Canadian compliance
Canadian website compliance for WordPress
Privacy, accessibility and anti-spam obligations are site health issues. They're also the ones no offshore maintenance provider will ever check. Here's what applies to you, in plain English.
Not legal advice. This is a technical guide to obligations that affect how a WordPress site is built and operated. For your specific exposure, talk to a lawyer. We'll tell you when that's the right call.
Four things that apply to Canadian business websites
PIPEDA — federal privacy
Applies to commercial handling of personal information across most of Canada. Governs consent, purpose limitation, safeguards, retention and access. Includes mandatory breach reporting where there's a real risk of significant harm.
PIPEDA and your WordPress site →Québec Law 25 — the strict one
If you handle the personal information of people in Québec, this applies whether or not you're located there. Adds a designated privacy officer, privacy-by-default, confidentiality-incident obligations, transparency about automated decisions, and administrative monetary penalties that scale with worldwide turnover.
Law 25 for website owners →AODA / WCAG — Ontario accessibility
Ontario organizations meeting the size thresholds must make web content conform to WCAG Level AA, with limited exceptions. Most WordPress themes do not achieve this out of the box.
AODA and WCAG on WordPress →CASL — anti-spam
Governs commercial electronic messages. Affects your newsletter signup, your form consent language, your unsubscribe mechanism, and — critically — your records of consent.
CASL and your website forms →Where WordPress sites usually fail
In our diagnostics, the same six issues appear repeatedly:
01
A cookie banner that doesn't block anything.
Analytics and pixels fire before consent. The banner is decorative.
02
No retention policy on form submissions.
Every contact form entry from six years ago is still in the database, indefinitely.
03
Pre-ticked consent boxes
Or consent bundled with terms acceptance.
04
No consent records.
You can't demonstrate what you can't produce.
05
Accessibility failures in the theme
Contrast, focus states, form labels, heading order, keyboard traps.
06
No incident response process.
Breach obligations have clocks, and the clock starts before you've figured out who to call.
Every one of these is checked in a Health Report.
Book a Health Report