Fingerprints, facial recognition, voice prints, and other biometric information receive heightened privacy protection under Canadian law.
This page provides legal information, not legal advice. Consult a qualified privacy lawyer or CIPP/C-accredited privacy professional before taking action on access requests, breach response, complaints to a Privacy Commissioner, or Federal Court applications.
Last verified: September 2026
TL;DR
Biometric information is treated as sensitive. Organizations must have a clear purpose, obtain express consent in most cases, and assess whether a less intrusive alternative exists. Commissioners in several provinces have investigated biometric time-clocks and facial-recognition systems.
Canadian commissioners jointly investigated Clearview AI and in February 2021 found that its database of scraped photos violated Canadian privacy law; Clearview had stopped offering its service in Canada in July 2020, during the investigation, and provincial regulators later issued binding orders.
Public-sector use of facial recognition in law enforcement is under active debate. Some police services have imposed moratoriums.
Quebec's Law 25 biometric registration
Quebec requires organizations to declare any biometric system to the CAI 60 days before it goes live. This is one of the strongest biometric rules in North America.
Alternatives test
Commissioners have consistently asked whether a less intrusive alternative would meet the same purpose. If a card, PIN, or password would work, biometrics are usually not reasonable.