Conversion tracking in Canada: consent, CASL and server-side tagging

Key takeaways

Cookies and ad pixels fall under privacy law (PIPEDA federally, and Quebec’s private sector privacy act as amended by Law 25), not CASL. CASL governs commercial emails, texts and direct messages.
Outside Quebec, the federal privacy commissioner accepts opt-out consent for behavioural ads only if you meet clear conditions. For Quebec visitors, the law points to tracking that identifies, locates or profiles people being off until they turn it on.
Google Consent Mode doesn’t collect consent. It passes the choice your banner collected to Google tags, and can model some of the conversions you lose.
Enhanced conversions and server-side tagging improve accuracy. Neither replaces consent.

Your conversion numbers dropped after you added a cookie banner. Or you never added one, and a client in Montreal just asked whether your tracking complies with Law 25. Someone on a forum says CASL bans cookies. Someone else says server-side tagging makes consent unnecessary. You need to know what’s actually required and how to keep your data good enough to run Smart Bidding.

This guide sorts out which Canadian rules apply to tracking, what a reasonable consent setup looks like, how Google Consent Mode, enhanced conversions and server-side tagging fit in, and gives you an audit checklist to run on your own site. It’s a practical summary, not legal advice. For your specific situation, talk to a privacy lawyer.

Which law covers what

Three sets of rules come up in conversations about tracking. Only two apply to cookies and pixels.

Law	What it covers for marketers	Applies to cookies and pixels?
PIPEDA (federal)	Collection, use and disclosure of personal information in commercial activity across most of Canada	Yes
Quebec’s Act respecting the protection of personal information in the private sector (amended by Law 25)	Personal information collected, held, used or shared by enterprises carrying on business in Quebec	Yes
CASL (Canada’s Anti-Spam Legislation)	Commercial electronic messages, installing computer programs, and altering transmission data	Generally no. Cookies are treated as already consented to under CASL’s program-installation rules

British Columbia and Alberta also have their own private sector privacy laws that can apply to organizations there. The principles are broadly similar to PIPEDA, but check them if you operate in those provinces.

What PIPEDA expects for tracking and ads

The Office of the Privacy Commissioner of Canada (OPC) publishes guidelines on online behavioural advertising, meaning tracking people across sites and over time to show them ads based on their interests. The OPC’s position is that the information used for this will generally count as personal information.

The OPC says opt-out consent can be reasonable for behavioural advertising, but only if you meet all of these conditions:

You explain the purposes clearly. The OPC says they can’t be buried in a privacy policy.
You tell people about the purposes, and the parties involved, at or before the time you collect the data.
People can opt out easily, ideally at or before collection.
The opt-out takes effect immediately and stays in place.
You limit collection to non-sensitive information where practicable.
You destroy or effectively de-identify the information as soon as possible.

Some things push you to express (opt-in) consent or out of bounds entirely:

Sensitive information. The OPC lists health, financial information, ethnic origin, political opinions, religious beliefs, sexual orientation, genetic and biometric data. If your site is about any of these, tracking for ads needs express consent. A pharmacy, clinic, mortgage broker or dating site should assume this applies.
Tracking people can’t decline. The OPC says not to use techniques like device fingerprinting, “zombie” cookies or super cookies that people can’t practically refuse.
Children. The OPC recommends avoiding tracking children and tracking on sites aimed at children.

Decision rule: if your site doesn’t touch sensitive categories and doesn’t target children, a clear notice at first visit with an easy, working opt-out is the minimum PIPEDA bar for ad tracking. If it does touch sensitive categories, use opt-in.

What Quebec requires

Quebec’s private sector privacy act, as amended by Law 25, is stricter. Two sections matter most for tracking.

Section 8.1: identification, location and profiling

If you collect information using technology that can identify, locate or profile a person, you must first inform them that you use it and tell them how to activate those functions. The act defines profiling as collecting and using information to assess characteristics such as interests, health or work performance. Ad remarketing and interest-based targeting fit that description.

The word “activate” is why many Quebec privacy practitioners read section 8.1 to mean those functions should be off until the person turns them on. In practice, that means advertising and profiling cookies stay off by default for Quebec visitors until they opt in. Strictly necessary cookies, like a shopping cart or login session, generally aren’t affected because they don’t profile anyone.

Section 9.1 and section 14

Section 9.1 requires products and services with privacy settings to offer the highest level of confidentiality by default, but it expressly excludes browser cookie settings. Section 14 says consent must be clear, free and informed, given for specific purposes, and requested for each purpose in clear and simple language. Consent for sensitive personal information must be express.

French

If you serve Quebec visitors, your banner, consent choices and privacy notice need to be available in French. A consent request people can’t read isn’t informed consent.

Decision rule: if you have meaningful Quebec traffic, the simplest compliant setup is opt-in for all non-essential cookies for Quebec visitors. Some advertisers choose to apply opt-in across Canada rather than maintain two configurations.

What CASL does and doesn’t cover

CASL is often blamed for cookie banners. It isn’t the reason for them.

The CRTC’s guidance on installing computer programs lists cookies, HTML and JavaScript among the programs for which a person is considered to have already given express consent, based on their conduct. If someone has disabled cookies or JavaScript in their browser, that deemed consent doesn’t apply. So CASL doesn’t require a cookie banner. Privacy law is what drives it.

Where CASL matters for paid media is what happens after the conversion. The CRTC’s CASL FAQ explains that a commercial electronic message (CEM) is any message sent to an electronic address, like email, text or a direct message on social media, where one purpose is to encourage commercial activity. Every CEM needs three things:

Consent. Express consent doesn’t expire until withdrawn and must be provable. Pre-checked boxes and silence don’t count. Implied consent from an existing business relationship lasts two years after a purchase and six months after an inquiry.
Identification. Who sent it and how to reach them.
An unsubscribe mechanism. Requests must be processed within 10 business days, and the link must work for at least 60 days after sending.

The CRTC notes penalties of up to $1 million per violation for individuals and $10 million per violation for businesses. For paid media, this means a lead form that feeds your email nurture sequence needs an unchecked consent box with clear wording. A lead ad that collects an email address doesn’t by itself give you express consent to send marketing emails.

No Canadian law spells out a banner design. But a banner, or a consent management platform (CMP), is the practical way to meet the notice and choice requirements above. A reasonable setup:

Inventory your tags. List every cookie, pixel and tag on the site, who sets it, and why: necessary, analytics, advertising, personalization.
Group by purpose. Give people a choice per purpose, not one all-or-nothing switch.
Set defaults by region. Opt-in (off until accepted) for Quebec at minimum, and for any site handling sensitive information. Opt-out with clear notice may be defensible elsewhere under PIPEDA if you meet the OPC’s conditions.
Make refusing as easy as accepting. A “Reject” option at the same level as “Accept,” and a link in the footer to change choices later.
Write plainly, in both languages. Say what you collect, for what purpose, and which companies receive it.
Honour the choice everywhere. Tags must actually stop firing when consent is denied. Test this; it’s an easy thing to get wrong.

Google’s developer documentation is clear: Consent Mode is an API, not a banner. You still need to collect consent yourself, with your own banner or a CMP. Consent Mode then tells Google’s tags how to behave based on the person’s choice. Many CMPs send that signal for you.

The four consent signals

ad_storage: cookies or identifiers used for advertising.
ad_user_data: whether user data can be sent to Google for advertising.
ad_personalization: whether personalized advertising, like remarketing, can be used.
analytics_storage: cookies used for analytics.

Basic vs advanced

	Basic	Advanced
Before a choice	Google tags are blocked	Tags load with consent set to denied by default
If consent is denied	Nothing is sent to Google, not even the consent status	Tags send cookieless pings with no cookies written
Conversion modelling	Relies on a general model	Uses an advertiser-specific model, which Google describes as more detailed
Privacy posture	More conservative	Sends limited data even without consent

Google says modelling only kicks in once your tag meets a minimum data threshold, so smaller sites may not see modelled conversions at all.

Decision rule: if you want the most conservative approach, or your legal advice says no data should leave the browser before consent in Quebec, use basic. If you’re comfortable that cookieless pings fit your privacy notice and legal advice, advanced recovers more measurement. Document the choice either way.

Enhanced conversions

Enhanced conversions improve match rates by sending hashed first-party data, like the email address a customer typed into your checkout or lead form, along with the conversion. Google says the data is hashed with SHA256 before it’s sent, then matched against signed-in Google accounts.

Enhanced conversions for web improves measurement of sales and sign-ups that happen on your site.
Enhanced conversions for leads connects the hashed data from your lead form to offline conversions you later import, like a qualified lead or a closed sale from your CRM.

Hashing isn’t anonymization. You’re still disclosing personal information to Google so it can be matched. Your privacy notice should say so, it should only run where your consent setup allows it (the ad_user_data signal exists for exactly this), and Google’s customer data policies apply. For lead-gen advertisers, enhanced conversions for leads plus CRM imports is usually the biggest accuracy gain available. If your reported numbers already disagree with GA4, read why GA4 and Google Ads numbers don’t match before you change anything.

Server-side tagging: pros and cons

With server-side tagging in Google Tag Manager, the browser sends data to a tagging server you control, and that server forwards it to Google, Meta or other vendors. Google’s documentation describes the server running on Cloud Run or your own infrastructure, ideally mapped to a subdomain of your site.

Pros

Fewer scripts in the browser, which can help page speed.
More control over data. You can strip or reduce fields, like IP addresses or URL parameters, before anything reaches a vendor.
More durable first-party cookies when served from your own subdomain.
Encryption options. Google notes enhanced conversions data can be encrypted before sending when you use server-side Tag Manager.

Cons

Cost. Google’s documentation says the default setup is meant for testing, and a production setup needs upgraded servers. Its estimate at time of writing is roughly US$30 to $50 per server per month, with at least three servers recommended for redundancy, plus more for heavy traffic.
Skills. Someone needs to set up, monitor and maintain the server and container.
It doesn’t remove the need for consent. Moving collection to a server doesn’t change what privacy law requires. A server-side setup that ignores the consent signal is still non-compliant, and harder for anyone to audit.

Decision rule: consider server-side tagging when you have steady traffic, technical support and a clear reason, such as data minimization, site speed or many vendor tags. For a small lead-gen site, get consent, Consent Mode and enhanced conversions right first.

A worked example

The numbers here are illustrative. A Montreal home renovation company gets about 40% of its traffic from Quebec and the rest from eastern Ontario. It runs Google Ads with a lead form and sends every lead a monthly newsletter.

The audit finds three problems. The Google Ads and Meta tags fire on page load for everyone, before any choice. The banner is English-only with just an “OK” button. And the lead form has a pre-checked “Send me offers” box.

The fixes: a bilingual CMP with Accept, Reject and Settings options; opt-in defaults for all non-essential cookies across Canada to keep one setup; Consent Mode wired to the CMP; an unchecked newsletter box with clear wording; and enhanced conversions for leads with CRM imports of booked estimates. Reported conversions fall about 20% in the first month because fewer people accept cookies. After enhanced conversions and modelling kick in, the gap narrows, and the CRM import means Smart Bidding now optimizes toward booked estimates instead of raw form fills.

Common mistakes

A banner that doesn’t block anything. Tags fire before or regardless of the choice. Test for this first.
Treating CASL as the cookie law. It isn’t. Treating it that way usually means the email consent problems get missed.
Pre-checked boxes for email marketing consent.
English-only consent for Quebec visitors.
Assuming server-side tagging solves consent.
Turning on enhanced conversions without updating the privacy notice.
Panicking over the drop. A fall in reported conversions after adding consent usually reflects lost visibility, not lost sales. Check your CRM before cutting budgets.

Audit checklist

List every tag, pixel and cookie on your site, with its owner and purpose.
Load your site in a private window with developer tools open. Before you click anything on the banner, check whether ad or analytics requests are already firing.
Click Reject. Confirm advertising cookies aren’t set and tags behave as configured.
Click Accept. Confirm tags fire and conversions record in Google Ads and GA4.
Check that the banner and privacy notice are available in French and English.
Confirm Quebec visitors (and, if you choose, all visitors) get opt-in defaults for non-essential cookies.
Check whether your site touches sensitive categories like health or finance. If so, use opt-in everywhere.
In Google Tag Manager or your CMP, confirm all four Consent Mode signals are set, and note whether you’re using basic or advanced.
In Google Ads, check that enhanced conversions are set up and that your privacy notice mentions sharing hashed data with Google.
Review every lead form: unchecked email consent box, clear wording, and a record of when and how consent was given.
Test an unsubscribe and confirm it takes effect within 10 business days.
Write down your decisions and the date, and repeat this audit whenever you add a new tag or vendor.

Start this week with steps 2 and 3. They take ten minutes and tell you whether your current banner actually works.

Sources: Guidelines on privacy and online behavioural advertising, Office of the Privacy Commissioner of Canada · Act respecting the protection of personal information in the private sector (P-39.1), LégisQuébec · Canada’s Anti-Spam Legislation Requirements for Installing Computer Programs, CRTC · Frequently Asked Questions about Canada’s Anti-Spam Legislation, CRTC · Consent mode overview, Google for Developers · About enhanced conversions, Google Ads Help · Server-side tagging overview, Google for Developers

Platform details as of November 2026.