No. WCAG is a W3C recommendation. It becomes binding where a statute, a regulation or a contract points at it. Ontario's O. Reg. 191/11 points at WCAG 2.0 Level AA, and that reference is what makes it enforceable in Ontario. A procurement contract that names WCAG 2.2 Level AA makes that version binding between the parties regardless of where the business is.

Do we need a cookie banner in Canada?

A banner is not itself a legal requirement anywhere in Canada. The questions the law asks are whether consent was meaningful under PIPEDA, and in Quebec whether profiling technology was disclosed with a means to deactivate it under section 8.1 of P-39.1. A banner is one way to answer those questions, and a banner that sets tracking before anyone clicks answers them badly.

Our site is in English and some of our customers are in Quebec. Does the Charter apply?

That is a determination for counsel, and the trigger is whether the enterprise is doing business in Quebec rather than whether a customer happens to live there. What a builder can say is what the design has to carry if the answer is yes: a content model where each language is a first-class version, per-language URLs, and system messages authored in each language rather than translated at the end.

How much of this has to be decided before the build starts?

Most of it, and that is the practical argument for raising it early rather than a scare tactic. Consent records, retention rules, the language content model, heading structure and keyboard order are ordinary design decisions at the start of a project and expensive retrofits at the end of one. The determinations can arrive later. The structure that makes them cheap to act on cannot.

What Canadian law requires of a website. HUREAL.

The map

Five regimes,and who each one binds.

There is no single Canadian website law. There is a federal privacy statute, a federal anti-spam statute, one province with a dated web accessibility standard, five provinces with accessibility framework acts at different stages, a separate federal accessibility regime for banks and carriers, and Quebec, which has two statutes of its own that reach a website directly.

Most of the confusion in this area comes from mixing those up. The table below separates them. Read the second column first: whether an instrument binds a particular business is almost always a question about the business, not about the website.

What reaches a Canadian business website, and who it binds
The instrument	Who it binds	What it puts on the website
AODA, and O. Reg. 191/11 s. 14	Organizations with 50 or more employees in Ontario, and the Ontario public sector.	Conformance with WCAG 2.0 Level AA, with two criteria excepted.
Accessible Canada Act	Federally regulated entities: banks, telecommunications, broadcasting, interprovincial transport, the federal public service.	A published accessibility plan, a feedback process, and progress reports on a fixed cycle.
Provincial accessibility acts outside Ontario	Prescribed organizations, which so far are mostly public sector.	Committees, plans and feedback channels. The technical standards are still being made.
PIPEDA	Organizations handling personal information in commercial activity, outside Alberta, British Columbia and Quebec for activity wholly inside those provinces.	A stated purpose at collection, meaningful consent, retention limits, safeguards, and breach reporting.
Quebec's Law 25, amending P-39.1	Enterprises handling personal information in Quebec.	A named privacy officer published on the site, consent per purpose, disclosure of profiling technology, and an incident register.
Charter of the French Language	Enterprises doing business in Quebec.	A French version available on terms at least as favourable as any other version.
CASL	Anyone sending a commercial electronic message to or from Canada.	Consent before sending, identification of the sender, and an unsubscribe that works.

Scroll the table sideways to read it.

Nothing in that table is a determination about any particular business. Whether an organization is an obligated organization under the AODA, whether a processing activity is commercial activity under PIPEDA, and whether an enterprise is doing business in Quebec are all questions for counsel. What follows is the mechanism, which is the part a builder can settle.

Accessibility, part one

One province has a deadline.The rest have a direction.

Ontario's Integrated Accessibility Standards, O. Reg. 191/11 made under the Accessibility for Ontarians with Disabilities Act, 2005, is the only instrument in Canada that names a web accessibility standard, a conformance level and a date, and applies all three to a private business. Section 14 of that regulation requires designated public sector organizations and large organizations to make their internet websites and web content conform with WCAG 2.0 Level AA, other than success criterion 1.2.4, Captions (Live), and success criterion 1.2.5, Audio Description (Pre-recorded). The schedule in section 14 set 1 January 2021 as the date by which all such websites and web content were to conform.

Three definitions do most of the work, and they are all in the regulation rather than in the Act. A large organization is an obligated organization with 50 or more employees in Ontario. An obligated organization includes every person or organization that provides goods, services or facilities to the public or to other third parties and has at least one employee in Ontario, which is why a company headquartered elsewhere can be inside the regulation. And the standard attaches to new websites and significant refreshes, a phrase the regulation defines, which is the clause that decides whether a rebuild inherits the obligation or merely continues an old one.

The AODA also requires obligated organizations to file accessibility reports with the province on a recurring cycle, and Ontario sets the filing threshold for a business at 20 or more employees. That is a lower threshold than the website standard's 50, and the two are frequently conflated. A business with 30 employees in Ontario files a report and is not caught by section 14's website requirement. A business with 60 does both.

The part that is usually left out

Section 37 of the Act sets the maximum fine on conviction at $100,000 for each day the offence occurs or continues for a corporation, and $50,000 a day for a director or officer. Those are ceilings on a prosecution, and a prosecution is not the usual route.

The route a complainant actually takes is the Ontario Human Rights Code, which has been applied to digital barriers. That matters for scoping, because the Code's duty to accommodate is not limited to the criteria the regulation excepts. Ontario's regulation lets a business off live captions and pre-recorded audio description. The Code does not automatically do the same, and a video that carries important information with no alternative is a different argument from a video that fails a checklist item.

The second practical exposure is procurement. Large buyers, public sector buyers and prime contractors ask about accessibility in tenders, and the answer is either a document with test results in it or an assurance. Only one of those survives a follow-up question.

Accessibility, part two

What the rest ofthe country says today.

Five provinces besides Ontario have accessibility framework legislation. A framework act creates a body, a planning duty and a power to make standards. It does not, on its own, tell anybody which version of WCAG to build to. Reading them as though they did is the most common error in this area, in both directions: some businesses assume they are bound when they are not, and some assume they are clear when a standard has since been made.

British Columbia

The Accessible British Columbia Act, S.B.C. 2021, c. 19, requires prescribed organizations to establish an accessibility committee, an accessibility plan and a public feedback mechanism. The organizations prescribed so far are public sector.
Framework act. No technical web standard in force for private business.
Manitoba

The Accessibility for Manitobans Act, C.C.S.M. c. A1.7, carries an Accessible Information and Communication Standard made under it, phased in by sector. Its centre of gravity is providing information in accessible formats on request, which is a duty a website participates in rather than a conformance target the website has to hit.
Standard made. Check your sector's date in the regulation.
Nova Scotia

The Accessibility Act, S.N.S. 2017, c. 2, sets a statutory goal of an accessible province by 2030 and makes standards in stages, beginning with areas other than information and communication.
Framework act. Standards arriving in sequence.
Newfoundland and Labrador, and Saskatchewan

The Accessibility Act, S.N.L. 2021, c. A-1.001, and The Accessible Saskatchewan Act, S.S. 2023, c. 1, are both framework acts of the same shape: a plan, a committee, a feedback route, and standards to come.
Framework acts. Early stage.
Federally regulated businesses

The Accessible Canada Act, S.C. 2019, c. 10, applies to banks, telecommunications and broadcasting, interprovincial transport, the federal public service and Crown corporations. It requires a published accessibility plan, a feedback process and progress reports on a recurring cycle, and it names information and communication technologies as one of the areas a plan must address. Accessibility Standards Canada has published a national ICT standard that adopts the European EN 301 549, which in turn incorporates WCAG by reference.
A planning and reporting duty, plus a standard to work to.
Quebec, and the remaining provinces

Quebec has no general web accessibility statute for private business; its public sector works to a government web standard of its own. Alberta, New Brunswick and Prince Edward Island have no equivalent framework act at the time of writing.
Check before assuming either way. This map changes.

A company that sells into more than one province now has a choice between tracking six instruments on six timetables, or building once to the highest standard in the set and keeping the evidence. The second is cheaper, and it is cheaper by a wide margin, because the expensive part of accessibility is never the standard. It is discovering at launch that the heading structure, the form labels and the keyboard order all have to be redone.

Which version

Ontario says 2.0.Build to 2.2.

WCAG is a W3C recommendation, not a law. It becomes binding when a statute, a regulation or a contract points at it, which is what Ontario's regulation does. The W3C designed 2.1 and 2.2 as backwards-compatible supersets, so content that conforms to WCAG 2.2 Level AA also conforms to 2.1 Level AA and 2.0 Level AA. One target therefore satisfies Ontario's regulation, the reference chain running through the federal ICT standard, and the procurement questionnaire that asks which current version you test against.

The nine success criteria WCAG 2.2 added are the ones most likely to be missing from a site built five years ago, and they are unusually concrete: focus not obscured, at minimum and enhanced; focus appearance; dragging movements; target size at minimum; consistent help; redundant entry; and accessible authentication at minimum and enhanced. WCAG 2.2 also removed 4.1.1 Parsing, which had become a test of a rule browsers no longer enforce.

Four of those are worth naming for anyone scoping a rebuild, because they change design decisions rather than markup. Target size sets a floor on how small a tap target can be, which reaches every icon button on a phone. Dragging movements requires a single-pointer alternative wherever a drag is the only way to do something, which reaches sliders, sortable lists and map interfaces. Accessible authentication constrains login flows that require a cognitive test, which reaches puzzle CAPTCHAs and some memory-based challenges. Consistent help requires that a help mechanism appear in the same relative place on every page, which is a layout rule rather than a code rule.

On overlays and toolbars. Conformance is assessed against the page as it is delivered to the person using it. A script injected at load that adds a floating toolbar does not change the heading structure, the form labels, the contrast ratios, the tab order or the alternative text underneath it, so the assessment of those things does not change either. Where a widget is genuinely useful it is useful in addition to a conforming page, never instead of one. This is a mechanism, not an opinion about any product.

Privacy, federal

PIPEDA, andwhere it does not reach.

The Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, applies to organizations that collect, use or disclose personal information in the course of commercial activities. Alberta, British Columbia and Quebec have private-sector privacy statutes that were declared substantially similar, so for activity wholly inside those provinces the provincial statute governs instead. PIPEDA still reaches federal works and undertakings, and personal information that crosses a provincial or national border, which is most of what a website does the moment it uses a hosted form service.

The substance is in Schedule 1, which carries ten principles. Five of them change a build rather than a policy. Identifying purposes requires the purpose to be identified at or before collection, which is a sentence next to the form rather than a link to a policy page. Consent has to be meaningful, and section 6.1 makes it valid only if it is reasonable to expect that the individual would understand the nature, purpose and consequences of what they are agreeing to. Limiting collection rules out the field nobody uses. Limiting retention requires information to be kept only as long as necessary, which means a retention rule per record type and something that actually enforces it. Safeguards have to be proportionate to sensitivity.

Two operational duties matter more than they look. Under section 8 an organization has to respond to an access request with due diligence and in any case within 30 days, which is a question about whether anybody can find all of a person's records at all. And under Division 1.1, a breach of security safeguards that creates a real risk of significant harm must be reported to the Privacy Commissioner and notified to affected individuals, with a record of every breach kept for 24 months, including the ones that did not meet the reporting threshold. The second half of that sentence is the part that gets missed: the record-keeping duty covers all breaches, not the reportable ones.

The Privacy Commissioner, together with the Alberta and British Columbia commissioners, has published guidelines on obtaining meaningful consent. They are guidance rather than law, and they are the clearest available statement of what a regulator expects a consent interface to look like, which makes them the most useful single document on this list for anyone designing a form.

Privacy, Quebec

Law 25, and the clausemost builds get backwards.

Law 25 is the short name for An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25. It is not itself the operative law. It amended the Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, and it is P-39.1 that a business is actually held to. Its obligations came into force in three waves, in September 2022, September 2023 and September 2024, and the last of those brought the portability right.

Five provisions reach a website directly. Section 3.1 requires an enterprise to have a person in charge of the protection of personal information and to publish that person's title and contact information on its website, which is the only obligation in this entire article that names a page. Section 8 sets out what a person must be told at the point of collection: the purposes, the means, their rights of access and rectification, and their right to withdraw consent. Section 8.1 requires that where technology allowing a person to be identified, located or profiled is used, the person is informed and given the means to deactivate it. Section 14 requires consent to be requested for each purpose, in clear and simple language, and presented separately from any other information. And sections 3.5 onward require confidentiality incidents to be reported where there is a risk of serious injury, and every incident to be entered in a register.

Then there is section 9.1, which is the one that gets reported backwards. It requires that a technological product or service offered to the public that collects personal information provide, by default, the highest level of confidentiality, without any intervention by the person concerned. It is widely described as Quebec's cookie rule. The section's own second paragraph says it does not apply to privacy settings for browser cookies.

That is not a licence to ignore tracking. It relocates the obligation. Consent for tracking in Quebec comes from the general consent provisions and from section 8.1's duty to disclose profiling technology and provide a way to switch it off, not from section 9.1's default-privacy rule. The practical difference is real: a build that treats section 9.1 as a cookie rule tends to produce a banner and stop, and a build that reads section 8.1 correctly produces a disclosure, a deactivation control that persists, and a record of what the person chose.

What the exposure looks like

The Act provides for administrative monetary penalties of up to $10,000,000 or 2 per cent of worldwide turnover for the preceding fiscal year, whichever is greater, and penal fines of up to $25,000,000 or 4 per cent, whichever is greater. Those are the statutory ceilings, and like all ceilings they are not the expected outcome of any particular failure.

The provision that changes behaviour faster is the private right of action, which allows a court to award punitive damages of at least $1,000 for an unlawful infringement. A floor on punitive damages, in a province with an active class action bar, is a different kind of risk from a regulator's discretion.

Language, Quebec

What "at least as favourable"means on a page.

The Charter of the French Language, CQLR c. C-11, as amended by S.Q. 2022, c. 14, commonly called Bill 96, is the instrument. Section 52 requires that catalogues, brochures, folders, commercial directories, order forms and any other documents of the same nature available to the public be drawn up in French, and that where a version in another language is available to the public, the French version be available on terms at least as favourable. Quebec's language regulator, the OQLF, applies that to commercial websites.

Two further sections reach the build. Section 55 requires contracts of adhesion to be drawn up in French, with a party able to consent to another language only after examining the French version, which catches terms of service, subscription agreements and anything accepted at checkout. Section 5 gives consumers of goods and services the right to be informed and served in French, and being served includes the error message, the order confirmation, the automated follow-up and the support channel, not only the marketing pages.

"At least as favourable" is the phrase that decides most of the work, because it is comparative rather than absolute. It does not ask whether a French page exists. It asks whether the French experience is as good. Six things fail that comparison in practice, and every one of them is a build decision rather than a translation decision:

A French page that is a shorter summary
The English page carries specifications, pricing guidance and a form. The French page carries three paragraphs and a phone number.
French behind an extra click
A visitor from Quebec lands on English and has to find a switch. The English visitor never has to find anything.
A translation widget instead of a page
Machine output rendered at read time has no URL of its own, is not in the sitemap, cannot be indexed, and changes between visits.
French excluded from search
The French pages are missing from the sitemap, blocked in robots.txt or carry a noindex left over from staging. Available to the public means findable.
A thinner French checkout
The English flow offers three payment methods and saved details. The French flow offers one, because the second integration was scoped as a phase two.
English-only system messages
The pages are French. The validation errors, the confirmation email, the password reset and the invoice are not, because they come from a different part of the stack.

Where this stops being a website question. Whether the Charter attaches to a particular enterprise, how the trademark exceptions apply after the 2025 changes to the commerce and business regulation, and what the OQLF complaint process means for a given company are all determinations. They belong to counsel. What a build can do is make sure that if the answer is yes, the structure already supports it: a content model where each language is a first-class version rather than a field on the English one, per-language URLs, and system messages authored in each language rather than translated at the end.

Electronic messages

A form usuallybecomes an email.

Canada's anti-spam legislation, S.C. 2010, c. 23, requires consent before a commercial electronic message is sent, identification of the sender in the message, and an unsubscribe mechanism that can be readily performed and is given effect within 10 business days. Consent can be express or implied. Implied consent from an existing business relationship runs two years from the transaction, and from an inquiry, six months. There is also implied consent from conspicuous publication, where a business address is published without a statement refusing unsolicited messages and the message is relevant to the person's role.

The statute sets administrative monetary penalties of up to $10 million for an organization and $1 million for an individual. It also regulates the installation of computer programs on another person's device, which is a part most website work never considers and which can reach some categories of tracking and companion software.

What it changes in a build is short and testable. The consent control is never pre-ticked and never bundled into the submit action, because a bundled consent is not given for a specific purpose. The consent record stores the date, the exact wording that was on screen, and the page it was given on, because the burden of proving consent sits with the sender and a database column reading "true" proves nothing. The unsubscribe link appears in every commercial message and works without a login, because requiring an account to unsubscribe is not a mechanism that can be readily performed.

The line

What a build settles,and what it cannot.

Almost every question in this article splits cleanly in two. One half is an engineering fact that can be measured on a page and written down. The other half is a legal determination about a specific business. Mixing them is how a vendor ends up asserting something they are not in a position to assert.

Settled by the build, and measurable

Which WCAG version and level the site was tested againstAnd the result per success criterion, with the method recorded.
Whether the site works with a keyboard alone, and with a screen readerTested by a person on a real page, not inferred from a scan.
Where every form's purpose statement sits, and what it saysAt the point of collection, in the reader's line of sight.
What each third-party script receives, and when it loadsBefore or after consent, with the list written down.
How long each record type is kept, and what deletes itA rule with something enforcing it, not a paragraph in a policy.
Whether the consent record stores date, wording and sourceWhich is what proving consent later actually requires.
Whether the French version is complete, indexed and equivalentSame depth, same URL structure, same forms, same messages.
Whether the unsubscribe works without a loginTested from a real message, on a device with no session.

Determined by your counsel or your privacy officer

Whether your organization is an obligated organization, and whereEmployee counts, provinces of operation, and which entity employs them.
Whether a given activity is commercial activity under PIPEDAAnd which provincial statute displaces it, if any.
Whether consent is express or implied for a given audienceAnd how long an implied consent has left to run.
Whether the Charter attaches to your enterpriseAnd what it requires of the parts of the business that are not the website.
Whether an incident carries a real risk of significant harmWhich is the trigger for reporting, and a judgement call.
What your retention periods must be under other lawTax, employment and sector rules routinely override "as short as possible".
The determination itself, in every one of these regimesA vendor offering to make it is offering something they do not have.

The useful test for any supplier in this area is which column they put themselves in. A supplier who volunteers the right-hand column unprompted is telling you where their competence ends, which is the only way to know that the left-hand column is real.

Questions

Questions peopleactually ask.

Does the AODA apply to a company based outside Ontario?

It can. The regulation defines an obligated organization to include every person or organization that provides goods, services or facilities to the public or to other third parties and has at least one employee in Ontario. The website standard in section 14 then attaches to large organizations, meaning 50 or more employees in Ontario. Head office location is not the test.
Is WCAG a law?

No. WCAG is a W3C recommendation. It becomes binding where a statute, a regulation or a contract points at it. Ontario's O. Reg. 191/11 points at WCAG 2.0 Level AA, and that reference is what makes it enforceable in Ontario. A procurement contract that names WCAG 2.2 Level AA makes that version binding between the parties regardless of where the business is.
Does an accessibility widget satisfy the standard?

Conformance is assessed against the page as delivered to the person using it. A script that adds a toolbar does not change the heading structure, the form labels, the contrast ratios, the tab order or the alternative text underneath it, so it does not change the assessment of those things. Where such a tool is useful it is useful in addition to a conforming page rather than instead of one.
Do we need a cookie banner in Canada?

A banner is not itself a legal requirement anywhere in Canada. The questions the law asks are whether consent was meaningful under PIPEDA, and in Quebec whether profiling technology was disclosed with a means to deactivate it under section 8.1 of P-39.1. A banner is one way to answer those questions, and a banner that sets tracking before anyone clicks answers them badly.
Our site is in English and some of our customers are in Quebec. Does the Charter apply?

That is a determination for counsel, and the trigger is whether the enterprise is doing business in Quebec rather than whether a customer happens to live there. What a builder can say is what the design has to carry if the answer is yes: a content model where each language is a first-class version, per-language URLs, and system messages authored in each language rather than translated at the end.
How much of this has to be decided before the build starts?

Most of it, and that is the practical argument for raising it early rather than a scare tactic. Consent records, retention rules, the language content model, heading structure and keyboard order are ordinary design decisions at the start of a project and expensive retrofits at the end of one. The determinations can arrive later. The structure that makes them cheap to act on cannot.

Sources

Everything above,at its source.

Every instrument named in this article, in the order it was used. Nothing here is secondary commentary, and none of it is behind a paywall.

Accessibility for Ontarians with Disabilities Act, 2005, S.O. 2005, c. 11

The Act itself, including the reporting duty and the offence provisions in section 37.
ontario.ca/laws/statute/05a11
Integrated Accessibility Standards, O. Reg. 191/11

Section 14 is the website standard. Section 1 carries the definitions of obligated organization, large organization, new internet website and significant refresh.
ontario.ca/laws/regulation/110191
Accessible Canada Act, S.C. 2019, c. 10

The federal regime, including the areas an accessibility plan must address.
laws-lois.justice.gc.ca/eng/acts/A-0.6
Web Content Accessibility Guidelines 2.2

The W3C recommendation, including the conformance section that establishes backwards compatibility with 2.1 and 2.0.
w3.org/TR/WCAG22
Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5

Section 4 for application, section 6.1 for valid consent, section 8 for access requests, Division 1.1 for breach reporting, and Schedule 1 for the ten principles.
laws-lois.justice.gc.ca/eng/acts/P-8.6
Act respecting the protection of personal information in the private sector, CQLR c. P-39.1

As amended by S.Q. 2021, c. 25. Sections 3.1, 8, 8.1, 9.1 and 14 are the ones that reach a website.
legisquebec.gouv.qc.ca/en/document/cs/P-39.1
Charter of the French Language, CQLR c. C-11

As amended by S.Q. 2022, c. 14. Sections 5, 52 and 55.
legisquebec.gouv.qc.ca/en/document/cs/C-11
Canada's anti-spam legislation

The Government of Canada's official information site for the statute, including the consent and unsubscribe requirements.
fightspam.gc.ca
Office of the Privacy Commissioner of Canada

Guidance, including the consent guidelines issued jointly with the Alberta and British Columbia commissioners.
priv.gc.ca

Three that followfrom this one.

The service behind this article

This work happensinside a build.

Everything in the left-hand column above is designed and tested as part of Websites and Platforms, and documented so that the people who make the determinations have something to read. The standard is named, the test results are recorded per surface, and the word used for the outcome is what was built and what it returned.

A performance audit reports what your site does today against the standard it would be tested to. Keyboard and screen reader, contrast, heading structure, form labels, what each third-party script receives, and what an indexer and an answer engine can read. It is a document about your company, and it is yours whether or not anything follows it.

Request a performance audit

More on this subject in the Websites and Platforms index, and everything else at Insights.

What Canadian lawrequires of a website.

Five regimes,and who each one binds.

One province has a deadline.The rest have a direction.

The part that is usually left out

What the rest ofthe country says today.

British Columbia

Manitoba

Nova Scotia

Newfoundland and Labrador, and Saskatchewan

Federally regulated businesses

Quebec, and the remaining provinces

Ontario says 2.0.Build to 2.2.

PIPEDA, andwhere it does not reach.

Law 25, and the clausemost builds get backwards.

What the exposure looks like

What "at least as favourable"means on a page.

A form usuallybecomes an email.

What a build settles,and what it cannot.

Settled by the build, and measurable

Determined by your counsel or your privacy officer

Questions peopleactually ask.

Does the AODA apply to a company based outside Ontario?

Is WCAG a law?

Does an accessibility widget satisfy the standard?

Do we need a cookie banner in Canada?

Our site is in English and some of our customers are in Quebec. Does the Charter apply?

How much of this has to be decided before the build starts?

Everything above,at its source.

Accessibility for Ontarians with Disabilities Act, 2005, S.O. 2005, c. 11

Integrated Accessibility Standards, O. Reg. 191/11

Accessible Canada Act, S.C. 2019, c. 10

Web Content Accessibility Guidelines 2.2

Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5

Act respecting the protection of personal information in the private sector, CQLR c. P-39.1

Charter of the French Language, CQLR c. C-11

Canada's anti-spam legislation

Office of the Privacy Commissioner of Canada

Three that followfrom this one.

What actually moves the price of a build

What a Canadian store has to get right

The year after a site launches

This work happensinside a build.

Software you own from day one.