What businesses can collect
Businesses can only collect personal information for purposes you would reasonably expect, and only what is necessary for those purposes. Collecting your date of birth, SIN, or driver's licence number is rarely necessary for a retail transaction.
Loyalty programs and profiling
Loyalty programs often involve broad consent to combine data across purchases, devices, and partner companies. You can review the privacy policy and withdraw consent, though you may lose rewards.
Quebec's Law 25 requires express consent for profiling and for automated decisions that significantly affect you.
Targeted advertising and tracking
Cookie banners should offer a meaningful choice, not just an accept-all button. The OPC has issued guidance that consent must be meaningful.
You can request that a company stop using your data for marketing purposes at any time.
Credit checks and background screening
Companies that run credit checks must have your consent and a valid purpose. Provincial consumer reporting laws (e.g., Ontario's Consumer Reporting Act) give you a right to see your credit file and dispute errors.