacy Commissioner of Canada, PIPEDA in brief · BC Personal Information Protection Act · Innovation, Science and Economic Development Canada, getting consent to send email · Canada’s anti-spam legislation, section 20 · Government of BC, Accessible BC Act · Statistics Canada, Canadian Survey on Disability
Written October 2026. Laws change. Check the linked sources before relying on any of this, and talk to a lawyer about your own situation.