canadian-law-compliance

Twelve laws apply including PIPEDA and Quebec Law 25 for privacy, CASL for anti-spam, the Excise Tax Act for GST/HST, provincial consumer protection acts, AODA and ACA for accessibility, and the Charter of the French Language for Quebec content requirements.

CASL-compliant emails require sender identification, a physical mailing address, contact information, a functional unsubscribe mechanism, a List-Unsubscribe header, and documented consent with timestamps. Transactional emails like order confirmations are exempt but should include the address as best practice.

Rates range from 5% GST in Alberta to 15% HST in Atlantic provinces, with Ontario at 13% HST and Quebec at 14.975% combined GST plus QST. Nova Scotia updated to 14% in 2025.

Yes, Quebec Law 25 has mandated a designated privacy officer since September 2022, and their name, title, and contact information must be published on the privacy policy page. It also requires granular consent and mandatory privacy impact assessments.

CASL's burden of proof requires schema fields for emailConsent, consentTimestamp, consentMethod (registration, checkout, or settings), and marketingOptIn as a boolean defaulting to false. These must be added to both backend and client schema constants.