Canada's federal privacy regulator closed 39 well-founded complaints under PIPEDA in fiscal 2024-25, more than double the year before, according to the Office of the Privacy Commissioner of Canada's Annual Report to Parliament. Yet the OPC issued $0 in direct fines, because PIPEDA gives it no power to levy a monetary penalty on its own. That gap between findings and fines, not the complaint count, is the real enforcement story going into 2026.
How many PIPEDA complaints did the OPC receive in 2026?
The OPC received 1,458 complaints under PIPEDA in fiscal 2024-25, a 32% increase over the prior year. Of those, 446 were formally accepted for investigation, the same number accepted in fiscal 2023-24. The gap between the two figures reflects the OPC's intake process: many complaints received are resolved as inquiries or redirected before they are formally accepted as complaints.
Thirty-nine of the 446 accepted complaints were closed as well-founded, meaning the OPC's investigation confirmed the organization had contravened PIPEDA. That is more than double the 16 well-founded findings the OPC issued in fiscal 2023-24, and it sits above the 19 recorded two years earlier. A rising well-founded rate on a flat acceptance count points to more serious cases making it through the intake process, not simply more complaints overall. This post covers PIPEDA enforcement broadly; for the incident-specific numbers behind those complaints, see our deep dive on PIPEDA breach reporting figures.
Why has the OPC issued $0 in fines under PIPEDA?
PIPEDA simply does not give the Office of the Privacy Commissioner of Canada the power to fine anyone. When an investigation ends in a well-founded finding, the OPC can publish the finding, recommend corrective steps, and negotiate a compliance agreement with the organization. What it cannot do is impose a monetary penalty the way a data protection authority in the European Union or a state privacy regulator in the United States can. If an organization refuses to comply, the only escalation path is for the Commissioner, or the complainant, to apply to the Federal Court for a binding order.
Figure 1: PIPEDA has no administrative monetary penalty step. Even a well-founded finding ends in a compliance agreement or a court application, not a fine. Source: PIPEDA sections 14 to 17, OPC guidance on the PIPEDA complaints and enforcement process.
That structural gap is not theoretical. On 3 March 2025, the OPC filed an application in Federal Court seeking an order requiring Aylo, one of the world's largest operators of pornographic websites including Pornhub, to comply with PIPEDA after an investigation found the company's consent practices for uploaded content fell short of the law's requirements. Court applications like this one are rare: the OPC's own public case records list only a handful of PIPEDA matters that reached the Federal Court since the law took effect in 2001, a pattern consistent with a regulator that has no faster or cheaper enforcement tool available to it.
How many PIPEDA investigations become well-founded findings?
Well-founded findings jumped from 16 in fiscal 2023-24 to 39 in fiscal 2024-25, even as the number of complaints accepted stayed flat at 446. Two years earlier, in fiscal 2022-23, the OPC closed 19 complaints as well-founded out of 454 accepted.
Figure 2: Well-founded PIPEDA findings by fiscal year. Source: Office of the Privacy Commissioner of Canada, Annual Reports to Parliament, 2022-23 through 2024-25.
| Fiscal year | Complaints accepted | Well-founded findings | Direct fines issued |
|---|---|---|---|
| 2022-23 | 454 | 19 | $0 |
| 2023-24 | 446 | 16 | $0 |
| 2024-25 | 446 | 39 | $0 |
Source: Office of the Privacy Commissioner of Canada, Annual Reports to Parliament, 2022-23 through 2024-25.
The OPC also entered fiscal 2024-25 with 66 investigations older than 12 months, 21% of its active caseload, and closed the year with that backlog down to 41 investigations, or 14% of active cases. A shrinking backlog alongside a rising well-founded count suggests the regulator cleared older, more substantive files rather than simply working faster through easy ones.
How are most PIPEDA complaints resolved?
Most PIPEDA complaints never reach a full investigation. The OPC closed 331 of its 446 accepted complaints in fiscal 2024-25 through early resolution, a faster process that typically ends with the organization voluntarily addressing the concern, and 107 through a standard investigation. Combined with summary investigations, the OPC reports that 89% of accepted complaints in fiscal 2024-25 were addressed without a full standard investigation.
Figure 3: How the OPC closed the 446 PIPEDA complaints it accepted in fiscal 2024-25. Source: Office of the Privacy Commissioner of Canada, Annual Report to Parliament 2024-25.
Early resolution has grown as a share of closures for several years running, up from 73% of closures in fiscal 2022-23 to 90% in fiscal 2023-24 and roughly the same level in 2024-25. For most organizations under PIPEDA, that means the more realistic enforcement risk is a fast-moving informal resolution process rather than a drawn-out formal investigation, which makes having accurate privacy documentation in place before a complaint arrives the more practical safeguard.
Is Canada about to get real privacy fines? What Bill C-36 would change
PIPEDA has gone through 25 years and three failed or pending reform attempts without gaining a fining power. Bill C-11, introduced in 2020, died without passing. Bill C-27, introduced in 2022 with the proposed Consumer Privacy Protection Act, died on the Order Paper when Parliament was prorogued on 6 January 2025. On 15 June 2026, the government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, its third attempt at modernizing the law.
Figure 4: Three attempts at federal privacy reform in six years. Source: Parliament of Canada bill records, Office of the Privacy Commissioner of Canada statement on Bill C-36, June 2026.
Bill C-36 would replace the OPC's private-sector oversight role with a new Digital Safety and Data Protection Commission of Canada, giving that body direct order-making power and administrative monetary penalties of up to the greater of 10 million dollars or 3% of global revenue for most violations, rising to the greater of 25 million dollars or 5% of global revenue for the most serious offenses. The Privacy Commissioner publicly welcomed the enforcement provisions, describing stronger enforcement powers as central to the reform. Bill C-36 was still moving through Parliament as of this post's publication and had not yet passed into law.
How is AI changing PIPEDA compliance work?
Businesses are increasingly asking the OPC for guidance on AI before they build it into a product. The share of advisory files in which a business sought the OPC's input on AI adoption rose from 40% in fiscal 2023-24 to 59% in fiscal 2024-25, according to the regulator's own reporting.
Figure 5: Share of OPC advisory files in which businesses sought guidance on AI adoption, by fiscal year. Source: Office of the Privacy Commissioner of Canada, Annual Report to Parliament 2024-25.
That trend lines up with a broader pattern: organizations are trying to get ahead of a privacy problem before it turns into a complaint, rather than waiting for an investigation to tell them their consent language was inadequate. A business collecting personal information to train or run an AI feature still needs the same PIPEDA-required disclosures as any other data collection: what is collected, why, and how it is safeguarded. You can generate a PIPEDA-ready privacy policy that covers those disclosures without waiting for the OPC to flag a gap first.
How does PIPEDA's enforcement gap compare to other privacy laws?
PIPEDA is unusual among major privacy laws in leaving its regulator with no direct penalty power at all. The table below compares PIPEDA today, the pending Bill C-36 replacement, and two laws with active fining regimes.
| Law | Regulator | Fine or order power | Maximum penalty |
|---|---|---|---|
| PIPEDA (Canada, current) | Office of the Privacy Commissioner of Canada | No direct fine or order power; Federal Court application only | $0, no monetary penalty mechanism exists |
| Bill C-36 / PPCDA (proposed) | Digital Safety and Data Protection Commission | Direct order-making and administrative monetary penalties | Greater of $25 million or 5% of global revenue |
| GDPR (European Union) | National data protection authorities | Direct order-making and administrative fines | Greater of EUR 20 million or 4% of global annual turnover |
| CCPA/CPRA (California) | California Privacy Protection Agency | Direct order-making and administrative fines | Up to $7,988 per intentional violation, adjusted for inflation |
Source: PIPEDA text and OPC enforcement guidance; Bill C-36 first reading text and OPC statement, June 2026; GDPR Article 83; California Civil Code section 1798.155 as amended.
For a full country-by-country rundown of who can fine whom under which privacy law, see our global privacy law tracker.
The Bottom Line
Thirty-nine well-founded PIPEDA findings and $0 in fines in fiscal 2024-25 is not a contradiction. It is exactly how the law was written. The OPC can investigate, publish findings, and negotiate compliance, but it cannot fine anyone, and its only path to a binding order runs through the Federal Court, a step taken only a handful of times in PIPEDA's 25-year history. Bill C-36 would close that gap by handing enforcement to a new commission with real penalty power, but until it passes, the practical enforcement risk under PIPEDA remains an early-resolution request or a published finding rather than a monetary penalty. That makes accurate, current privacy disclosures the most direct way to stay out of the 446 accepted complaints in the first place, since 89% of those cases never reach a formal investigation and most trace back to a documentation or consent gap the organization could have closed beforehand.
Frequently Asked Questions
How many PIPEDA complaints did the OPC accept in 2024-25? The Office of the Privacy Commissioner of Canada accepted 446 complaints under PIPEDA in fiscal 2024-25, the same number it accepted the year before, and closed 39 of them as well-founded, more than double the 16 well-founded findings issued in fiscal 2023-24.
Has the OPC ever fined a company under PIPEDA? No. PIPEDA gives the Office of the Privacy Commissioner of Canada no power to issue administrative monetary penalties or binding orders on its own. The OPC can investigate and publish findings, and if a company will not comply it can apply to the Federal Court for an order, a step it has taken only a handful of times in PIPEDA's 25-year history, most recently against Aylo, the operator of Pornhub, in March 2025.
What is Bill C-36 and would it change PIPEDA enforcement? Bill C-36, the proposed Protecting Privacy and Consumer Data Act introduced on 15 June 2026, would replace the OPC's private-sector role with a new Digital Safety and Data Protection Commission holding direct order-making power and the ability to levy penalties up to the greater of 10 million dollars or 3% of global revenue, rising to 25 million dollars or 5% for the most serious offenses.
Which sector receives the most PIPEDA complaints? Financial services, which accounted for 25% of all complaints accepted under PIPEDA in fiscal 2023-24, according to the OPC, more than any other industry the regulator tracks.
Where the Numbers Come From
- Office of the Privacy Commissioner of Canada. (2025). "Annual Report to Parliament 2024-2025: Prioritizing privacy in a data-driven world." 1,458 complaints received, 446 accepted, 39 well-founded findings, complaint closure breakdown, and the AI advisory share for fiscal 2024-25.
- Office of the Privacy Commissioner of Canada. (2024). "Annual Report to Parliament 2023-2024." 446 complaints accepted, 16 well-founded findings, and the prior-year closure and AI advisory figures used for comparison.
- Office of the Privacy Commissioner of Canada. (2023). "Annual Report to Parliament 2022-2023." 454 complaints accepted, 19 well-founded findings, the earliest year in this post's three-year comparison.
- Office of the Privacy Commissioner of Canada. (2025). "News release: Privacy Commissioner seeks Federal Court order requiring Pornhub operator to comply with Canadian privacy law." Federal Court application filed 3 March 2025, Court File No. T-702-25.
- Parliament of Canada. (2026). "Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act." First reading, 15 June 2026, including proposed administrative monetary penalty amounts.
- Office of the Privacy Commissioner of Canada. (2026). "Statement by the Privacy Commissioner of Canada on Bill C-36, the Protecting Privacy and Consumer Data Act." Commissioner's response to the proposed enforcement reforms, 15 June 2026.
Note: All figures verified as of September 2026. Bill C-36 was still before Parliament as of this post's publication and its provisions, including the proposed penalty amounts, may change before it passes or could die on the Order Paper as its two predecessors did. PIPEDA enforcement figures are refreshed at least twice a year to track new OPC Annual Reports to Parliament and material legislative developments.
