--- title: "PIPEDA: What It Means for Cold Email" description: "Does PIPEDA allow B2B cold email in Canada? The business contact exemption, consent and harvesting rules, how CASL fits in, fines and OPC findings." path: /cold-email-laws/pipeda family: laws updated: 2026-10-17 html: /cold-email-laws/pipeda sources: - "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html" - "https://laws-lois.justice.gc.ca/eng/regulations/SOR-2001-7/FullText.html" - "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/canadas-anti-spam-legislation/casl-compliance-help-for-businesses/casl_guide/" - "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-interpretation-bulletins/interpretations_06_pai/" - "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2016/pipeda-2016-003/" - "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-002/" - "https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html" - "/anti-spam" - "/terms" - "/features" facts: law: "Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5)" jurisdiction: "Canada" in_force: "2001 (Part 1 from January 1, 2001)" regulator: "Office of the Privacy Commissioner of Canada (OPC)" b2b_cold_email: "Exempt if role-relevant; CASL still governs the email" max_penalty: "CAD 100,000 fine (not for consent breaches)" --- # PIPEDA: What It Means for Cold Email Yes for role-relevant email. PIPEDA does not apply to a work email used solely to contact someone about their job. Off-topic pitches and harvested lists bring its consent rules back, and CASL still governs the email. Its fines, up to CAD 100,000, do not cover consent failures. ## Not Legal Advice > Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer. ## Can You Send B2B Cold Email Under PIPEDA? **In short:** Usually, for the data side: PIPEDA does not apply to a work email used solely to contact the person about their job (section 4.01), but CASL still decides whether you may send the email. PIPEDA is Canada's federal private-sector privacy law. It is consent-based: collecting, using or disclosing personal information needs the person's knowledge and consent (Schedule 1, clause 4.3), and a work email address is personal information. CASL, not PIPEDA, decides whether you may send the email itself. Section 4.01 takes business contact information out of Part 1 when you collect, use or disclose it solely to communicate with the person about their employment, business or profession. A role-relevant B2B email fits. An off-topic pitch does not: the Privacy Commissioner applied PIPEDA to Compu-Finder because many of its emails were not relevant to the recipients' work (Report of Findings 2016-003). Two more rules matter for list building. Addresses the person published themselves can be used without consent for the purpose they were published for (section 7 and SOR/2001-7). Addresses collected with harvesting software lose those exceptions (section 7.1(2)), and the OPC says you must make sure of consent even for addresses bought from a supplier. ## What Do You Need to Do Under PIPEDA? **In short:** 7 rules apply to a cold email program under PIPEDA. **PIPEDA requirements for cold email, checked October 17, 2026** | Requirement | What it means | How to do it | Section | | --- | --- | --- | --- | | Stay inside the business contact exemption | The exemption applies only when you use the contact information solely to communicate about the person's employment, business or profession. | Keep each contact's title or role, and send only pitches relevant to it. | PIPEDA s 2(1) and 4.01 | | Consent and reasonable expectations | Outside the exceptions you need consent, and the person's reasonable expectations count. The OPC found that emailing people who had no dealings with a company was outside their expectations. | Do not rely on the exemption for pitches unrelated to the person's job. | PIPEDA Schedule 1 clauses 4.3 and 4.3.5 | | No address harvesting | Addresses collected with harvesting or address-generation software lose the consent exceptions. | Do not use scraping or address-generation tools to build lists. | PIPEDA s 7.1(2) | | Publicly available data only as specified | Directory data may be used only for the purpose it was listed for, and publications only where the person supplied the information. | Use addresses the person published themselves, and match the pitch to why they are listed. | PIPEDA s 7(1)(d) and 7(2)(c.1); SOR/2001-7 s 1 | | Bought lists | The OPC says businesses must make sure of informed consent even when a third-party supplier provided the addresses. | Get a written warranty from each list vendor about where the addresses came from and how consent was obtained. | OPC e-marketing guidance | | Withdrawal of consent | A person may withdraw consent at any time. | Honor every opt-out across all lists and tools. | PIPEDA Schedule 1 clause 4.3.8 | | Purposes and openness | State your purposes at or before collection, and make your privacy policies available. | Publish a privacy notice that covers prospect data. | PIPEDA Schedule 1 clauses 4.2 and 4.8 | ## What Are the Penalties Under PIPEDA? **In short:** Maximum penalty: CAD 100,000 fine (not for consent breaches). **PIPEDA maximum penalties, checked October 17, 2026** | Penalty | Maximum | In USD | Section | | --- | --- | --- | --- | | Fine for knowingly breaking breach-reporting, record-keeping or whistleblower rules (indictable offence) | CAD 100,000 | about USD 70,600 | [PIPEDA s 28(b)](https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html) | | Same offences, on summary conviction | CAD 10,000 | about USD 7,060 | [PIPEDA s 28(a)](https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html) | | Damages for consent or marketing breaches | Set by the Federal Court after an OPC complaint, including damages for humiliation; no fixed maximum | Not a fixed amount | [PIPEDA ss 14 and 16](https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html) | USD amounts are approximate, converted at the European Central Bank reference rates of 2026-10-16. The Office of the Privacy Commissioner investigates complaints (section 11) and can enter into compliance agreements (section 17.1). After the OPC report, the complainant, or the Commissioner, can apply to the Federal Court, which can order changes and award damages (sections 14 to 16). PIPEDA has no fine for consent or marketing failures. ## What Enforcement Has There Been Under PIPEDA? **In short:** 2 cases from regulator and court records, newest first. PIPEDA has no fines for consent failures, so these Privacy Commissioner findings ended in commitments rather than amounts. **PIPEDA enforcement examples from regulator and court records** | Date | Company | What happened | Outcome | Source | | --- | --- | --- | --- | --- | | 2022-05-10 | Biron Health Group | Used email addresses collected to send airport COVID-19 test results for promotional emails. | Stopped the practice and deleted non-client addresses; no fine | [OPC Findings 2022-002](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-002/) | | 2016-04-21 | 3510395 Canada Inc. (Compu-Finder) | Used address harvesting software to collect about 170,000 email addresses and kept emailing about 28,000 of them after July 1, 2014. | Complaint well-founded; compliance agreement, no fine | [OPC Report of Findings 2016-003](https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2016/pipeda-2016-003/) | ## Cold Email Checklist for PIPEDA 1. Record each contact's title or role, and send only pitches relevant to it. 2. Prefer addresses the person published themselves, and match the pitch to why they are listed. 3. Do not use scraping or address-generation tools. 4. Get written warranties from list vendors about where addresses came from and how consent was obtained. 5. Honor every withdrawal of consent across all lists. 6. Publish a privacy notice that covers prospect data. 7. Meet CASL for the email itself: consent, identification and unsubscribe. ## How Ken Helps **In short:** Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility. - Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3). - Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it. - Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits. - You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2). - Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6). - Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under PIPEDA, that includes keeping each pitch relevant to the contact's role. - [Join the waiting list](/waitlist) - [Read Ken's anti-spam policy](/anti-spam) ## FAQ ### Is a work email address personal information under PIPEDA? Yes. The OPC says business contact information such as a work email address is personal information. Part 1 does not apply when you use it solely to communicate with the person about their employment, business or profession (section 4.01). ### Does PIPEDA let me email B2B prospects without consent? Only within section 4.01, where the message is truly about the recipient's job, or within the publicly available information regulations. Off-topic pitches fall back under PIPEDA, as the OPC found with Compu-Finder. ### Can I scrape emails from websites to build a list? There is no safe route. Section 7.1(2) removes the consent exceptions for addresses collected with harvesting software. ### Can I buy a list of Canadian business emails? The OPC says you must make sure of informed consent even for addresses from a third-party supplier, and get a written contractual assurance that consent was obtained. ### What are the PIPEDA fines? Up to CAD 100,000 under section 28, and only for knowingly breaking breach-reporting, record-keeping or whistleblower rules or obstructing the Commissioner. Consent and marketing breaches lead to an OPC complaint and possibly Federal Court damages (section 16). ## Related - [Cold email laws by country](/cold-email-laws): All 12 laws compared - [CASL (Canada): What It Means for Cold Email](/cold-email-laws/casl): Consent first; implied consent for published work addresses - [GDPR: What It Means for Cold Email](/cold-email-laws/gdpr): Legitimate interest; consent rule varies by country - [CCPA and CPRA: What They Mean for Cold Email](/cold-email-laws/ccpa-cpra): Allowed; privacy rights apply to covered businesses - [Ken anti-spam policy](/anti-spam) ## Sources | Source | URL | Checked | | --- | --- | --- | | PIPEDA, S.C. 2000, c. 5, full text | https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html | 2026-10-17 | | Regulations Specifying Publicly Available Information, SOR/2001-7 | https://laws-lois.justice.gc.ca/eng/regulations/SOR-2001-7/FullText.html | 2026-10-17 | | OPC, guidance for businesses doing e-marketing | https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/canadas-anti-spam-legislation/casl-compliance-help-for-businesses/casl_guide/ | 2026-10-17 | | OPC, interpretation bulletin on publicly available information | https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-interpretation-bulletins/interpretations_06_pai/ | 2026-10-17 | | OPC, Report of Findings 2016-003 (Compu-Finder) | https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2016/pipeda-2016-003/ | 2026-10-17 | | OPC, Findings 2022-002 (Biron Health Group) | https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2022/pipeda-2022-002/ | 2026-10-17 | | European Central Bank, euro foreign exchange reference rates (2026-10-16) | https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html | 2026-10-17 | | Ken anti-spam policy (sections 4 and 6) | /anti-spam | 2026-10-17 | | Ken Terms of Service (sections 7.1 to 7.3) | /terms | 2026-10-17 | | Ken features: deliverability monitoring and multi-inbox rotation | /features | 2026-10-17 | ## Changelog - 2026-10-17: Page published.