A Canadian business website can fall under four different sets of rules at once: federal privacy law, Quebec’s stricter Law 25, the anti-spam law that governs your newsletter and contact forms, and, in Ontario, accessibility standards. Each one shows up in specific WordPress plugins and settings.
This checklist explains what each rule means on a WordPress site and how to keep it working as the site changes.
PIPEDA: The Federal Baseline
The Personal Information Protection and Electronic Documents Act covers personal information that private-sector businesses collect in the course of commercial activity, including through their websites. In practice, that means collecting only what you need, explaining why, and protecting it.
If a breach creates a real risk of significant harm, you must report it to the Privacy Commissioner and notify the people affected. You must also keep a record of every breach for 24 months, whether or not you reported it. Security monitoring and activity logs make those records possible.
Quebec’s Law 25
If you collect personal information from people in Quebec, Law 25 adds stricter rules. It came into force in stages between 2022 and 2024, and is overseen by the Commission d’accès à l’information.
For a WordPress site, three parts matter most. Privacy settings must offer the highest level of confidentiality by default. You must tell visitors about technology that identifies, locates or profiles them, and how to turn it on. And you need a published privacy policy written in clear language. In practice, that means analytics and marketing tracking off until visitors opt in.
CASL: Consent for Your Forms and Newsletter
Canada’s Anti-Spam Legislation covers commercial emails. You need consent, express or implied, before sending them, every message must identify you, and unsubscribe requests must be honored within 10 business days.
On WordPress, the risk is in the integrations. A newsletter checkbox must not be pre-ticked, and your form must actually pass the consent record to your email platform. Plugin updates break these connections more often than you’d expect, so test a sign-up after each one.
AODA: Accessibility in Ontario
Under the Accessibility for Ontarians with Disabilities Act, businesses and non-profits with 50 or more employees must make their public websites meet WCAG 2.0 Level AA, apart from live captions and pre-recorded audio descriptions. Our practical WCAG guide covers the common WordPress fixes, and the same habit applies everywhere: re-test after major updates.
French-Language Requirements
Businesses serving customers in Quebec generally need a French version of their commercial website under the Charter of the French Language, which Bill 96 strengthened. If you run a bilingual WordPress site, check both languages after updates: the language switcher, translated URLs, consent banner and order emails.
Frequently Asked Questions
Does Law 25 apply if my business isn’t in Quebec?
It can. If you collect personal information from people in Quebec, check whether Law 25 applies to you with a privacy adviser.
Is an unchecked newsletter box enough for CASL?
It is the start. You also need to record when and how consent was given, identify yourself in every email and process unsubscribes within 10 business days.
My business has fewer than 50 employees. Does the AODA apply?
The website requirement doesn’t, but an accessible site still reaches more customers and lowers your risk elsewhere.
Do I need to report every breach?
You must report breaches that create a real risk of significant harm, and keep a record of all breaches for 24 months.
What to Do This Week
- Submit a test newsletter sign-up and confirm the consent record reaches your email platform.
- Check that analytics and marketing tracking stay off until a visitor opts in.
- Start a simple breach log if you don’t already keep one.
- Test your main pages with only a keyboard.
Our managed WordPress maintenance keeps updates, backups and monitoring running underneath all of this. Not sure where you stand? Start with a free site audit.
This article explains the technical side for website owners. It isn’t legal advice; for decisions about your own obligations, talk to a qualified adviser.
Get a free audit covering security, updates, backups, and performance gaps. Takes 60 seconds to request and costs nothing.
