PIPEDA does not use the words "cookie policy". Nothing in the Act orders a stand-alone document with that name. What it does require is that people can understand what you collect, why, and who gets it, and a cookie policy is the most practical place to say so.

This guide covers what to put in that document, which parts come from the law and which from the regulator's guidance, and what changes when your visitors are in Quebec. For the full legal frame, start with our guide to PIPEDA and cookies.

Principle 4.8 (openness) says an organization must make specific information about its policies and practices readily available. Principle 4.2 says purposes must be identified at or before collection. Section 6.1 says consent is only valid if people can reasonably understand what they are agreeing to.

A cookie policy is where those three requirements meet. It is the document the banner links to, and the one a regulator or a customer will read first if something goes wrong.

The Act sets the principles. The Office of the Privacy Commissioner of Canada (OPC) turns them into specific expectations in its guidelines for obtaining meaningful consent and its policy position on online behavioural advertising.

Those are guidance, not statute. They still matter, because the OPC applies them when it investigates a complaint.

The OPC names four key elements that people must be able to find easily: what personal information is collected, which parties it is shared with, for what purposes, and the risk of harm and other consequences. A good cookie policy is built around those four.

List cookies and similar technologies by category: strictly necessary, preferences, analytics, advertising. Name the vendor, the cookie name, the lifetime and whether it is first-party or third-party.

Cover local storage and similar technologies too: our guide to the difference between cookies, local storage and session storage explains what to include. Do not rely on the domain alone to decide a category. A cookie set by another domain is not always a third-party advertising tag, and a tag of unknown purpose should be blocked until you know what it does.

State the purpose in plain language, one per category. Section 5(3) of PIPEDA adds a test: the purpose must be one a reasonable person would find appropriate in the circumstances. Say so to yourself before you write it down. If a purpose reads badly in plain words, that is a warning.

Name the third parties that receive data through your cookies, or at least the categories, such as analytics providers and ad platforms. This is the element that most sites leave out, and the OPC lists it as one of the four things people must see.

Principle 4.3.8 lets people withdraw consent at any time. Your policy should explain how to do it, and the way out should be as easy as the way in. A link in the footer that reopens the preference center is the usual solution.

For behavioural advertising, the OPC accepts opt-out consent only if six conditions are all met. In plain terms:

• People are told clearly about the purposes, and the parties involved, at or before collection.
• The opt-out is easy to use.
• The opt-out takes effect immediately and lasts.
• The information collected is limited and not sensitive.
• The information is deleted or made anonymous as soon as possible.

If your site cannot meet all of them, use opt-in. The same position says that zombie cookies, supercookies and fingerprinting should not be allowed at this time, so leave them out of the policy entirely by leaving them out of the site.

Principle 4.5.3 says personal information should be kept only as long as needed. Put a lifetime next to every cookie, and explain what happens to the data after it expires.

A cookie that outlives its purpose is a quiet compliance gap. Review lifetimes whenever you add a tag, and compare them with how long you really need the data.

If you serve Quebec visitors, Law 25 changes the policy in two places. Section 8.1 of the Quebec private-sector Act requires informing people when a technology allows them to be identified, located or profiled, and how to turn those functions on. Section 14 requires consent that is clear, free and informed.

In practice, we recommend offering the Quebec version of your policy in French and explaining each profiling or tracking function before it is switched on.

Need a cookie policy that matches what your site actually does? Talk to our team.

A policy that was accurate in January and wrong in June is worse than a short one. Run a scan on a schedule, compare the result with the list in the policy, and update the document when a tag is added or removed. If you need a method, see our guide on tag categorization.

A consent management platform such as AdOpt can keep the banner, the categories and the record of each choice in sync, so the policy is not the only evidence you have. The policy explains the rules, and the log shows that each visitor's choice was honoured.

Use this list before you publish:

1. Every cookie and similar technology listed, with category, vendor, lifetime and purpose.
2. Third parties named, or named by category.
3. A clear way to withdraw consent, linked from every page.
4. The opt-out conditions checked if you use advertising cookies without opt-in.
5. A retention period for each category.
6. A French version and a Quebec-specific section if you serve Quebec.
7. A last-updated date, and a note on how changes are announced.

For the rest of the document set, see the PIPEDA privacy policy guide. If you also serve California, compare with the CCPA cookies policy.

No provision names one. PIPEDA requires openness (principle 4.8), identified purposes (4.2) and meaningful consent (section 6.1). A separate cookie policy is the clearest way to meet all three for tracking technologies, and it keeps the main privacy policy readable. Many organizations also link it from the banner for that reason.

You need enough detail that people can understand what is collected, why and by whom. Listing each cookie by name, vendor and lifetime is the most reliable way to do that, and it makes updates easier. At a minimum, list by category with the vendors that matter, and keep the full list available.

For analytics that use limited, non-sensitive data and a clear opt-out, it can be. The OPC's six conditions apply to behavioural advertising, and analytics are judged against the meaningful-consent guidelines. If analytics data goes to a third party that uses it for its own purposes, treat it like advertising and use opt-in.

Quebec's Law 25 adds notice and consent requirements. Under section 8.1, people must be told when a technology can identify, locate or profile them, and how to activate it. Under section 14, consent must be clear, free and informed. We recommend providing the policy in French and describing each tracking function before it runs.

Whenever the site changes what it collects, and on a fixed review schedule. Add or remove a tag, change a vendor, or change a lifetime, and the policy needs to change with it. A quarterly review against a fresh scan catches most drift before it becomes a complaint.

• Canada PIPEDA and cookies: all you need to know, the full guide to the law
• PIPEDA DSAR privacy portal, for handling access requests