The legal minimum in Canada

Not legal advice, and worth a professional's eye if anything here is close to the line for you. But these are the rules that apply to an ordinary Canadian business website, and most sites are quietly in breach of at least one.

A privacy policy

If you collect any personal information — and a contact form is personal information — federal privacy law expects you to say what you collect, why, what you do with it, and how someone can ask to see or delete it.

Yours needs to cover:

• What you collect, in specifics, listing the form fields.
• Why, and what you use it for.
• Who else handles it. This one is missed constantly: your website host, your form service and your email provider all process it, and many are in the United States, which means data crossing the border. Say so.
• How long you keep it.
• How someone asks for a copy or a deletion, and who to contact.
• That people can complain to the Office of the Privacy Commissioner of Canada.

Write it yourself in plain language. A generic template is usually inaccurate about your specific setup, and the representation you make is the one you are held to.

Keep it true. The day you add analytics, a chat widget or a Meta pixel, your policy has to change too.

Cookies

If your site sets no cookies and runs no analytics, say so and you need no banner. That is a genuinely good position and it is achievable for most small business sites.

The moment you add analytics or advertising tools, you are tracking people, and you need meaningful consent — which means a real choice, not a banner that only says "OK".

Worth deciding deliberately: most small businesses install Google Analytics, never look at it, and take on a compliance obligation in exchange for nothing. Your Business Profile and Search Console give you more useful information without setting a single cookie.

Email rules, which have teeth

Canada's anti-spam legislation is stricter than most people expect, and the penalties are not theoretical.

• You need consent before sending commercial email. Someone enquiring about a job is not consent to a newsletter.
• Every commercial message needs your name, a postal address and contact details.
• Every one needs a working unsubscribe honoured within ten business days.
• Keep records of when and how consent was given.

Never buy an email list. Never add enquirers to a mailing list because they contacted you.

Accessibility

Beyond being right, accessibility obligations are tightening across Canadian jurisdictions, and public-facing business websites are within scope in a growing number of them. Chapter 11 gets you most of the way; treat it as a requirement rather than a nicety.

Also worth having

• Terms of service, if you sell online or take bookings.
• Accurate business identification — your legal name and contact details findable on the site.
• Accessible contact information, which is both a legal expectation in some contexts and the thing customers want anyway.

What to do now

• Write your privacy policy, honestly, covering your actual setup.
• Decide whether you want analytics, knowing the trade.
• If you plan to email people, read the anti-spam rules properly.