Cookie Notice
NorthCan Roofing Inc., 425 Alness Street, Toronto, ON M3J 2T8. Questions about this page: info@northcanroofing.com.
The Canadian rule, stated accurately, because this is where most agencies get it wrong in both directions.
Canada has no ePrivacy Directive and no statutory cookie law. The requirement comes from PIPEDA and specifically from the consent principle in Schedule 1, Principle 4.3 and the reasonableness requirement in s. 5(3). So do not import the EU model wholesale, and do not conclude that nothing is required.
The operative distinction is the OPC's. In its Guidelines for Obtaining Meaningful Consent, the OPC states that while "consent should generally be express, it can be implied in strictly defined circumstances," and that express consent is required where the information is sensitive, where the collection, use or disclosure is outside the individual's reasonable expectations, or where it creates a meaningful residual risk of significant harm. It also requires that, for collections not necessary to provide the service, individuals get "a clear and easily accessible choice" rather than being made to hunt for an opt-out (OPC, Guidelines for Obtaining Meaningful Consent).
Applied to this site:
| Tag category | Consent standard | May it fire before consent? |
|---|---|---|
| Strictly necessary (session, security, consent-choice storage, WP Rocket cache behaviour) | No consent needed | Yes |
| First-party analytics (GA4 with advertising features and Google signals off, used only to improve the site) | Implied consent is defensible in Canada, provided notice is given on entry, the policy is live before the tag fires, and opting out is easy | Yes, if and only if ads features are off. The safer build, and the one I recommend, is to gate it anyway, because a single toggle in the GA4 admin can silently move this row. |
| GA4 with Google signals / advertising features on | Express. Cross-device profiling for advertising is outside a roofing customer's reasonable expectations | No |
| Meta pixel, Google Ads remarketing, Microsoft UET, LinkedIn Insight, any conversion or remarketing tag | Express | No |
| Call tracking that records calls | Express, plus a recording notice announced at the start of the call | No |
| Embedded YouTube, Google Maps, live chat, third-party fonts | Express, because each transmits the visitor's IP to a third party | No, use click-to-load placeholders |
What the banner must do to be compliant here:
- Appear on entry, before any non-essential tag fires. Notice buried in a footer link is not notice.
- First layer carries Accept and Reject with equal prominence. Same size, same weight, same contrast, both real buttons. A grey ghost "Reject" beside a green "Accept All" is a dark pattern and it is the most common defect we find.
- No pre-ticked boxes. Analytics and marketing default to off.
- Granular categories: Necessary (locked on), Analytics, Marketing. A "Manage preferences" second layer with per-category toggles and a description of each.
- Continuing to browse is not consent for anything requiring express consent. Dismissing the banner without choosing means non-essential tags stay off.
- Withdrawal from any page: a persistent "Cookie Settings" link in the footer that reopens the preference centre, and choices must actually be revocable, meaning revoking removes the consent and stops the tags on the next page load.
- The privacy policy must be live at its URL before a single tag fires. This is one of the two hard blocks in our process. Data collected before a live policy is a fact that is simply wrong, not a risk to weigh.
- A consent log: timestamp, the choice made, the banner/policy version, retained as evidence. The OPC's seventh principle is "Be accountable: stand ready to demonstrate compliance," and a log is how you do that.
- The banner must not block the page content in a way that traps a user, and it must be keyboard navigable and screen-reader accessible with a visible focus ring. An inaccessible consent banner is an AODA problem sitting on top of a privacy problem (see C3).
- GTM must gate the tags, not the banner. See Part D2 for the implementation.
Banner text, first layer, ready to publish:
We use cookies We use necessary cookies to make this site work. With your permission we would also like to use analytics cookies to understand how visitors use the site, and marketing cookies to measure our advertising. You can change your mind at any time using the Cookie Settings link in our footer. [ Accept all ] [ Reject non-essential ] [ Manage preferences ] Read our [Privacy Policy].
Preference centre, second layer:
Cookie preferences
Strictly necessary — always on Needed for the website to work: security, page loading and remembering your cookie choices. These cannot be switched off.
Analytics — off by default Google Analytics 4, deployed through Google Tag Manager. Tells us which pages people read, how they found us and where they leave. We use it to improve the site. It does not tell us who you are.
Marketing — off by default . Used to measure our advertising and to show our ads to people who have visited this site.
[ Save my choices ]
Footer link text, on every page: Cookie Settings
The rest of the legal pack
Questions about any of this go to info@northcanroofing.com or 416-456-0777. To book a roof assessment, use the assessment request form or read what we do on the services page.