Guides
Data-broker opt-outs in Canada, PIPEDA limits and provincial lists compared
Data-broker opt-outs Canada: compare PIPEDA with provincial rules, find people-search sites listing Canadians, and run removals that stick for good.
What to take away
- Data-broker opt-outs Canada means asking each company directly, because PIPEDA gives you access and correction rights, not a delete button.
- Quebec's Law 25 and BC, Alberta and Ontario rules add consent and complaint routes that fill some of PIPEDA's gaps.
- People-search sites such as Whitepages, Spokeo, BeenVerified, Radaris, MyLife and Canada411 list Canadians, and each has its own removal form.
- U.S. state privacy laws like the CCPA do not apply to Canadian residents, so ignore ZIP-code opt-out templates.
- Opt-outs need identity proof, a confirmation reference and a suppression request to stop the profile returning.
- The Office of the Privacy Commissioner of Canada (OPC) and the Canadian Anti-Fraud Centre (CAFC) are the main complaint and fraud routes.
How data brokers and people-search sites collect Canadian records
Canadian records start in public registries. Provincial land titles, corporate registries, court lists and voter files are open by design. Brokers copy them, then merge phone directories, loyalty programmes and marketing lists.
People-search sites add social media, delivery databases and breach dumps. The result is a profile with your name, age, address history and relatives. Some brokers sell it; others show it free and charge for removal.
Credit bureaus are a separate category. Equifax Canada and TransUnion Canada hold credit files under provincial and federal rules, not under people-search terms. Our data services compared piece explains the split.
Ad-tech platforms collect browsing and location data through cookies and SDKs. That data rarely appears on a people-search page, but it feeds the same marketing lists. The OPC has published positions on technology and data-driven profiling that touch these practices, covering tracking, profiling and automated decisions.
What PIPEDA does and does not give you: access, correction and opt-out limits
PIPEDA is Canada's federal private-sector privacy law. It covers how businesses handle personal information in commercial activity. It applies to data brokers that operate commercially in Canada, even if the company is foreign and handles Canadians' data.
PIPEDA gives you the right to access personal information a business holds about you. You can ask what it has, how it uses it and who it shared it with. The OPC's guidance on accessing personal information is the starting point for that request.
PIPEDA also gives you a correction right. If the information is wrong, you can ask the business to correct it. If the business refuses, it must note your disagreement on the file.
What PIPEDA does not give you is a general delete right. There is no federal erasure button for accurate data. Consent is the main lever: if a broker collected your data without meaningful consent, you can withdraw it and ask the business to stop using it.
That limit matters. A broker can keep accurate public-record data and keep showing it. Your practical goal is suppression: stop the display and stop the sale, even if the record stays in a backend file.
Complaints go to the OPC. The OPC can investigate and publish findings, but it does not fine first offenders the way some regulators do. For identity misuse, the CAFC and the Canadian Centre for Cyber Security are the reporting routes.
Provincial rules compared: Quebec, BC, Alberta and Ontario
Provincial laws matter because they can cover employers, unions and some businesses that PIPEDA does not. They also set different consent standards and different complaint bodies.
Provincial privacy rules compared
Quebec
- Main statute
- Law 25
- Regulator
- CAI
- Opt-out addition
- Deletion, portability
British Columbia
- Main statute
- PIPA BC
- Regulator
- OIPC BC
- Opt-out addition
- Consent rules
Alberta
- Main statute
- PIPA Alberta
- Regulator
- OPC Alberta
- Opt-out addition
- Consent, complaints
Provincial rules compared
Main statute
- Quebec
- Law 25 amending the private-sector Act
- British Columbia
- PIPA BC
- Alberta
- PIPA Alberta
- Ontario
- PIPEDA for private sector; FIPPA and MFIPPA for government
- Nova Scotia, Manitoba, Saskatchewan, Newfoundland and Labrador
- Substantially similar private-sector laws
Regulator
- Quebec
- Commission d'acces a l'information (CAI)
- British Columbia
- Office of the Information and Privacy Commissioner for BC
- Alberta
- Office of the Privacy Commissioner of Alberta
- Ontario
- Office of the Information and Privacy Commissioner of Ontario
- Nova Scotia, Manitoba, Saskatchewan, Newfoundland and Labrador
- Provincial commissioners
What it adds for opt-outs
- Quebec
- Consent, transparency, deletion and portability rights for Quebec residents
- British Columbia
- Consent for collection, use and disclosure by provincial private-sector organizations
- Alberta
- Consent rules and a complaint route for provincially regulated businesses
- Ontario
- Government-held records and municipal privacy complaints
- Nova Scotia, Manitoba, Saskatchewan, Newfoundland and Labrador
- Consent and access rules for provincially regulated organizations
The OPC's overview of privacy laws in Canada explains how federal and provincial statutes overlap. In practice, a Quebec resident has the strongest deletion-style rights under Law 25. A BC or Alberta resident can complain to a provincial commissioner about a provincially regulated business.
Ontario is different. Private-sector businesses fall under PIPEDA, so the Ontario IPC mostly handles government and health records. That means an Ontario resident chasing a data broker usually deals with the OPC, not the IPC.
Quebec's CAI can take complaints under Law 25. If you live in Quebec and a broker refuses deletion, that route is worth using before you escalate.
The people-search sites that actually list Canadians
Many U.S. people-search sites do list Canadians, because they buy from brokers that cover North America. Others are Canada-specific. The removal process differs by site, so treat each one separately.
People-search sites listing Canadians
Site
- Whitepages
- Name, address, phone
- Spokeo
- Public and marketing data
- BeenVerified
- Background-style summaries
- Radaris
- Address and relatives
- Canada411
- Phone and address
Canadian content
- Whitepages
- Opt-out form, phone verify
- Spokeo
- Web opt-out, email confirm
- BeenVerified
- Opt-out search, email verify
- Radaris
- Opt-out form, email confirm
- Canada411
- Correction or removal request
Removal route
- Whitepages
- Spokeo
- BeenVerified
- Radaris
- Canada411
People-search sites that list Canadians
| Site | Typical Canadian content | Removal route |
|---|---|---|
| Whitepages | Name, address history, phone, relatives | Opt-out form with phone verification |
| Spokeo | Profiles built from public and marketing data | Web opt-out with email confirmation |
| BeenVerified | Background-style summaries | Opt-out search and email verification |
| Radaris | Address and relative listings | Opt-out form and email confirmation |
| MyLife | Profiles with reputation scores | Opt-out request by email or form |
| Canada411 | Phone and address directory | Directory correction or removal request |
| YellowPages.ca | Business and some residential listings | Listing correction request |
Some sites hide removal behind a paid subscription. Paying is not required under PIPEDA, but a paid removal can be faster. Decide per site whether the fee is worth it.
Aggregators are the harder problem. A single removal from one site often leaves copies on others. Our data broker privacy guide covers how profiles spread between brokers.
Why U.S. state privacy laws such as the CCPA do not reach Canadian residents
The CCPA and similar state laws protect consumers who reside in those states. A Canadian resident living in Canada is outside their scope, even if the broker is a California company.
Some brokers offer CCPA-style opt-outs to everyone as a policy choice. That is voluntary, and it can change without notice. Do not build your plan around it.
Ignore templates that ask for a ZIP code, an IRS form or a state attorney general complaint. Those routes do not apply here. Canadian complaints go to the OPC or a provincial commissioner.
The same logic applies to the GDPR. It can cover some processing of Canadian data, but enforcement is slow and aimed at large platforms, not small people-search sites. Your practical lever remains a direct request plus a Canadian complaint.
Running an opt-out: identity proof, confirmation and suppression
Opt-outs fail when the broker cannot match your request to a profile. Follow a repeatable process and keep records. Our data broker opt-out workflow sets out the filing method, and the steps below are the short version.
Six-step data-broker opt-out
- Find every listing first
- Send removal request
- Prove identity without oversharing
- Ask for confirmation
- Add suppression request
- Set 30-60 day review
Keep a simple log: site, date sent, method, reference number, outcome. If a broker refuses, ask for its written reasons and its privacy officer's name. That record supports a complaint to the OPC.
Identity proof is where most requests stall. The OPC's identity topics explain the risks of oversharing and how identity theft and fraud prevention work. Use the least data the site will accept.
If the profile exposes your address, treat it as a safety issue. Our people-search address removal case walks through a removal from several sites at once.
Monitoring for reappearing profiles and duplicates
Profiles come back. Brokers refresh from public records and marketing feeds, and a removal can be undone by the next data load. Expect at least one reappearance.
Duplicates are common. The same person appears under a maiden name, a middle initial or an old city. Search those variants too, not just your current name.
Family exposure matters. Removing your own listing can still leave a relative's page that names you. Request removal of the linked entry as well.
Use a quarterly routine:
Quarterly reappearance monitoring routine
- Search name plus each old city
- Search each phone and email
- Check relatives' listings mentioning you
- Re-file any returned profile
- Update log with dates and references
- Escalate refusals to OPC or commissioner
Our data broker opt-out problems piece covers aliases and family exposure in more depth. The data broker opt-out checklist is the printable version of this routine.
For fraud, report to the CAFC and the Cyber Centre. For telecom marketing calls, the CRTC's Do Not Call List is separate from data-broker opt-outs, but it reduces one collection channel.
