Is Foot Traffic Data PIPEDA Compliant? A Plain Guide

Sooner or later, someone on your legal or privacy team will ask whether the foot traffic data you want to buy is allowed. This guide gives you the background to answer well. It covers what Canada's federal privacy law requires, how consent works for location data, the difference between personal, de-identified and aggregated information, and what to ask a data provider.

This guide is general information, not legal advice. Talk to your own counsel about your situation. Privacy law depends on the facts of each case.

The short answer

PIPEDA does not set up a certification or approval program for datasets ³. Whether a use of location data complies depends on how the data was collected, what it contains, what it is used for and how it is protected. So the useful question is not "is it compliant?" but "how was it collected, and what reaches us?" The rest of this guide explains what to look for.

What PIPEDA requires

The Personal Information Protection and Electronic Documents Act (PIPEDA) covers private-sector organizations that collect, use or disclose personal information in the course of commercial activity ¹. It is built on ten fair information principles, including accountability, identifying purposes, consent, limiting collection, limiting use and retention, safeguards and openness ².

Two parts of the Act matter most for location data:

• Appropriate purpose. An organization may collect, use or disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances (subsection 5(3)) ³.
• Valid consent. Consent counts only if it is reasonable to expect the people involved would understand the nature, purpose and consequences of what they are agreeing to (section 6.1) ³.

PIPEDA also says organizations should generally seek express consent when information is likely to be sensitive (Schedule 1, clause 4.3.6) ³.

How consent works for location data

The Office of the Privacy Commissioner of Canada (OPC) has published guidelines on meaningful consent, jointly with the Alberta and British Columbia commissioners ⁴. They ask organizations to make clear, up front:

• what personal information is collected;
• who it is shared with;
• what it is used for; and
• any meaningful risk of harm.

The guidelines say express consent is generally required when information is sensitive, when a use falls outside what people would reasonably expect, or when it creates a meaningful residual risk of significant harm. In discussing reasonable expectations, the guidelines give the tracking of location as an example where express consent would likely be required ⁴.

In practice, that is why credible location data comes from apps where people have actively opted in to location sharing, through the permission prompts on their phones.

A cautionary example: the Tim Hortons app

On June 1, 2022, the OPC and its counterparts in Quebec, British Columbia and Alberta released findings from a joint investigation into the Tim Hortons app ⁵⁶. Their findings set out what regulators expect when location data is involved.

• What happened. From May 2019 until June 2020, the app used a third-party software kit that collected precise GPS location, including when the app was closed. Users had been led to believe location was used only while the app was open ⁵.
• Purpose. The data was collected for targeted advertising but was never used for it. The regulators found the collection was not for an appropriate purpose, because the privacy cost was out of proportion to any benefit ⁵.
• Consent. The regulators found consent was not valid, because users were not told about background collection. They also stated that consent cannot make an inappropriate purpose acceptable ⁵.
• Sensitivity. The report says large volumes of granular location data can be highly sensitive, since visits to places such as a medical clinic can reveal health, religious or other personal details ⁵.
• Contracts. The contract with the location provider was found too vague to properly limit how the provider could use the data, including in "de-identified" form ⁵⁶.

Tim Hortons agreed to delete the data and set up a privacy management program ⁵. The lesson for buyers: tell people clearly what is collected and when, collect only what you need, and control what your suppliers can do with it.

Personal, de-identified and aggregated information

These three terms get used loosely. Your privacy team will want them used carefully.

Personal information

Under PIPEDA, personal information is information about an identifiable individual. The OPC applies a "serious possibility" test: information is about an identifiable person if there is a serious possibility they could be identified from it, alone or combined with other information ⁷. The OPC has treated GPS tracking data from company vehicles as personal information because it could be linked to specific drivers, and has said an IP address can be personal information when it can be tied to a person ⁷.

De-identified information

De-identified data has had direct identifiers, such as names, removed. The OPC says this does not make it anonymous if there is still a serious possibility of linking it back to someone ⁷. In the Tim Hortons findings, the regulators noted that location histories can reveal a person's home and workplace, so de-identified data derived from them could still be personal information ⁵.

Aggregated information

Aggregated data describes groups, not individuals: for example, the share of a venue's visitors who live within 15 km. Well-built aggregation is designed so no single person can be picked out. PIPEDA itself does not use or define the terms "aggregated" or "anonymized" ³. The OPC's "serious possibility" test is how it decides whether information is about an identifiable person ⁷. Ask how a provider prevents small groups from being singled out.

What Measured Reporting says about its own approach

Our Data and Privacy page sets out how our data works. In summary, location signals come from mobile apps where people have opted in to location sharing, sourced through our Canadian data partner. We report on groups and areas, and every insight describes patterns across many devices, never one person. There are no names, phone numbers, emails or account details, and nothing is matched to customer or player accounts. Each device's home area is estimated at the six-digit postal code level, never a street address, and we report shares and indices, not headcounts. Our data and methods are built to meet Canada's federal privacy law, PIPEDA, and the provincial privacy rules that apply where we work.

That describes our approach. Whether a particular use is right for your organization is still a question for your own privacy advisers. Our website privacy policy separately covers information you share with us through this site.

Questions to ask a foot traffic data provider

1. Where do the location signals come from, and how did people opt in?
2. Were users told their location could be collected in the background, if it was?
3. What reaches us: device-level records, or aggregated results?
4. Does the data include names, contact details, account numbers or street addresses?
5. How do you stop a small group, or a single home, from being identified in results?
6. Is anything matched to our customer records, or to anyone else's?
7. What can your own suppliers do with the data under their contracts?
8. Do you exclude sensitive places, or sensitive inferences about individuals?
9. Is our data or our audience ever resold or shared with other clients?
10. How do you handle Quebec's rules if our project includes Quebec?

Provincial differences, in brief

Alberta, British Columbia and Quebec have their own private-sector privacy laws, recognized as substantially similar to PIPEDA. Organizations covered by them are generally exempt from PIPEDA for activity within that province, though PIPEDA still applies to information that crosses provincial or national borders ¹.

Quebec has gone further through amendments widely known as Law 25. Its private-sector act now:

• requires anyone collecting personal information from a person with technology that has functions to identify, locate or profile them to first inform them of the use of that technology and of the means available to activate those functions (section 8.1) ⁸;
• requires privacy settings on technology products to be at the highest level of confidentiality by default, with an exception for browser cookies (section 9.1) ⁸;
• requires consent to be clear, free, informed and given for specific purposes, and express consent for sensitive information in some cases (sections 12 to 14) ⁸;
• treats personal information as de-identified when it no longer allows the person to be directly identified, and requires anyone using it to take reasonable measures to limit the risk of re-identification (section 12) ⁸; and
• treats information as anonymized only if it is reasonably foreseeable that it irreversibly no longer allows the person to be identified, directly or indirectly (section 23) ⁸.

A Quebec regulation made in 2024 sets out how anonymization must be done. It requires supervision by a person qualified in the field and a re-identification risk analysis showing that residual risks are very low ⁹.

Is federal privacy law changing?

Not so far. Bill C-27 would have replaced PIPEDA's privacy rules with a Consumer Privacy Protection Act. LEGISinfo shows it was still at committee stage in the House of Commons when the parliamentary session ended on January 6, 2025. It did not pass ¹⁰. A new bill, C-36, would enact a Protecting Privacy and Consumer Data Act. It was introduced and given first reading in the House of Commons on June 15, 2026. As of November 12, 2026, LEGISinfo lists it at second reading in the House of Commons, and it has not become law ¹¹. Until a new law passes and takes effect, PIPEDA still applies.

FAQ

Is foot traffic data personal information?

It depends on what it contains. Device-level location histories can be personal information, even without names, because they can reveal where someone lives and works. Properly aggregated results that describe groups are designed not to be.

Do people have to consent to location tracking?

Under the OPC's guidance, location tracking is an example of a practice that generally calls for express consent. Phone permission prompts are one way apps ask for it.

Does "anonymized" mean the same thing everywhere in Canada?

No. PIPEDA does not use or define the term, and the OPC uses the "serious possibility" test. Quebec defines anonymized information in law and sets specific rules for producing it.

Did Bill C-27 replace PIPEDA?

No. It did not pass before the parliamentary session ended in January 2025. A new bill, C-36, was introduced in June 2026 and had not passed as of November 12, 2026.

Can a vendor guarantee its data is PIPEDA compliant?

A vendor can explain how its data is collected, what it contains and how it is protected. Whether your intended use complies is a judgment for your own legal or privacy advisers.

Bring your privacy team

We are happy to walk your privacy, legal or data team through our method. Start with a complimentary Sample Insight on one of your locations, and see exactly what reaches you.