We built a consent mechanism for our own site this summer and did the legal reading properly rather than copying a template. Two things stood out. Most banners on Canadian stores are theatre: they appear, they don't gate anything, and the pixels fired before you saw them. And the advice circulating about consent in Canada is often wrong in both directions — too strict about analytics, too relaxed about ad pixels. This is what the rules say as of October 2026, what a banner has to do, and where the technical traps are. We're an engineering firm, not a law firm — take this as how we build, not as legal advice.
Which law applies to which visitor
Quebec: Law 25
Two sections get mixed up. Section 9.1, the privacy-by-default rule, expressly excludes browser cookies, so “Law 25 requires every cookie off by default” is not what the statute says. Section 8.1 is the one that matters for marketing: if you use technology that identifies, locates or profiles a person, you must tell them, and tell them how to activate it. The regulator's own summary of the law reads that as profiling functions being off by default. In practice: analytics cookies can be handled with notice, but advertising and retargeting pixels, which exist to profile, stay off for Quebec visitors until they switch them on. Where you do need consent, section 14 says it must be clear, free, informed and given for specific purposes.
The Commission d'accès à l'information has published general consent guidelines and a guide to website privacy policies, but nothing specific to cookie banners, and as far as we can find it has not fined anyone over cookies. That's not a reason to relax; it means the statute is the only guide.
The rest of Canada: PIPEDA
Implied consent is acceptable for analytics if you give notice at or before collection and an easy opt-out. Advertising is where most write-ups, including an earlier draft of this one, go too far. The federal Privacy Commissioner's position on online behavioural advertising accepts opt-out consent, but only when all of these hold:
- visitors are told clearly what's happening and why, at or before the moment of collection — on the page, not only in the privacy policy;
- turning it off is easy, takes effect immediately and stays off;
- the information is non-sensitive (no health, finances or similar) as far as practicable;
- it's destroyed or de-identified as soon as possible;
- you don't knowingly track children or use technology the visitor can't decline.
Miss any of those, or use the data in a way people wouldn't reasonably expect, and you need express consent. The clearest example for merchants is the Commissioner's 2023 Home Depot finding: sending hashed customer emails to Meta to measure ads, on the strength of a privacy policy, was not valid consent. If you upload customer lists or send emails through a conversions API, get an explicit yes for it.
Federal reform is back on the table: Bill C-36, introduced in June 2026, would replace PIPEDA's privacy part with penalties of up to $25 million or 5% of global revenue. It isn't law yet. Build to PIPEDA, and assume enforcement gets sharper.
EU and Swiss visitors: GDPR and ePrivacy
This is the regime that actually forces a banner. Non-essential cookies, pixels and tracking links need prior consent — the European data protection board's technical-scope guidelines (final, October 2024) confirm pixels and URL tracking are covered, not just cookies. The regulators' 2023 taskforce report is still the reference for what a valid banner looks like: reject on the same layer as accept, nothing pre-ticked, reject as a button rather than a buried link, no pressure, and withdrawal as easy as consent — a footer link is fine.
Enforcement reaches ecommerce: France's regulator fined Shein €150 million in September 2025 for setting cookies without consent. The EU's “Digital Omnibus” proposal would add exemptions for first-party audience measurement and change how soon you may re-ask after a refusal, but it is still being negotiated. Don't redesign for it yet.
UK visitors: a new analytics exemption
The UK has split from the EU here. Since February 2026 the Data (Use and Access) Act lets you set cookies for statistical purposes without consent — first-party analytics used to improve your own site, producing aggregate figures, with clear information and a simple, free way to object. It never covers advertising or tracking individuals, so ad pixels still need opt-in for UK visitors.
US visitors
California's privacy law applies above US$26,625,000 in global annual revenue, or if you buy, sell or share the data of 100,000 or more consumers, or earn half your revenue from selling or sharing it. Most Canadian stores don't qualify. Honour the Global Privacy Control browser signal anyway: around a dozen state laws now require businesses they cover to treat it as an opt-out, and from January 1, 2027 browsers in California must offer it. On the litigation side, California's SB 690, signed in September 2026 and effective January 1, 2027, ends private “pen register” lawsuits over website tracking; wiretap claims under the same law remain possible.
What that means in practice
- Quebec, EU, UK and Swiss visitors: advertising pixels load only after an explicit yes. EU and Swiss visitors need opt-in for analytics too; UK first-party statistics can now be opt-out.
- The rest of Canada: analytics on implied consent is defensible with a real notice and off switch. Advertising on opt-out is possible only if you meet every condition in the Commissioner's list. Asking everyone first is simpler and safer; opt-out buys you bigger retargeting audiences in exchange for doing the notice properly.
- Everyone: no customer emails or phone numbers to ad platforms without express consent, and a GPC signal counts as a refusal.
What a compliant banner actually does
- In opt-in regions, loads nothing non-essential before a choice is made — verify this in the browser's network tab, not by reading the vendor's brochure.
- In opt-out regions, still shows a notice on the first visit with a one-click way to turn things off. Silence is what makes implied consent invalid.
- Shows “Reject all” with the same prominence as “Accept all”, on the first screen, as buttons of the same size and colour.
- Separates purposes (analytics, advertising) with nothing pre-ticked, and treats closing the banner or pressing Escape as no consent, not as yes.
- Remembers the choice for a sensible period — we use six months for both accept and reject, the French regulator's recommended practice — and re-asks when the purposes or vendors change.
- Offers withdrawal from a permanent link in the footer.
- Works with a keyboard and a screen reader. A banner that traps focus incorrectly or can't be dismissed without a mouse is an accessibility defect on every page of the site.
The technical traps
- Safari can wipe a consent cookie written by JavaScript within about a week. Safari users then get re-prompted, which is annoying and means you keep re-collecting consent you already had. Set the consent cookie from the server instead. The same limits apply to local storage, so don't keep consent there either.
- Google Consent Mode has to run before any Google tag, with defaults that are right for the visitor's region before the page's tags load — otherwise the first pageview is measured under the wrong state. Advertisers are not required to use a Google-certified consent platform; that requirement is for publishers running Google's ad networks on their own pages. A well-built mechanism of your own satisfies the policy.
- The Meta pixel has no cookieless mode, and its “revoke consent” state isn't remembered between page loads. Where consent is required, don't inject the pixel at all until the visitor agrees, and re-assert revoke on every page for anyone who declined.
- Single-page navigation hides pageviews. Modern storefronts change pages without a reload, so a pixel that only fires on load undercounts every visit after the first page. Fire a pageview on each route change, behind the same consent check.
One less visible: under GDPR you have to be able to demonstrate that consent was given, and the regulators have said a correctly configured banner alone isn't sufficient evidence. Keep a log — when, which version of the banner, which choices — and keep a dated screenshot of each banner version.
Shopify versus WooCommerce
Shopify's customer privacy settings show a native banner automatically only for the UK and the EEA; you can switch it on for other regions, and a store with Quebec customers should. It governs Shopify's own cookies and pixels built on Shopify's pixel framework. For scripts pasted into the theme, or added by apps outside that framework, Shopify itself says you may need another banner or custom logic. Legacy script tags can't be created or updated since October 1, 2026 and stop loading on March 1, 2027 — finishing that cleanup is also a consent cleanup.
WooCommerce has no banner in core; you choose a plugin or build it. Note that Woo's built-in order attribution sets its own tracking cookies (named sbjs_) by default, so classify them like any other analytics tag. Test the result the same way on either platform: network tab, before any click.
Our checklist
- List every third-party tag on the site — theme, apps, tag manager — and classify it: essential, analytics, advertising.
- Decide the regime per region: opt-in for advertising in Quebec, the EU, the UK and Switzerland; opt-in for analytics in the EU and Switzerland; for the rest of Canada, opt-out advertising only if you meet every one of the Privacy Commissioner's conditions.
- Implement the banner with equal-prominence buttons, nothing pre-ticked, Escape ≠ consent, and a notice even where consent is implied.
- Set the cookie server-side; wire Consent Mode defaults before the first tag; don't inject Meta until consent where it's required.
- Honour Global Privacy Control as a refusal.
- Never upload customer emails or phone numbers to an ad platform without express consent.
- Log consent events and archive a screenshot of each banner version.
- Test with a keyboard and a screen reader, and re-test the network tab after every theme, app or tag change.
- Update the privacy policy to match what the site actually does — including that you run ads, if you do.
You can see the mechanism running on this site, and our privacy policy describes what it governs. We build the same thing for clients as part of growth & ads work on Shopify and WordPress, and we'd rather set it up before the first campaign than after the first complaint. Book a free consultation.