Canada Introduces Privacy Reform Bill With AI Protections for Children's Data and a Ban on Surveillance Pricing
The Canadian federal government tabled its long-promised update to private-sector privacy law on June 16, 2026, launching the Liberals' third attempt to modernize the Personal Information Protection and Electronic Documents Act for the AI era. AI Minister Evan Solomon introduced the bill in the House of Commons, addressing AI data collection, children's data rights, and a prohibition on surveillance pricing by retailers - while critics immediately questioned whether the government's simultaneous privacy-eroding bills undercut the reform's credibility.
The bill is expected to include protections for children's data as well as measures ensuring Canadians' data is not used for surveillance pricing by private retailers like grocery stores. Solomon told reporters the government was looking at "right to deletion in privacy legislation" and ensuring children's information is treated sensitively, adding the government was looking at "enshrining privacy as a fundamental right." Apple
Why This Matters Now
The context behind the bill is impossible to separate from the Anthropic export control issued two days earlier and a joint federal-provincial investigation into OpenAI completed last month.
A joint investigation by federal and provincial privacy commissioners found OpenAI, the company behind ChatGPT, engaged in "overly broad" data collection without getting Canadians' consent. That investigation led OpenAI to commit to enhanced privacy safeguards and data collection policies. Privacy commissioners said Canada's privacy laws need modernized language that restrains AI companies from overly broad and accountability-free data harvesting. Apple
Federal privacy commissioner Philippe Dufresne has repeatedly called for stronger enforcement powers under PIPEDA, including the ability to issue monetary penalties. The Liberals' third attempt at privacy reform comes after bills introduced in 2020 and 2023 both failed to become law, leaving Canada with privacy legislation that predates the smartphone, let alone generative AI. Apple
The Credibility Problem
The bill arrived with immediate criticism from legal experts who argue the government is pursuing privacy reform with one hand while undermining it with the other.
Michael Geist, a law professor and Canada Research Chair in internet and e-commerce law at the University of Ottawa, said: "This is a government that is talking about making privacy a fundamental priority and a foundational element of forthcoming privacy law - and yet at the same time, is putting forward as part of Bill C-22 what may be one of the most invasive privacy-related issues we've seen in years in Canada." He added: "Simply put, the government cannot credibly claim to treat privacy as a fundamental right while actively undermining that right through a series of other bills and efforts to sideline the Privacy Commissioner of Canada." Apple
Bill C-22, the lawful access bill currently moving through Parliament, has raised alarm among tech companies and privacy experts for potentially requiring metadata retention and creating law enforcement access backdoors that security researchers warn could be exploited by hackers.
The online harms bill, meanwhile, would require social media companies to verify users' ages to prevent under-16s from holding accounts - creating a new data collection regime covering children's identity information with limited apparent privacy oversight, the very opposite of the privacy protections the new bill claims to enshrine.
What This Means for Businesses Using AI in Canada
For companies collecting and processing Canadian data - particularly those using generative AI tools that train on or analyze personal information - this bill signals where Canadian regulatory requirements are heading regardless of whether this particular iteration becomes law.
The three consistent themes across all three attempts at PIPEDA reform are: stronger consent requirements for data collection, explicit rights for individuals to access and delete their data, and stronger enforcement powers for the Privacy Commissioner. Whether the bill passes or fails again, those requirements are coming. Companies that build compliance infrastructure now will be ahead of companies that wait for the final text.
The surveillance pricing prohibition is also directly relevant to businesses using AI for business in retail pricing or personalization. Dynamic pricing powered by AI that adjusts based on individual customer data profiles is increasingly common - and is exactly the practice this bill targets. Retailers using algorithmic pricing should review their practices against this standard now.
Cut Through the Noise
What does Canada's 2026 privacy reform bill cover? The Liberal government's privacy reform bill introduced on June 16, 2026 is the third attempt to update Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) for the AI era. It is expected to include protections for children's data, measures preventing retailers from using Canadians' data for surveillance pricing, potential enshrinement of privacy as a fundamental right, and a right to deletion of personal information.
Why has Canada failed to pass privacy reform before? Canada's privacy reform efforts have failed twice before - in 2020 and 2023 - because neither bill became law before Parliament dissolved. PIPEDA was written before smartphones and generative AI, leaving Canada with privacy legislation that does not address AI data collection, algorithmic decision-making, or the specific risks of large language models trained on personal data.
What is Canada's surveillance pricing ban? The proposed surveillance pricing prohibition would prevent private retailers, including grocery chains, from using individual Canadians' personal data to set personalized prices. Surveillance pricing uses AI and data analytics to charge different prices to different customers based on their purchase history, location, and inferred willingness to pay. The ban would require retailers to set prices based on product characteristics rather than customer data profiles.
What is the Privacy Commissioner's enforcement gap in Canada? Canada's federal Privacy Commissioner currently lacks the power to issue monetary penalties against companies that violate PIPEDA. Unlike European regulators under GDPR or US state privacy enforcement agencies, the Commissioner can investigate and recommend, but cannot directly fine companies. Privacy reform advocates and the Commissioner himself have repeatedly called for penalty powers as a minimum requirement for effective enforcement.
