The federal Liberal government just dropped its third attempt to fix Canada's broken, 25-year-old private-sector privacy laws. It's called Bill C-36, the Protecting Privacy and Consumer Data Act (PPCDA).
If you are wondering why the government is rushing this out right before the summer parliamentary recess, look no further than the sudden mainstream explosion of artificial intelligence.
Just days ago, Canada’s Privacy Commissioner Philippe Dufresne dropped a bombshell report revealing that Elon Musk’s Grok AI broke Canadian privacy laws, at one point pumping out over 6,000 explicit deepfake images every single hour.
Canadians are spooked. According to data from the Privacy Commissioner’s office, 88% of Canadians are actively worried about how their data gets used, and 85% want AI regulated immediately.
Bill C-36 tries to answer that panic. It officially recognizes privacy as a fundamental right, promises to crush AI-generated deepfakes, and cracks down on sneaky algorithms that hike up prices based on your web history.
But there's a glaring problem. The government’s actual track record on digital privacy over the last year makes this new bill look more like desperate political virtue signaling than a genuine plan.
The Core Promises of Bill C-36
Artificial Intelligence Minister Evan Solomon pitched the bill on Parliament Hill as a common-sense way to hand control back to ordinary people. The legislation targets companies with a substantial connection to Canada and replaces the deeply outdated PIPEDA framework from 1998.
Three main pieces of the bill stand out.
The Right to Erase AI Deepfakes
For the first time, you can legally demand that a private company delete your data, including AI-generated deepfakes that hijack your face or voice. If an algorithm trains on your photos without your permission, you have the right to order it scrubbed.
There are loopholes, though. A company can reject your deletion request if they anonymize the data or claim they need it to prevent fraud.
Banning Surveillance Pricing
Ever notice a flight or a pair of shoes gets more expensive the second time you look at it? That is surveillance pricing—using your location, browsing history, and device type to squeeze more money out of you.
Bill C-36 promises to curb this practice when the harms outweigh the benefits. However, the actual text of the bill does not explicitly mention the words "surveillance pricing". Minister Solomon admitted the government will simply leave it up to a new regulator to figure out the specific rules later.
Stiffer Penalties for Tech Giants
To make companies take this seriously, the bill introduces heavy financial penalties. Serious corporate offenders face administrative penalties up to $10 million or 3% of global revenue. For criminal-level infractions, fines can skyrocket to $25 million or 5% of global revenue, whichever is higher.
Why the Tech Expert Community is Skeptical
The big numbers and flashy headlines sound great on paper. But Canada’s top digital policy experts aren't buying the hype.
Prominent privacy scholar Michael Geist has pointed out a massive double standard in how Ottawa handles digital rights. While the Liberals claim Bill C-36 values privacy as a fundamental right, their other legislative actions over the past year completely contradict that narrative.
Take Bill C-34, the Safe Social Media Act introduced just last week. It tries to ban kids under 16 from social networks, but it forces millions of adult Canadians to hand over sensitive ID or biometric data just to verify their age to use platforms like Reddit or Instagram.
Then there’s Bill C-22, a lawful access bill that forces telecom companies to keep logs of user metadata, giving authorities access to data footprints without a warrant. During committee debates on that bill, a Liberal MP openly claimed the legislation had nothing to do with people's privacy.
You can't claim privacy is a sacred human right in one bill while systematically dismantling it in three others.
How Bill C-36 Compares to the Old Rules
To understand how drastically the digital economy has evolved, look at what the current law permits versus what the new bill targets.
Under the old 1998 PIPEDA framework, tech companies operated in a wild west where data could be hoarded indefinitely as long as it was buried in a confusing terms-of-service agreement. Algorithmic transparency was non-existent.
Bill C-36 completely shifts the burden of proof. It mandates plain-language explanations for data tracking and forces companies to explain exactly how automated decision-making systems affect your life.
Furthermore, the new Digital Data Commissioner will have actual teeth to enforce these rules, replacing the toothless "name and shame" approach that failed to stop companies like Grok AI from ignoring Canadian standards.
What You Need to Do Right Now
The law will take months, if not years, to pass through committees and become active. You cannot wait for Ottawa to protect your digital footprint.
Take immediate steps to secure your personal data from predatory AI scraping and algorithmic price gouging.
First, audit your social media privacy settings. Turn off public visibility on your photos to prevent automated scrapers from feeding your face into deepfake generators.
Second, mix up your web habits to beat surveillance pricing. Use a virtual private network (VPN) to mask your location, and browse shopping or travel sites exclusively in incognito mode. Clear your browser cookies regularly to stop retail algorithms from profiling your purchasing vulnerabilities.
Third, check the privacy policies of apps your kids use. Under current conditions, your data is treated as commercial oil. Treat it like the fundamental right the politicians say it is, and lock it down yourself.
