New Canada Privacy Law To Stop Companies Charging More Using Your Data

Last Updated On 14 July 2026, 5:32 PM EDT (Toronto Time)

The federal government has proposed a new privacy law that could fundamentally change how companies use your personal information in Canada, including putting limits on the practice of charging you higher prices based on your browsing history, location, or shopping habits.

Bill C-36, officially called the Protecting Privacy and Consumer Data Act, was tabled in the House of Commons on June 15, 2026, by Minister of Artificial Intelligence and Digital Innovation Evan Solomon.

If passed, this law would replace Canada’s current privacy legislation, which is now more than 25 years old and was written before smartphones, social media, and artificial intelligence existed.

The bill arrives during a year of aggressive federal consumer protection changes that have already delivered banking fee caps, cellphone fee bans, and tougher rules for digital services across the country.

Here is what the proposed law means for everyday Canadians, explained in plain language.

What Is Surveillance Pricing And Why Should You Care

Surveillance pricing is the practice where companies use your personal data to charge you a different price than someone else for the exact same product or service.

This is not the same as a sale, a coupon, or a loyalty discount that benefits you.

Surveillance pricing works against you by using information like your location, your income bracket, your past purchases, and even the type of device you are using to determine the maximum price you are likely to pay.

For example, surveillance pricing could theoretically allow a company to show a higher price to someone using a newer device or browsing from a wealthier postal code if its system predicts that person is willing to pay more.

The government backgrounder for Bill C-36 specifically identifies inappropriate surveillance pricing as an unfair use of personal information that the new law is designed to address.

Minister Solomon confirmed that if the bill passes, one of his first actions will be directing the new regulator to publish specific guidance on surveillance pricing.

What Bill C-36 Actually Does For Canadians

Bill C-36 would replace Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s current federal privacy law, with a completely new statute called the Protecting Privacy and Consumer Data Act.

In simple terms, the new law gives you more control over your personal information and creates real consequences for companies that misuse your data.

Here are the key changes that matter most to everyday Canadians.

Your Right To Have Your Data Deleted

Under the proposed law, you would have the right to ask a company to delete your personal information in specified circumstances.

This includes situations where the company collected your data without proper consent, where you withdrew your consent, or where the data is no longer necessary for the service you originally requested.

The law defines disposal as permanently and irreversibly deleting personal information or anonymizing it so that it cannot reasonably be linked back to you under the law’s standard.

This is similar to the right to erasure that already exists under the European Union’s GDPR, and it would be a first for Canadian federal privacy law.

Transparency About Automated Decisions

Companies that use artificial intelligence, algorithms, or any automated system to make decisions about you would be required to tell you that they are doing so.

If the automated decision could have a legal or similarly significant effect on you, such as a credit decision, a job screening, or a pricing determination, you would have the right to request a plain-language explanation of how the decision was made.

That explanation must include the type of personal information used, where the data came from, and the main factors that influenced the outcome.

You would also have the right to submit written representations requesting human review of the automated decision.

This matters because automated systems are increasingly being used to determine everything from your insurance premiums to whether you get approved for an apartment rental or a cellphone plan.

Stronger Protection For Children’s Data

Bill C-36 classifies the personal information of anyone under 18 as sensitive information, which triggers a higher standard of care from any company that collects it.

Organizations would be held to a stricter standard when handling children’s data, and the new privacy commissioner would be required to consider the best interests of children when exercising any powers under the law.

This directly responds to growing concerns about how social media platforms, gaming companies, and digital entertainment platforms collect and use data from minors.

The current law allows many companies to bury consent in lengthy terms and conditions that nobody reads.

Bill C-36 would require that consent be meaningful, which means companies must explain in clear and simple language exactly what information they are collecting, why they need it, and what they plan to do with it.

Express consent would be required unless implied consent is specifically permitted under the law.

Companies would be prohibited from forcing consumers to consent to unnecessary data collection as a condition of receiving a product or service.

This is particularly relevant for newcomers to Canada who sign up for multiple services during their first months in the country and often agree to lengthy terms without understanding what data they are giving away.

Data Mobility: Take Your Data With You

The law would authorize data mobility frameworks that could let you transfer your personal information from one company to another.

This is similar to cellphone number portability, where you can switch carriers without losing your number, except this would apply to your personal data across a broader range of services.

The specific details of how data mobility would work will be developed through future regulations after the enabling legislation was passed.

How The New Law Would Be Enforced

One of the biggest weaknesses of Canada’s current privacy law is that it has limited enforcement power.

Bill C-36 fixes this by creating a brand-new federal regulator called the Digital Safety and Data Protection Commission of Canada.

This new commission would replace the Office of the Privacy Commissioner as the primary enforcer of private-sector privacy law.

Unlike the current system, the new commission would have the power to issue binding orders and impose significant financial penalties on companies that violate the law.

Financial Penalties Under Bill C-36

Violation Type	Maximum Penalty
Administrative monetary penalties	Up to $10 million or 3% of gross global revenue, whichever is greater
Most serious offences	Up to $25 million or 5% of gross global revenue, whichever is greater

To put that in perspective, a company earning $1 billion in annual global revenue could face a fine of up to $50 million for the most serious privacy violations.

The law would also create a private right of action, meaning individual Canadians who suffer loss or injury could sue for damages after a qualifying finding, compliance agreement, or conviction becomes final.

This is a significant shift from the current system, where Canadians who experienced the CRA data breach in 2020 had to pursue a class action lawsuit to receive compensation.

How Bill C-36 Compares To The Current Law

The following table shows the key differences between PIPEDA, Canada’s existing privacy law, and the proposed Protecting Privacy and Consumer Data Act under Bill C-36.

Feature	Current Law (PIPEDA)	Bill C-36 (PPCDA)
Privacy as a right	Not explicitly stated	Recognized as a fundamental right
Right to delete data	No formal right	Yes, right to request disposal
Surveillance pricing	Not addressed	The government identifies it as a practice the bill is intended to address
Automated decisions	No specific rules	Transparency and explanation required
Children’s data	No special category	Classified as sensitive information
Maximum penalties	Up to $100,000	Up to $25 million or 5% of global revenue
Regulator	Privacy Commissioner (investigates; may seek court enforcement)	New Digital Safety Commission (binding orders)
Private lawsuits	Very limited	Private right of action after qualifying finding or conviction
Data mobility	No framework	Right to transfer data where an approved framework applies
Cross-border transfers	Limited requirements	Privacy impact assessment required

What The Bill Does Not Ban Outright

It is important to understand that Bill C-36 does not ban surveillance pricing outright.

Minister Solomon clarified that the government does not want to prevent companies from offering you better prices through loyalty programs, promotional discounts, or reward systems that benefit consumers.

The distinction the bill draws is between using data to benefit the consumer and using data to exploit the consumer, a principle consistent with the broader consumer protection direction the federal government has taken throughout 2026.

NDP Leader Avi Lewis criticized this approach, saying the bill does not mention surveillance pricing by name and instead relies on the new regulator to develop guidance on the issue after the law takes effect.

This means the practical impact on surveillance pricing will depend heavily on how aggressively the new Digital Safety and Data Protection Commission chooses to enforce the rules once it becomes operational.

Cross-Border Data Transfers And Your Privacy

Bill C-36 introduces a new requirement that companies must conduct a privacy impact assessment before sending your personal information outside of Canada.

This reflects growing concerns about data sovereignty, particularly when Canadian user data is stored on servers in countries with weaker privacy protections.

If you use cloud-based services, social media platforms, or international e-commerce sites, this provision is directly relevant to how your personal information is handled once it leaves the country.

Companies would also be required to disclose in their privacy policies whether they transfer personal information outside of Canada, which is especially relevant given the new banking fraud protection rules that require financial institutions to obtain express consent for data handling.

When Would This Law Take Effect

Bill C-36 received first reading on June 15, 2026, which means it has only entered the very beginning of the legislative process.

Parliament rose for the summer on June 18, 2026, and regular sittings are scheduled to resume on September 21, 2026.

The bill must still pass through second reading, committee study, third reading, the full Senate process, and receive Royal Assent before it becomes law, following the same process that new bail and sentencing laws went through earlier this year.

This is Canada’s third attempt at modernizing its privacy framework after Bill C-11 died in 2021 when an election was called, and Bill C-27 died in January 2025 when Parliament was prorogued.

If the bill passes, its coming into force will also depend on the establishment of the new Digital Safety and Data Protection Commission, which is being created under a separate bill, Bill C-34, the Safe Social Media Act.

Canadians who followed the banking fee caps and the cellphone fee bans know that consumer protection laws can move through Parliament when there is enough public pressure.

How Provincial Privacy Laws Fit In

Alberta, British Columbia, and Quebec each have their own private-sector privacy laws that are currently considered substantially similar to PIPEDA.

If Bill C-36 passes, those provincial laws would need to be assessed against the new federal standard.

Provinces with substantially similar private-sector privacy laws may continue to receive exemptions for covered organizations and activities, while the federal law would continue applying to federally regulated businesses and interprovincial or international commercial data flows.

Ontario recently introduced its own consumer credit protections in July 2026, including the right to place a free security freeze on credit files, which already goes further than what federal law currently offers.

Manitoba has also moved independently, introducing a provincial bill in March 2026 that would specifically ban retailers from using personal data to increase prices for individual consumers.

What Canadians Should Do Right Now

Even though Bill C-36 has not been passed yet, there are steps you can take right now to protect your personal information while navigating an increasingly digital landscape of new Canadian rules and services.

Review the privacy settings on every app and website you use regularly, and turn off any data sharing that is not essential to the service.

Limit location permissions, block unnecessary cookies, review app tracking settings, and avoid remaining logged in when comparing personalized prices.

Check whether the online services you use send your data outside of Canada by reading their privacy policies.

If you want to compare prices online, try using a private browser window to reduce the amount of stored browsing information available during price comparisons.

Stay informed about the progress of Bill C-36 through Parliament, because the bill could be amended during committee study and the final version may look different from what was tabled in June.

Bill C-36 would not directly govern federal institutions like IRCC, which remain subject to the federal Privacy Act, although private-sector service providers handling Canadians’ data on behalf of businesses may have obligations under the new framework.

Bill C-36 represents the most ambitious attempt to modernize Canada’s privacy framework in over two decades.

For everyday Canadians, the proposed law would mean stronger control over your personal information, the right to have your data deleted, clear explanations when algorithms make decisions about you, and meaningful consequences for companies that violate your privacy.

Combined with Ontario’s new credit freeze protections and the federal banking reforms, 2026 is shaping up to be the most significant year for Canadian data and consumer rights in over two decades.

The surveillance pricing provisions, while not an outright ban, signal that the federal government views the practice of using your data to charge you more as a serious consumer protection issue.

Canada’s Privacy Commissioner Philippe Dufresne welcomed the bill, noting he was pleased to see recommendations for recognizing privacy as a fundamental right, protecting children’s data, and requiring privacy impact assessments reflected in the legislation.

The biggest risk is that this bill could die in Parliament just like its two predecessors, leaving Canadians stuck with a 25-year-old privacy law in an age of artificial intelligence and algorithmic pricing.

July 2026 has already delivered 10 major federal law changes across criminal justice, benefits, and professional regulation, and Bill C-36 could be the next blockbuster consumer reform if it survives the fall sitting.

Whether Bill C-36 survives the legislative process will depend on how much Canadians push their members of Parliament to prioritize passing it when the House resumes in September 2026.

This bill arrives alongside a broader wave of consumer protection reforms in 2026 that have already eliminated telecom fees, capped bank charges, and strengthened data-sharing rules across the country.

Frequently Asked Questions (FAQs)

Would Bill C-36 apply to companies based outside Canada that serve Canadian customers?

The proposed law applies to organizations that collect, use, or disclose personal information in the course of commercial activities. If a foreign company provides services to Canadians and its commercial data-processing activities have a real and substantial connection to Canada, it could fall within the scope of the law. The enforcement mechanism for international companies would rely on the new Digital Safety and Data Protection Commission’s ability to issue orders and penalties, though practical enforcement across borders remains a challenge that regulators worldwide are still working to address.

Can I ask a company to delete my data right now under the current law?

PIPEDA gives you the right to access your personal information held by a company and to challenge its accuracy, but there is no formal right to deletion under the current law. Quebec’s provincial privacy law already includes a right to request de-indexation and cessation of dissemination. Bill C-36 would be the first time a formal right to request disposal is included in federal privacy legislation, giving all Canadians across the country the same baseline protection regardless of which province they live in.

How is Bill C-36 different from the EU’s GDPR that I keep hearing about?

The General Data Protection Regulation is the European Union’s privacy law that has been in effect since 2018 and is considered one of the strongest privacy frameworks in the world. Bill C-36 borrows several concepts from the GDPR, including the right to deletion, transparency requirements for automated decisions, and significant financial penalties for violations. However, the Canadian bill uses language like having a legal or similarly significant effect as the threshold for automated decision transparency, which is closer to but not identical to the GDPR standard. Canada’s proposed penalties (up to $25 million or 5% of global revenue) are comparable to the GDPR (up to 20 million euros or 4% of global revenue), signalling that Canada wants to be taken just as seriously on enforcement.

Would loyalty programs and rewards still be allowed under the new law?

Yes, Minister Solomon specifically clarified that the government does not intend to eliminate loyalty programs, promotional discounts, or reward systems that benefit consumers. The law targets situations where personal data is used to exploit consumers by charging them higher prices, not situations where data is used to offer better deals. However, the exact boundary between a beneficial loyalty program and exploitative surveillance pricing will need to be defined through regulatory guidance once the new commission is operational, which is why the minister committed to directing the regulator to publish surveillance pricing guidance as a first priority.

What happens to complaints I have already filed with the Privacy Commissioner under PIPEDA?

Bill C-36 would transfer private-sector privacy oversight from the Office of the Privacy Commissioner to the new Digital Safety and Data Protection Commission. The government has indicated it will consult stakeholders to ensure a smooth transition between the two bodies. Transitional provisions in the legislation would need to address how existing complaints, ongoing investigations, and pending compliance agreements are handled during the changeover, but those details will be finalized as the bill moves through committee study and the regulatory framework is developed.

Fact-Checked: All legislative details, penalty amounts, and regulatory structures in this article are verified against the official text of Bill C-36 on the Parliament of Canada website, the Government of Canada backgrounder, the Office of the Privacy Commissioner’s statement, and analysis from McCarthy Tetrault, DLA Piper, Gowling WLG, Bennett Jones, Fasken, and Baker McKenzie as of July 2026.

Disclaimer: This article is for informational purposes only and does not constitute legal, financial, or professional advice. Bill C-36 is a proposed law at first reading and may be amended or may not pass. Readers should consult a qualified privacy or consumer-law lawyer for advice specific to their circumstances.

Satinder Bains

Satinder brings expertise, knowledge, and experience related to internal work flows at IRCC. She worked at Canadian Consulate in Chandigarh before moving to Canada. Her articles on “Chinook – An internal IRCC tool used to bulk process temporary applications” was one of the notable work on our news website