Every Rule That Might Apply to Your Website

Every article on this site deals with one rule at a time. That is useful when you already know which rule you are worried about, and useless when you do not. So here is the whole list on one page: every rule that can reach a Canadian business website, what each one actually asks for, and who it catches.

Two things to say before the list. The first is that almost nobody is caught by all of these. Most businesses are caught by two or three, and the rest are noise for them. The second is that some of what gets quoted at you is not law yet, and one of the entries below is a bill that has not passed. We have marked which is which, because plenty of people selling compliance do not.

The accessibility rules

AODAAccessibility for Ontarians with Disabilities Act. The Accessibility for Ontarians with Disabilities Act is the one people have heard of, usually as a rumour about fines. Its website requirement lives in a regulation called the IASRIntegrated Accessibility Standards Regulation, the regulation made under the AODA, and that regulation points at WCAGWeb Content Accessibility Guidelines, the technical standard the AODA points at 2.0 Level AA. Note the version: not 2.1, not 2.2. That is 38 criteria, 25 at Level A and 13 at Level AA.

The threshold is the part that gets misrepresented. The website standard applies to the public sector and to organizations with 50 or more employees. Under 50, it does not apply to you. There is a separate 20 employee threshold for filing an accessibility compliance report, which is a different obligation and is not the same thing. Anyone telling you the AODAAccessibility for Ontarians with Disabilities Act catches every business with a single employee is selling something.

Ontario Human Rights CodeOntario's human rights law, which applies at any size and has no employee threshold. This is the rule almost nobody mentions, and for a small business it is the one that matters. It has no employee threshold at all. If a person cannot use your site because of a disability, the Code is what gives them a route to the Human Rights Tribunal of Ontario, and that route exists whether you have two employees or two hundred. It is a quieter argument than a daily fine and it is the true one.

ADAAmericans with Disabilities Act, which has no company size exemption. The Americans with Disabilities Act reaches you if you serve customers in the United States, and it has no company size exemption. Most of the noise you have seen about accessibility lawsuits is American, not Canadian, and it comes from here.

EAAEuropean Accessibility Act, in force since June 2025. The European Accessibility Act has applied since 28 June 2025 to a defined set of products and services sold into the EU, ecommerce among them. Worth knowing if you ship there. Worth also knowing that it is an accessibility law and says nothing at all about cookies, consent or tracking, whatever you may have read.

The privacy rules

PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law. Canada's federal privacy law, and unlike the AODAAccessibility for Ontarians with Disabilities Act it has no employee threshold. If you collect personal information in the course of commercial activity, it applies. What it asks is more reasonable than the marketing suggests: say what you collect and why, in language a person can follow, get consent appropriate to how sensitive the information is, and let people see and correct what you hold.

It does not require a cookie banner. There is no Canadian equivalent of the European banner rule. For ordinary, non sensitive tracking, consent can be implied as long as the notice is findable rather than buried, the purpose is stated plainly, and the opt out is easy and actually works. Express opt in is the requirement where the information is sensitive, where the purpose is profiling a reasonable person would not expect, where the site is aimed at children, and for session recording that captures what someone types.

Quebec Law 25Quebec's privacy law, stricter than PIPEDA and expecting tracking to be off until a visitor turns it on. Stricter than PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law, and in force in stages since September 2022. The headline difference is that technology which profiles, locates or identifies a person has to be off by default. Not off after a click, off on arrival. Whether it reaches a business outside Quebec that has Quebec customers is the Commission d'accès à l'information's stated position rather than a settled question, and no court has ruled on it. Treat it as a live risk, not a certainty.

CASLCanada's Anti Spam Legislation, which governs what you send rather than what you collect. Canada's anti spam law governs what you send and what you install, not what your forms collect. That distinction trips people up constantly. A newsletter signup is CASL's business; what happens to the email address afterwards is PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law's. There is also a detail worth knowing: section 10(8) of CASL treats ordinary browsing conduct as consent to cookies, which cuts squarely against anyone telling you Canadian law demands a banner.

GDPRGeneral Data Protection Regulation, the European privacy law. The European privacy regulation, and together with the ePrivacy rules it is the source of the model everyone recognizes: nothing fires until the visitor agrees. It applies if you offer goods or services to people in the EU. It is the strictest common standard, which is why building to it is a reasonable choice even when it does not apply to you. It is not, however, the Canadian rule, and a lot of Canadian compliance marketing quietly pretends it is.

Bill C-36The Protecting Privacy and Consumer Data Act, tabled June 2026 and still before Parliament. The Protecting Privacy and Consumer Data Act was tabled on 15 June 2026 and is at second reading. It would replace the private sector half of PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law with the Consumer Privacy Protection Act and create a tribunal, with penalties up to $10 million or 3 percent of gross global revenue for administrative violations and $25 million or 5 percent for offences. It is a bill. It is not law, it can change, and it can die on the order paper the way its predecessor C-27 did in January 2025. It is worth watching and it is not a reason to panic.

So which ones are yours

Work down four questions. Do you have 50 or more employees in Ontario, which decides the AODAAccessibility for Ontarians with Disabilities Act website standard. Do you sell into the United States or the European Union, which brings in the ADAAmericans with Disabilities Act, which has no company size exemption and the EAAEuropean Accessibility Act, in force since June 2025. Do you have customers in Quebec, which brings in Law 25. And does your site load analytics or an ad pixel, which is almost always a yes and puts you inside PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law regardless of size.

A two person shop running Google Analytics sits outside the AODAAccessibility for Ontarians with Disabilities Act website standard and squarely inside PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law. A fifty person company selling into the States is inside both lanes and the ADAAmericans with Disabilities Act, which has no company size exemption on top. The mix is different for almost everyone, which is why the honest first question is never what does compliance cost. It is which of these actually applies to me.

One thing worth saying plainly, since this page is nothing but law. We are not lawyers and this is not legal advice. It is what the regulations say and what we keep finding on real sites. For a ruling on your own obligations, talk to a lawyer.