Canadian privacy enforcement
Privacy Enforcement Tracker
I keep this tracker because enforcement is where privacy law gets real. Fines make headlines, but the day-to-day signal is quieter: the orders and decisions regulators publish when organizations get personal information handling wrong. Every entry below is a real, published action: binding orders and monetary administrative penalties from the Commission d’accès à l’information (CAI) under Quebec Law 25, or investigation findings with recommendations from the federal Office of the Privacy Commissioner (OPC) under PIPEDA. Each entry is linked to its official source. I update it weekly.
10
Tracked actions
3
Orders
7
Decisions / findings
$0 CAD
SAPs imposed (0)
Filter the record
Showing 10 of 10 tracked actions.
| Date | Respondent | Issue | Outcome / penalty | Source |
|---|---|---|---|---|
| Jun 11, 2026 | OPC · PIPEDA X Corp. and X.AI LLC (xAI) | Commissioner-initiated investigation into whether Grok (X Corp./xAI) obtained valid consent to collect, use and disclose personal information of identifiable individuals to generate sexually explicit deepfakes, and whether that purpose was appropriate under PIPEDA. | Decision / findings Well-founded and not resolved at report date: no valid consent obtained for the collection, use and disclosure; a reasonable person would consider the purpose inappropriate; respondents' safeguards judged insufficient to demonstrate effectiveness. Recommendations issued; OPC will continue monitoring. Note: Commissioner-initiated complaints under PIPEDA s.11(2), Jan 2026; single report covering both respondents. No monetary penalty under PIPEDA; recommendations only. | OPC PIPEDA findings #2026-004 (EN) ↗ |
| May 6, 2026 | CAI · Law 25 OpenAI | Joint CAI/OPC/BC/Alberta investigation into whether ChatGPT's training and deployment (GPT-3.5/4) complied with privacy law on collection, consent, transparency, accuracy, retention, and privacy-by-default. | Decision / findings CAI found OpenAI's initial training-data collection overbroad and non-compliant with Quebec's Private Sector Act (arts. 8 and 9.1); four recommendations issued on consent notices, opt-out-by-default training use, privacy-by-default settings, and retention transparency. Note: Joint investigation; the federal OPC published the joint findings report. No monetary penalty imposed – recommendations only. | CAI press release (PDF, FR) ↗ |
| Mar 5, 2026 | OPC · PIPEDA Loblaw Companies Ltd. | Investigation into Loblaw's retention of PC Optimum loyalty members' purchase history after account deletion, and whether removing direct identifiers was sufficient to consider the data anonymized. | Decision / findings Well-founded and conditionally resolved: Loblaw took an unreasonable time to handle deletion and privacy requests (contravening Principle 4.10) and did not demonstrate retained data was properly anonymized (Principle 4.5). Agreed to an independent third-party review of its anonymization process. Note: Covers complaints received from May 2024 onward. No monetary penalty under PIPEDA; recommendations only. | OPC PIPEDA findings #2026-001 (EN) ↗ |
| Dec 1, 2025 | OPC · PIPEDA Staples Canada ULC | Whether returned laptops resold through Staples' Openbox program were adequately wiped of previous customers' personal information before resale, and whether staff procedures and training were adequate. | Decision / findings Well-founded and conditionally resolved: procedures and training inadequate, contravening Principles 4.7.1 and 4.7.3. Staples agreed to clear wipe procedures aligned with manufacturer guidelines, staff training, and annual independent third-party spot checks of stores for 3 years. Note: Follows a 2011 OPC audit that also found Staples' wipe procedures inadequate. No monetary penalty under PIPEDA; recommendations only. | OPC PIPEDA findings #2025-004 (EN) ↗ |
| Nov 25, 2025 | OPC · PIPEDA Unnamed privately-run swimming pool (Canada) | Privately owned swimming pool required parents to accept a waiver allowing photos/videos of their children to be taken and posted publicly for promotional purposes as a condition of enrolling in swimming lessons. | Decision / findings Well-founded and resolved: requiring consent for promotional photos as a condition of service contravened Principles 4.3.3 and 4.3.6; the respondent agreed to implement an opt-in photo policy within 4 months. Note: OPC does not name the respondent; described only as a privately-run swimming pool in Canada. No monetary penalty under PIPEDA; recommendations only. | OPC PIPEDA findings #2025-005 (EN) ↗ |
| Sep 23, 2025 | CAI · Law 25 TikTok | Joint investigation (CAI, OPC, BC and Alberta commissioners) into TikTok's collection and use of minors' personal information. | Decision / findings Joint investigation conclusions published; findings on minors' data practices announced at a joint press conference. Note: CAI page links to the federal OPC communiqué and joint findings report. No monetary penalty imposed. | CAI news item (FR) ↗ |
| Aug 27, 2025 | OPC · PIPEDA Google LLC | Complaint that Google's search engine returned outdated media articles about a complainant (a stayed HIV non-disclosure criminal charge) when their name was searched, causing significant harm; whether PIPEDA requires de-listing. | Decision / findings Well-founded (and unresolved): continued display contravened subsection 5(3) of PIPEDA; OPC recommended Google de-list the articles from name searches. Google declined, saying courts should decide whether PIPEDA includes a right to de-list. Note: Complaint dates to 2017; Federal Court (2021) and Federal Court of Appeal (2023) confirmed PIPEDA applies to Google's search service. No monetary penalty under PIPEDA; recommendations only. | OPC PIPEDA findings #2025-002 (EN) ↗ |
| May 20, 2025 | CAI · Law 25 13859380 Canada inc. (Crane Supply) | Use of dashcam video surveillance filming the inside of delivery-truck cabs, recording continuously over 14-day periods. | Order Ordered to limit in-cab collection to a few seconds around incidents, stop recording after engine shutdown, destroy excess footage, and restrict access to footage to serious accidents/incidents. Note: Decision rendered 2025-05-20 (dossier 1031833-S); announced by the CAI on 2025-05-28. | CAI decision 1031833-S (PDF, FR) ↗ |
| Feb 27, 2025 | CAI · Law 25 Metro Inc. | Planned facial-recognition pilot (Metro, Super C, Jean Coutu banners) to identify people previously involved in shoplifting or fraud, requiring a biometric characteristics bank. | Order Prohibited from putting the biometric bank into service: identity verification via biometrics requires express consent, which was not obtained. First order under s.45 of the Act respecting the legal framework for information technology. Note: CAI announced the decision on 2025-02-27; the communiqué describes the decision as 'recently rendered', so the decision date may slightly precede this date. | CAI news item (FR) ↗ |
| Sep 4, 2024 | CAI · Law 25 Société Imprimeries Transcontinental inc. | Facial-recognition system used to control employee access to premises; biometric data bank created during COVID-19 temperature-screening era and kept afterwards. | Order Ordered within 90 days to stop collecting employees' facial biometrics, stop using facial recognition for access control, and destroy existing biometric templates and encoded representations. Note: CAI's 10th biometrics decision since 2000. Company had notified the CAI of the biometric bank on 2020-10-02. | CAI decision 1024350-S (PDF, FR) ↗ |
No entries match your filters.
Scope & limits
About this tracker
This tracker covers published enforcement from two regulators: the Quebec CAI (monetary administrative penalties, sanctions administratives pécuniaires, in force since September 2024, and published orders and decisions against private-sector organizations under Law 25) and the federal OPC (published PIPEDA investigation findings against businesses). It does not cover access-to-information decisions involving public bodies, confidential investigations, or court proceedings.
A note on fines: the CAI can impose monetary administrative penalties under Law 25, though none have been publicly announced yet. When the first one lands, it will appear here with its amount. The OPC has no fine power under PIPEDA: its findings are recommendations, so every OPC entry shows no penalty by design.
This tracker is not exhaustive. It is a practitioner’s reading aid. For the definitive record, consult the CAI’s and the OPC’s own publications.
Next step
Reading the fines? Check your own banner first.
Consent failures are a recurring theme in privacy enforcement. Run your site through the free cookie banner auditor and see how your opt-in consent holds up before a regulator does.