Canadian healthcare marketers face strict privacy rules that vary by province and may face even more requirements with the introduction of Bill C-36. What is coming down the funnel, and how can your team continue to aggregate user data in an ever-changing digital landscape?

What is Bill C-36?

On June 15, 2026, Ottawa introduced Bill C-36. It is proposed to replace PIPEDA’s privacy provisions and move enforcement to a new Digital Safety and Data Protection Commission of Canada. Part of Bill C-36 aims to increase control and transparency when Canadians’ personal information is handled by organizations, including through meaningful consent and clearer explanations.¹ It isn’t law yet, but certain violations could draw penalties up to the greater of $10,000,000 or 3% of global revenue.¹ 

Rights and responsibilities

Across Canada, individuals have rights regarding the collection or use of their web browsing activity, and it must be done with the user’s knowledge and consent. Therefore, “if an individual is not able to decline the tracking and targeting using an opt-out mechanism because there is no viable possibility for them to exert control over the technology used, or if doing so renders a service unusable, then organizations should not be employing that type of technology for online behavioural advertising purposes”.²

Quebec’s own privacy regulator (the CAI) says businesses can’t activate identification, location, or profiling functions by default, and the law defines profiling to include evaluating health, interests, or behaviour.³ Penal fines can reach CAD $25 million or 4% of worldwide turnover.⁴ 

Health context raises the bar

Medical information is treated as sensitive and requires express consent to use this information for a new purpose.⁵ Tracking users on a condition-specific page, paired with a persistent identifier would create a highly sensitive health-data profile that could not be used for future targeting ad signals. 

Implementing consent

• Be mindful of your inventory: review what actions and data you are tracking through every tag, pixel, and script on site and in tag managers. Are you driving campaign traffic to a sensitive landing page, then using sensitive data actions for retargeting? 
• Make consent real: Ensure appropriate consent banners are implemented on site for both English and French. Keep profiling functions off until the visitor opts in, and offer bilingual banners with accept and reject options. Enable Google Consent Mode for Google measurement products to ensure that a visitor’s consent mode state is preserved across the pages they visit, and tags will adjust their behavior accordingly. ⁶ 
• Prioritize first-party data: use what your audience has provided you voluntarily to help provide them with the most relevant messaging.
  • Ex. Webinar registrations: Registration is a great first-party conversion because the person gave their details knowingly. Track registration rate by channel, registration/attendance, and downstream signals like content downloads or rep-meeting requests. 
• Utilize additional privacy-safe tactics: Script lift compares prescription volume between an exposed group and a matched control group, across total, new, and new-to-brand prescriptions, with the data join done in a privacy-safe environment.⁷ 
• Separate HCP and DTC data flows: DTC and HCP campaign data should always be kept separate to comply with regulatory requirements and protect sensitive privacy signals.

Privacy-first measurement should always be top-of-mind when working in Healthcare Marketing, and the emergence of Bill C-36 is a good reminder to check if you’re still compliant.

Sources

1. Government of Canada, “Backgrounder: Government of Canada introduces legislation to Protect Canadians’ Privacy in the Digital Age”, June 15, 2026, https://www.canada.ca/en/innovation-science-economic-development/news/2026/06/government-of-canada-introduces-legislation-to-protect-canadians-privacy-in-the-digital-age.html.
2. “Guidelines on privacy and online behavioural advertising”, August 11, 2025, https://www.priv.gc.ca/en/privacy-topics/technology/online-privacy-tracking-cookies/tracking-and-ads/gl_ba_1112/.
3. Commission d’accès à l’information du Québec, “Collecte de renseignements personnels — entreprises,” cai.gouv.qc.ca.
4. Ligue des droits et libertés, “Pas de quoi contrecarrer le modèle d’affaires des GAFAM,” February 8, 2024, liguedesdroits.ca.
5. Commission d’accès à l’information du Québec, “Principaux changements apportés par la Loi 25,” cai.gouv.qc.ca.
6. Google Support, “About consent mode”, https://support.google.com/google-ads/answer/10000067?hl=en.
7. ppc.land, “Explaining script lift,” 2026, ppc.land.