CPPA (Consumer Privacy Protection Act)
The CPPA was the proposed federal law meant to replace PIPEDA’s private-sector rules with stronger consent, individual rights, and order-making and fining powers; it died with Bill C-27 in January 2025.
The Consumer Privacy Protection Act (CPPA) was the centrepiece of Bill C-27. It would have replaced PIPEDA’s private-sector provisions with modernized rules: clearer consent, a right to disposal (deletion), data mobility, special protections for minors’ information, and — crucially — real enforcement power, including order-making and administrative monetary penalties, plus a new Personal Information and Data Protection Tribunal.
The bill also proposed the Artificial Intelligence and Data Act (AIDA) as a companion.
Because Parliament was prorogued in January 2025, Bill C-27 and the CPPA died on the Order Paper. Until any successor is passed, PIPEDA remains the governing federal private-sector law.
