Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic
A Critical Look at Bill C-27's Consumer Privacy Protection Act
CIPPIC has published A Critical Look at Bill C-27's Consumer Privacy Protection Act, written by Michelle Hennessey and Shaarini Ravitharan. The publication examines Part 1 of Bill C-27, the Digital Charter Implementation Act, 2022. Introduced in June 2022, Bill C-27 would have repealed and replaced Canada's twenty-year-old private-sector privacy framework under PIPEDA. It died on the order paper when Parliament was prorogued in January 2025, without the Consumer Privacy Protection Act ever coming into force.
CIPPIC argues that while the CPPA was a welcome and necessary modernization, it does not deliver the protection Canadians need and deserve. Six shortcomings stand out: the CPPA failed to recognize privacy as a fundamental human right; it scoped anonymized data and federal political parties outside the Act; it restructured consent and its exceptions in ways that favoured commercial interests over individual rights; it left children inadequately protected; and it overlooked the growing prevalence of dark patterns and the data brokerage economy.
In response, CIPPIC advances six recommendations, each accompanied by proposed statutory language: a definition of "sensitive information," a data protection impact assessment framework, "best interest of the child" language and high-by-default privacy settings for minors, a definition of "dark patterns" alongside a rule voiding consent obtained through them, and a registration and national opt-out regime for data brokers. Each draws on leading international standards, including the EU's GDPR, the UK's Data Protection Act 2018 and Age-Appropriate Design Code, and California's Age-Appropriate Design Code Act.
The gaps identified here did not disappear with the bill, and the central argument holds regardless of which legislative vehicle carries reform forward: meaningful privacy protection and innovation are interdependent, not opposed. Meaningful privacy protection sustains the public trust on which a viable digital economy depends.