Consent
Consent is an individual’s meaningful agreement to the collection, use, or disclosure of their personal information — and under Canadian law it must be informed and, for sensitive data, express.
Consent is the cornerstone of PIPEDA and Law 25. It must be *meaningful*: the person needs to understand what is collected, why, and who it may be shared with, in plain language.
Canadian law recognizes two forms:
- Express consent — an active, unambiguous opt-in (checking a box, clicking “I agree”). Required for sensitive information (health, financial, SIN) and, under CASL, for most commercial electronic messages.
- Implied consent — reasonably inferred from the person’s action or the obvious purpose (giving your address to receive a delivery). Only appropriate for non-sensitive, expected uses.
Law 25 tightens the rules further: consent for sensitive information must be express, requests must be clear and separate from other terms, and consent for minors under 14 must come from a parent. Consent can always be withdrawn.
