Guide · Privacy
Your contact form
and the law.
The moment a website has a contact form, a booking tool or analytics, it is collecting personal information. In Ontario that is governed by federal law. The obligations are lighter than the templates you find online suggest, but they are real, and they are easy to meet.
Published 2026-09-21 · Formory Group
Which law applies.
Ontario has no general private-sector privacy law of its own, so a business collecting personal information in the course of commercial activity is covered by the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Health information custodians — clinics, dentists, physiotherapists — are covered for health information by Ontario's PHIPA instead, which has its own requirements.
The government introduced a bill to replace PIPEDA's privacy rules in June 2026. As of September it had only had a first reading. PIPEDA is still the law.
Is a privacy policy legally required?
PIPEDA never uses the words "privacy policy". What it has is the openness principle: an organisation must make readily available specific information about how it handles personal information. That includes the name or title and address of the person accountable for privacy, how someone can get access to the information you hold about them, what kinds of personal information you hold and what you use it for, and what you share with related organisations. The Act says this can be provided online.
A privacy page on your website is simply the most sensible way to meet that. So the practical answer is yes: if your site collects anything, publish one.
What a short, honest one says.
Who you are and who to contact about privacy — a named person or role, with an address. What the form collects and why: name, phone and email to answer the enquiry. What else the site collects: analytics, cookies, any booking or payment provider. Who else sees it: the form service, the email provider, the booking tool. How long you keep it. How someone can see or correct what you hold, or ask for it to be deleted.
Six short paragraphs cover a typical service business. A ten-page template copied from a software company describes data you do not collect and makes the page less honest, not more.
Analytics and cookies.
Canada has no cookie-banner law of the European kind. The federal privacy commissioner's guidance on online tracking and advertising accepts opt-out consent for analytics and ad tracking where the purposes are explained clearly and not buried, the notice comes before or at collection, opting out is easy and lasting, no sensitive information is involved, and the data is destroyed or de-identified promptly. Sensitive information or unexpected uses need express consent.
For most small sites that means: say plainly on the privacy page what analytics you use and how to opt out, and do not collect anything you would not want to explain. Visitors from Quebec and the EU bring their own rules; if a meaningful share of your customers are there, get advice.
The email addresses your form collects.
Canada's Anti-Spam Legislation governs what you may send to those addresses later. Someone who made an enquiry gives you implied consent to send commercial email for six months; a customer who bought or leased something from you, for two years. A message that only provides a quote the person asked for is exempt from the consent requirement.
Every commercial email must identify you, give your contact details and include a working unsubscribe, which must be honoured within ten business days. If you want to keep marketing to enquirers beyond six months, add an unticked checkbox to the form asking for express consent, and keep a record of it. The maximum administrative penalty for a business is $10 million; nobody should be anywhere near it, but it explains why the checkbox is worth a minute of your time.
A two-minute check of your own site.
Does the site have a privacy page, linked from the footer and from the form? Does it name a real person or role to contact? Does it mention the analytics you actually run? Does the form ask for anything you do not need — date of birth, a full address for a simple enquiry? Each "no" is a small fix.
This guide is general information from PIPEDA, CASL and the federal privacy commissioner's published guidance. It is not legal advice.
Questions
The usual questions.
I only have a phone number and an email link, no form. Do I need a privacy page?
You are collecting much less, but if the site runs analytics you are still collecting information about visitors. A short privacy page is still the sensible way to meet the openness principle.
Do I need a cookie banner?
Not in the European sense under Canadian law. You need clear, prominent information about tracking and an easy opt-out. A banner is one way to deliver that; a clear privacy page linked from every page is another.
Can I add people who fill in the contact form to my newsletter?
Only with consent. An enquiry gives implied consent for six months. To keep them on the list longer, ask for express consent with an unticked checkbox and keep a record.
Your turn
Same check,
run on your site.
The check behind this page is the one we ran on every business above. Put your own address in and it will load your site on a phone screen, look at the certificate and the page age, and tell you what a visitor meets. No email, nothing stored.
Want the same for
your business?
Tell us what you do and where you work. We will look at what you have now and say plainly whether it is worth rebuilding — including when it is not.