If you run a small business in Canada and you're adding an AI agent to your website chat, here's the one fact that cuts through the confusion: Bill C-27 — the bill that contained the proposed Consumer Privacy Protection Act (CPPA) and the Artificial Intelligence and Data Act (AIDA) — died on the Order Paper when Parliament was prorogued on January 6, 2025, and has not been reintroduced as of mid-2026 (Gowling WLG, 2025). So the laws that actually govern how your chatbot handles customer data are PIPEDA (the federal private-sector law) and, if you have any Quebec customers, Quebec's Law 25 — the most stringent in-force privacy regime in the country. This guide walks through what each one requires, in plain language, so you can deploy an AI agent without a legal scare.
Is Bill C-27 (the CPPA) still law in 2026?
No. Bill C-27 is not law, and the CPPA and AIDA it contained never came into force. The bill died on the Order Paper when Parliament was prorogued on January 6, 2025, a snap federal election followed on April 28, 2025, and as of mid-2026 it has not been reintroduced (Gowling WLG, 2025).
This matters because a lot of "AI chatbot compliance" content online still describes the CPPA as upcoming or implies it's already in force. It isn't. In June 2025 the responsible Minister signalled that AIDA would not return as drafted. Any article telling you to comply with the CPPA right now is simply wrong about Canadian law.
So what fills the gap? PIPEDA — the Personal Information Protection and Electronic Documents Act, in force since 2000 — remains the operative federal private-sector privacy law. And Quebec's Law 25, fully in force since September 22, 2024, is the toughest in-force regime in Canada. The smart posture for a Canadian SMB is to build to Law 25 as your baseline. If a successor federal bill eventually arrives, you'll already be most of the way there.
What does PIPEDA require for an AI chatbot handling customer data?
PIPEDA requires that you obtain meaningful consent before collecting, using, or disclosing personal information through your chat — and express, opt-in consent when that information is sensitive or falls outside what a customer would reasonably expect. That's the heart of it.
Under the Office of the Privacy Commissioner's Fair Information Principles, "meaningful consent" means the person actually understands the nature, purpose, and consequences of what's being collected. A buried line in your terms of service doesn't cut it. Your AI agent should make a short, clear disclosure at the start of the conversation: what you collect, why, and how it's used. PIPEDA also requires you to limit collection to what's necessary, limit how long you keep it, safeguard it, and give customers a way to access and correct their data.
There's now real enforcement signal here. The OPC's joint investigation into OpenAI (PIPEDA Findings #2026-002) concluded that OpenAI did not obtain valid consent and reinforced that chatbot operators must obtain express consent for sensitive data and be transparent about how the system works (OPC, 2026). On top of that, the federal, provincial, and territorial privacy regulators jointly published "Principles for responsible, trustworthy and privacy-protective generative AI technologies" on December 7, 2023 — urging privacy-by-design, valid and meaningful consent, transparency, and labelling AI-generated content (OPC).
The practical translation: be upfront that customers are talking to an AI agent, collect only what you need to help them, and don't quietly feed sensitive chat logs into a model without consent.
What does Quebec Law 25 require that PIPEDA doesn't?
Quebec Law 25 adds five things PIPEDA does not: a hard rule on automated decisions, explicit separate consent, a mandatory Privacy Impact Assessment, a cross-border transfer assessment, and French-language obligations. If you have Quebec customers, these are not optional.
The one that trips up AI deployments most is automated decision-making (s.12.1). Where a decision about an individual is based exclusively on automated processing, you must inform them at or before the decision, and on request provide the personal information used, the reasons and principal factors, the right to correction, and a chance to submit observations to a human. The escape hatch is straightforward: a genuine human-in-the-loop means the decision isn't "exclusively automated," so the heavy obligations don't trigger. This is exactly why the credible model for an AI agent is automation plus a human for escalations — not full replacement.
Consent under Law 25 must be clear, free, and informed, and presented separately from your other terms. Sensitive data needs explicit opt-in. Notably, Law 25 is the only North American law requiring explicit consent for tracking technologies and cookies, and it requires parental consent for anyone under 14.
A Privacy Impact Assessment (PIA) is mandatory before launching any project that creates or modifies a system involving personal information — and before any cross-border transfer (CAI; CFIB). That includes deploying a new AI chat agent.
Does Law 25 require a French chatbot, and how does cross-border data work?
Yes — for Quebec consumers, a French-capable chat experience is effectively required, and yes, sending chat data to a vendor outside Quebec triggers a mandatory assessment, even if that vendor is elsewhere in Canada.
On language: Quebec's Charter of the French Language requires your privacy policy, terms, and customer-facing commercial communications to be available in French of at least equal quality. A customer-service AI agent that can only respond in English isn't compliant for Quebec consumers. If you're already weighing channels and languages, our guide to bilingual English-French AI customer service for Canada covers how to set this up properly.
On cross-border transfers (s.17): before you communicate personal information outside Quebec — and this includes another Canadian province or a US-based vendor — you must conduct a PIA weighing the sensitivity of the data, the purpose, the contractual protections in place, and the legal framework of the destination. The single most-misunderstood point here: "Canadian" does not mean "Quebec." An Ontario-hosted vendor is still a transfer outside Quebec and still requires the assessment. Most AI platforms and cloud services run on US infrastructure, so for any Quebec customer data, this step is almost always in play.
The penalties make it worth getting right. Law 25 carries administrative monetary penalties up to $10M or 2% of worldwide turnover, penal fines up to $25M or 4%, and a private right of action with statutory damages starting at $1,000 (CAI).
How do PIPEDA, Law 25, and the CPPA compare side by side?
PIPEDA is the in-force federal baseline, Law 25 is the in-force Quebec regime and the strictest in Canada, and the CPPA is a dead proposal that is not law. Here's the matrix.
| Requirement | PIPEDA (federal, in force) | Quebec Law 25 (in force) | CPPA (Bill C-27 — NOT in force) |
|---|---|---|---|
| Status in 2026 | Operative federal law (since 2000) | Fully in force since Sept 22, 2024 | Died on Order Paper Jan 6, 2025; not reintroduced |
| Consent | Meaningful consent; express for sensitive data | Explicit opt-in; separate from terms; cookies need consent; under-14 parental | Would have strengthened consent (n/a) |
| Automated decisions | No specific rule; covered by 2023 GenAI Principles | s.12.1: inform + explain + human review for exclusively automated decisions | Proposed transparency rights (n/a) |
| Privacy Impact Assessment | Recommended (privacy management program) | Mandatory for new PI systems and cross-border transfers | Proposed (n/a) |
| Cross-border transfer | Accountability; transfer ≠ disclosure | s.17: PIA required before any transfer outside Quebec (incl. other provinces) | Proposed rules (n/a) |
| French language | Not required federally | Charter of French Language: French policy/terms/comms required | n/a |
| Max penalties | Limited; up to ~$100K for offences | AMP up to $10M/2%; penal up to $25M/4%; private right of action ($1,000+) | Proposed up to $25M/5% (n/a) |
Source: Gowling WLG (2025); OPC; CAI; CFIB.
The takeaway from the table is simple. Law 25 is the high-water mark, so building to it covers you almost everywhere else in Canada. And don't let the "CPPA" column tempt you into either complacency ("a federal law is coming, I'll wait") or panic ("I have to comply with the CPPA"). Neither is true today.
What's a practical compliance checklist before launching an AI agent in Canada?
Get five things in place before you turn on the chat, and you'll be covered under both PIPEDA and Law 25. None of them require a six-figure legal budget.
- Meaningful, express consent at chat start (PIPEDA + Law 25). Open every conversation with a short, plain-language notice: customers are talking to an AI agent, here's what you collect, here's why. Make sensitive-data consent explicit and separate from your general terms.
- A clear privacy notice, with a French version for Quebec. Publish a privacy policy that covers chat data, and provide a French version of at least equal quality if you serve Quebec consumers.
- A human-in-the-loop for escalations. Keep a person in the decision path so you stay outside Law 25 s.12.1's "exclusively automated" trigger. This is good service design anyway — no AI agent resolves everything.
- A Privacy Impact Assessment before launch — and before data leaves Quebec. Run a PIA on the deployment, and a second assessment under s.17 before any Quebec customer data flows to a vendor outside the province (including elsewhere in Canada or the US).
- State your legal posture plainly, internally. Document that the CPPA and AIDA are not in force and that you're aligning to Law 25 as your baseline. If federal reform is reintroduced, revisit the plan.
Two more practical notes. First, retention: don't hoard chat transcripts forever — Law 25 and PIPEDA both push you to limit how long you keep personal information. Build a deletion schedule. Second, vendor diligence: when you pick a platform, ask where data is hosted, whether it's used to train models, and what contractual protections exist. If you're weighing tools, our breakdown of customer data privacy for AI in SMEs goes deeper on what to ask.
This is also where the right tool helps. Omago, an AI agent platform that helps SMEs automate customer conversations across WhatsApp, Telegram, and web chat, is built around an agent that takes actions — capturing and routing leads, running guided multi-step flows, and triggering integrations like Airtable — while keeping a human in the loop for anything that needs judgment. That human-in-the-loop design isn't just nice service; in Quebec it's the difference between a routine deployment and tripping the s.12.1 automated-decision rule.
How big a deal is privacy, really, for a small Canadian business adopting AI?
It's a real concern but not the biggest barrier — and that's useful to know, because it means you're solving a manageable problem, not a dealbreaker. Among Canadian businesses not planning to adopt AI, only 8.1% cited privacy and security concerns, well behind the 78.1% who simply said AI was "not relevant" to their work and the 11.3% citing lack of knowledge (Statistics Canada, Q3 2025).
Meanwhile, adoption is climbing fast. Statistics Canada found that 12.2% of Canadian businesses used AI to produce goods or deliver services in Q2 2025, double the 6.1% a year earlier (StatCan CSBC, 2025). BDC reports that 30% of Canadian SMEs used AI in 2025 and that AI users were 24% more productive (BDC, 2026). And among AI-using businesses, virtual agents and chatbots were the third most-adopted application at 24.8% (StatCan, Q2 2025). Customers are comfortable too: 33% of Canadians used a generative AI tool in the past year, double the 16% in 2024 (CIRA, 2025).
So privacy compliance isn't a reason to sit out — it's a reason to deploy thoughtfully. The businesses lagging most are the smallest staffed ones: only 9.4% of firms with 5–19 employees used AI versus 17.9% of firms with 100+ employees, with mid-sized firms of 20–99 employees sitting at 15.4% (StatCan Table 33-10-1004-01, 2025). That gap is the opportunity — the smallest staffed teams are the least likely to have adopted, and a compliant, well-scoped deployment lets them close the distance. Getting consent, notice, and a human-in-the-loop right is what lets a small team adopt with confidence instead of hesitation. If you're still deciding whether to automate or hire, weigh it against the decision of AI versus hiring in the Canadian labour market and the broader Canadian SME AI adoption picture for 2026.
One honest caveat on channels while you're here: WhatsApp is not dominant in Canada. Facebook Messenger leads at roughly 55% penetration and SMS is near-universal (Infobip, 2025). Position your web chat widget as the always-on backbone, and offer WhatsApp or Telegram only where your specific audience already uses them. The privacy rules above apply the same way regardless of channel — collect consent, give notice, keep a human in the loop.
Frequently Asked Questions
Is the CPPA or AIDA in force in Canada in 2026?
No. Both were part of Bill C-27, which died on the Order Paper when Parliament was prorogued on January 6, 2025, and neither has been reintroduced as of mid-2026 (Gowling WLG, 2025). PIPEDA remains the federal private-sector privacy law, and Quebec's Law 25 is the strictest in-force regime in Canada. Build to Law 25 as your baseline.
Do I need consent to use an AI chatbot with customer data in Canada?
Yes. PIPEDA requires meaningful consent before you collect, use, or disclose personal information, and express opt-in consent for sensitive data (OPC). Quebec Law 25 goes further, requiring consent that is clear, free, informed, and presented separately from your other terms. The simplest fix is a short, plain-language notice at the start of each chat.
Does Quebec Law 25 require my chatbot to speak French?
In practice, yes, for Quebec consumers. Quebec's Charter of the French Language requires privacy policies, terms, and customer-facing commercial communications to be available in French of at least equal quality. A French-capable chat experience is effectively required to serve Quebec customers compliantly.
If my AI vendor's servers are in Ontario, am I clear of Law 25's cross-border rules?
No. Under Law 25 s.17, communicating personal information anywhere outside Quebec — including to another Canadian province — counts as a transfer and requires a Privacy Impact Assessment first (CAI; CFIB). "Canadian" does not mean "Quebec." Since most AI platforms run on US infrastructure, this assessment is usually in play for any Quebec customer data.
How do I avoid the "automated decision" rule under Law 25?
Keep a human in the decision path. Law 25 s.12.1 only triggers its heavy notice-and-explanation obligations when a decision about an individual is based exclusively on automated processing. A genuine human-in-the-loop — where a person reviews and can override outcomes — keeps you outside that trigger and is good service design regardless.
Sources: Statistics Canada Canadian Survey on Business Conditions, Q2/Q3 2025; Statistics Canada Table 33-10-1004-01 (2025); BDC (2026); CIRA 2025 Canadian Internet Trends; Office of the Privacy Commissioner of Canada (PIPEDA Findings #2026-002; GenAI Principles 2023); Commission d'accès à l'information du Québec (CAI); CFIB; Gowling WLG (2025); Infobip (2025).