Privacy-Conscious Marketing Measurement in Canada

What this article covers, and what it does not

This is a practical guide to measuring marketing in a way that respects Canadian privacy expectations. It explains the principles behind the law, how they translate into analytics and advertising setups, and what to bring to a conversation with your lawyer.

It is not legal advice. Privacy obligations depend on what kind of organization you are, where your customers live, what you collect and how you use it, and the law and its interpretation keep moving. Your counsel should decide what applies to you. The job of a measurement team is different: to know exactly what the website and marketing systems collect, to make them collect less where they can, and to make sure they do what the organization decided they should.

The good news for anyone worried about losing visibility: the measurement that actually informs decisions (qualified leads, bookings, revenue by source) depends far less on invasive tracking than most setups assume.

The principles behind Canadian privacy law

For most private-sector organizations, federal privacy law (PIPEDA) sets the rules for personal information collected in the course of commercial activity. Some provinces, notably Quebec, Alberta and British Columbia, have their own private-sector laws. Public bodies such as municipalities, universities and provincial agencies usually fall under provincial public-sector privacy legislation instead, and health information often has its own provincial law, including in New Brunswick. That is precisely why the legal question belongs with counsel.

The federal law is built on a set of fair information principles that are easy to state and worth reading in full on the Privacy Commissioner’s website. The ones that matter most for marketing measurement:

• Identifying purposes. Know, and be able to say, why each piece of information is collected.
• Consent. Get meaningful consent, in a form that suits the sensitivity of the information and what a reasonable person would expect.
• Limiting collection. Collect only what is needed for the purposes identified.
• Limiting use, disclosure and retention. Use it for those purposes, share it only as consented, and do not keep it forever.
• Safeguards. Protect it appropriately, including when it sits with a supplier.
• Openness and accountability. Be transparent about practices, and have someone responsible for them.

“Meaningful” is the important word in consent. A notice buried in a privacy policy nobody reads, or a banner that offers only “OK”, is hard to describe as meaningful. The federal regulator has published guidance on what meaningful consent looks like, and it is worth reading before designing a banner.

Quebec’s Law 25 and why New Brunswick organizations notice it

Quebec modernized its private-sector privacy law through what is commonly called Law 25, with requirements phased in over several years. At a principles level, it goes further than federal law in several ways that touch marketing measurement:

• Technology that can identify, locate or profile a person is expected to be off by default, with the person informed and able to turn it on.
• Organizations must designate a person responsible for protecting personal information and publish how to reach them.
• Privacy impact assessments are required in certain situations, including before personal information is communicated outside Quebec, which matters because many analytics and advertising tools process data elsewhere.
• Penalties for non-compliance are significant.

For organizations in New Brunswick, Quebec visitors are not hypothetical. Bilingual sites, tourism offers, recruitment and border-region services all attract them, whether or not anyone planned for it. Our piece on being bilingual by default covers the language side. Whether Law 25 applies to your organization, and how, is for counsel. Many organizations simply decide that a configuration acceptable for Quebec visitors is a sensible default for everyone, which also makes the setup simpler to maintain.

Start with a map of what you actually collect

You cannot minimize what you have not inventoried, and most organizations are surprised by what their website does. Build a simple data map, one line per tool:

• The tool: GA4, Tag Manager, Meta Pixel, LinkedIn Insight Tag, session recording, chat, call tracking, form tool, CRM, email platform.
• What it collects: page views, events, device information, cookies, form contents, recordings, phone numbers.
• Why: the purpose, in a sentence. If nobody can state one, that is a finding.
• Where it goes and where it is stored, including outside Canada.
• Which consent choice governs it, and whether it actually obeys.
• Who owns the account, and how long data is kept.

The map usually turns up old pixels from campaigns that ended years ago, session-recording tools installed for a project and forgotten, and form fields collecting information nobody uses. Removing them is the easiest privacy improvement available, and it makes the site faster.

Data minimization in practice

Minimization means collecting only what a stated purpose requires. In measurement, it looks like this:

• No personal information in analytics. Names, emails and phone numbers should never be sent to GA4, whether in event parameters or in page URLs. Google’s own terms prohibit it. Check form confirmation URLs and site search parameters, which are the usual leaks.
• Fewer tags. Every advertising pixel shares data with another company. Keep the ones tied to active campaigns and remove the rest.
• Shorter retention. Set analytics and CRM retention to what reporting actually needs, not the maximum available by default.
• Fewer form fields. Ask for what you need to respond, plus a self-reported source question. Hidden source fields carry marketing data, not personal profiles.
• Aggregate before sharing. Reports for leadership, boards and suppliers rarely need anything at the individual level.
• Careful with uploads. Sending customer lists or CRM outcomes to ad platforms, even hashed, is still sharing personal information. Confirm with counsel that your consent covers it.

Consent that actually controls the tags

The most common gap is not a missing banner. It is a banner that records a choice and controls nothing, because tags were installed outside the system it talks to. That is arguably worse than no banner at all, because it creates a record of asking and then ignoring the answer.

• Route analytics and advertising tags through a tag manager or consent tool the banner controls.
• Separate categories, at least analytics and advertising, so a visitor can accept one and decline the other.
• Configure Google consent mode deliberately. Whether tags wait entirely for consent or send limited cookieless signals beforehand is a decision for the organization and its counsel, not a default left by a developer.
• Make withdrawal as easy as acceptance, with a link to preferences on every page.
• Test every path, as described in our guide to testing whether website tracking is working. Server-side setups must follow the same choices, as covered in client-side vs server-side conversion tracking.

Email marketing consent is a separate matter, governed by Canada’s anti-spam legislation, and worth its own review.

Measuring well with less data

Honest consent means analytics will see fewer visitors. That is the measurement becoming accurate, not broken, and leadership should be told before the numbers drop. The decisions that matter still have good evidence available:

• The CRM is first-party and complete. Leads, qualification and revenue by captured source do not depend on cookies. Our guide to connecting marketing reporting to sales covers the setup.
• Self-reported source catches referrals, events and word of mouth that tracking never could.
• Trends and comparisons remain valid when consent rates are stable, even if absolute totals are lower.
• Controlled tests (pausing or increasing a channel in one region or period) answer budget questions without tracking individuals at all.

Record the consent configuration and its effect on reporting in your marketing measurement plan, so the numbers are read with the right caveats.

What to bring to your legal review

Lawyers give better answers to specific questions. Bring the data map and ask:

1. Which privacy laws apply to us, given where our customers and visitors are?
2. For each tool on the map, is our purpose legitimate and is our form of consent adequate?
3. Should tracking technologies be off by default for everyone, or only for some visitors?
4. Which data leaves Canada or Quebec, and do we need an assessment before it does?
5. Does our consent cover uploading customer data to ad platforms?
6. Does our privacy policy accurately describe what the site does today?
7. Who is our designated privacy contact, and how are incidents reported?

Then document the decisions and set a review trigger: any new tool, new market, website rebuild or change in the law. In our analytics and measurement work, we configure and verify consent behaviour and produce the data map; interpreting obligations stays with counsel. That division of labour tends to produce setups that are both compliant and genuinely useful, because each side is doing the job it is qualified for.