Today, e-commerce operations are subject to a diverse and evolving range of federal and provincial legislation. This requires companies to ensure their existing and new e-commerce operations are compliant to avoid risk exposure, whether in the form of penalties, legal action, or public relations issues.
Whether as a traditional retailer considering new ways of doing business online or an e-commerce retailer looking to build on an existing platform, both must constantly be adapting to new demands and legal considerations when engaging the online market.
This bulletin provides a business-focused overview of the legal requirements to consider when launching or upgrading an e-commerce business in Canada. These considerations range from consumer protection, to privacy, to language rules, to online marketing, to payment processing, and finally accessibility.
- Consumer Protection
E-commerce businesses must ensure that their consumer-facing materials comply with provincial consumer protection legislation across the Canadian provinces. These laws range from general consumer protections against unfair or deceptive business practices, to regulating consumer transactions and related services. Consumer protection laws must be considered in your terms of service, purchase policy, shipping policy, exchange/return policy, and loyalty and subscription program terms and benefits.
In addition to consumer-facing materials, internal company policies and procedures must align with consumer protection laws, covering areas such as payment processes, prepaid cards, rebate and rewards programs, samples, and warranties, as well as credit programs (ex: buy-now-pay-later).
- Privacy
Since the recent Law 25 amendments, Québec’s Act respecting the protection of personal information in the private sector (“The Private Sector Act”) poses significant challenges for businesses in safeguarding and processing personal information. Compliance with Québec, federal, and other provincial privacy laws is paramount in the e-commerce business. With the implementation of Law 25, between 2021 and 2024, Québec now has the strictest regime in Canada. For example, if you collect, use, disclose, or retain personal information as part of your e-commerce activities in Québec, you must have a privacy policy that meets Law 25’s new transparency requirements. If you use profiling technology, such as cookies, you must implement a mechanism that announces the use of such technology and that indicates to users how to enable it (this is usually done through a cookie banner and a cookie policy). For other uses, Law 25 may require obtaining separate consent (see our bulletin on consent requirements in Québec).
Companies must also ensure that their data governance policies and procedures are compliant with the relevant legislation, which include, for Québec, designating a privacy officer, the inventory of personal information processing activities, maintaining a register of confidentiality incidents, as well as conducting privacy impact assessments in certain circumstances. Québec privacy legislation also requires that companies adopt a governance framework for the protection of personal information throughout its lifecycle, as well as a mechanism for handling complaints. In case of non-compliance with Québec’s Law 25, fines can be steep: penalties can reach $10 million or 2% of global revenue, and for more serious offenses, $25 million or 4% of global revenue, whichever is higher.
- French-Language Compliance
French is the only official language of Québec. Retail and e-commerce businesses must therefore contend with stringent language rules when marketing and selling goods and services in the province, and even more so since Bill 96 amended Québec’s Charter of the French Language. Québec language legislation requires that promotional materials (including websites and social media), products (including their packaging and labelling), public signage, and commercial advertising be drawn up in French. English may be used on these consumer-facing materials, but French must be presented in at least equivalent conditions to English (or, markedly predominant on exterior public signage). In this regard, Bill 96 has significantly tightened the rules applicable to the use of non-French trademarks in public signage and on products (see our bulletin on this topic). There are certain exceptions to these rules, most notably for non-French trademarks, but restrictions apply and it may prove challenging to navigate this complex web of language rules. In case of non-compliance with the French Language Charter, fines can reach $30,000, $60,000, and even $90,000, for first and second offenses and any subsequent offense, and each day of non-compliance constitutes a distinct infraction.
Additionally, the federal Consumer Packaging and Labeling Act imposes bilingual language requirements on consumer goods, regardless of which province they are sold.
- Marketing and Advertising
Marketing and advertising activities in the e-commerce landscape must be compliant with various federal legislation. In particular, businesses must consider federal anti-spam legislation (“CASL”), which protects consumers and businesses from the misuse of digital technology, including spam and other electronic threats. CASL imposes strict requirements for sending commercial electronic messages, including obtaining consent or relying on implied consent.
Other federal legislation also applies to the practice of e-commerce and various types of consumer goods that are sold via e-commerce platforms. This includes an overarching prohibition on false and misleading representations in labels and advertising, as well as protections applicable to specifically regulated goods such as textiles, cosmetics, foods, and items for use by babies or children.
Moreover, certain advertising claims are subject to specific conditions. Notably, with trade tensions looming between the United States and Canada, Canadian business may increasingly be looking to make “origin claims”, such as “Made in Canada”, “Proudly Canadian” or include a call to action to “Buy Canadian”. However, businesses must ensure the accuracy of such origin claims. There are strict criteria to respect for consumer goods, such as requiring that a “Product of Canada” has had its last substantial transformation in Canada and that 98% of total direct costs of producing or manufacturing have occurred in Canada. As is the case with all marketing and advertising claims, retailers must make accurate claims and not mislead the public (see our bulletin on this topic).
- Payment Products
E-commerce operations are at the forefront of payment methods innovations. With the introduction of new payment methods (i.e. virtual wallets or currency), handling payments in the context of e‑commerce operations may be subject to the new federal Retail Payment Activities Act and corresponding laws aimed at protecting end-user funds. These laws govern retail payments activities, including payments handling and digital wallets, and the federal Act requires as well, in certain cases, registration as a “payment services provider” with the Bank of Canada (see our bulletin on this topic).
- Accessibility
Finally, businesses operating in Ontario must also consider the Accessibility for Ontarians with Disabilities Act (“AODA”). The AODA requires that consumer-facing materials be accessible, in terms of developing and maintaining accessible website content, including alternatives to text, and an accessibility policy.
In order to build an e-commerce site right the first time, it is important to take action at the design phase to avoid having to retrofit the site for legal compliance after it is launched. This is the most time- and cost-effective way of minimizing risk.
Do not hesitate to contact Fasken’s e-commerce team for more information on how these considerations may apply to your business. We will work with you to achieve your commercial goals while also minimizing legal risk.
