Starting an online store feels a lot simpler than opening a physical shop. No lease to sign, no storefront to build out, no landlord to negotiate with- just a website, a product, and a “Buy Now” button. But that simplicity is a little deceiving. The moment your online store accepts its first Canadian customer, it becomes subject to a web of federal and provincial laws covering privacy, advertising, sales tax, accessibility, and consumer rights, often several sets of rules at once depending on where your customers live.
Most founders don’t find this out until something goes wrong: a customer complaint, a Competition Bureau inquiry, a CASL fine, or a demand letter over a trademark. Almost all of it is avoidable with a bit of planning at the outset. This guide walks through what any ecommerce business operating in Canada, from a one-person Shopify store to a national retailer needs to have in place, and where it makes sense to bring in an ecommerce lawyer to get it right the first time.
What Are The Consumer Protection Requirements For E-Commerce In Canada?
Every province has its own consumer protection legislation, and most of it applies squarely to online sales. In Ontario, the Consumer Protection Act, 2002 sets out specific rules for “internet agreements”- contracts formed by a consumer accepting an offer online. Before a purchase is completed, the merchant must clearly disclose an itemized list of what’s being purchased, the total price (including delivery, taxes, and other charges), the merchant’s legal name and contact information, and the cancellation, return, or refund policy. If a business fails to disclose this properly, the consumer typically gains a statutory right to cancel, commonly within seven days of the missing information finally being disclosed.
Similar rules exist in Quebec’s Consumer Protection Act, British Columbia’s Business Practices and Consumer Protection Act, and equivalent legislation in every other province, generally prohibiting unfair or deceptive practices- false origin claims, exaggerated “was/now” pricing, fake urgency and hidden checkout fees.
That last point is now a major enforcement priority. Amendments to the federal Competition Act in 2022 expressly treat “drip pricing”- advertising a lower price than what a consumer actually pays once mandatory fees are added as false or misleading advertising. In 2024, the Competition Tribunal ordered Cineplex to pay nearly $39 million for adding an undisclosed $1.50 online booking fee to ticket prices, and in 2017 Amazon.ca paid $1.1 million to settle concerns over inflated “was” pricing. The lesson: whatever price you advertise has to be the price a customer can actually pay.
Does An E-Commerce Website Need Terms And Conditions?
Yes, and not as a formality. Terms and conditions (sometimes called “terms of service” or “terms of use”) are the contract between your business and everyone who visits or buys from your site. Without one, you’re relying entirely on default rules under provincial sale-of-goods and consumer protection legislation, with no ability to limit your liability, set governing law, define how disputes get resolved, or protect your intellectual property.
Canadian courts have repeatedly upheld “clickwrap” agreements- the kind where a user must click “I agree” before completing a purchase as enforceable, provided the terms are reasonably accessible and the user has a genuine opportunity to review them. In Rudder v Microsoft Corp., [1999] OJ No 3778 (Ont Sup Ct J), the Ontario Superior Court of Justice held that a forum selection clause buried in a lengthy online agreement was still binding, reasoning that scrolling through terms online is no different in principle from turning the pages of a printed contract; clicking “I agree” is enough to show assent, even if the user never reads the terms.
That said, enforceability has limits, particularly for consumer-facing clauses that strip away rights. In the Douez v Facebook, Inc., 2017 SCC 33 case, the Canadian Supreme Court refused to give effect to a forum-selection provision in a B.C. consumer’s contract with Facebook, Inc., requiring him to sue his claim in the state of California on account of their imbalance in a standard form consumer contract. Lesson? Your terms are likely to be enforced, but they should be reasonable and not against consumer/privacy protection.
Choosing A Legal Structure For Your Online Business
Before you worry about terms and conditions or tax registration, you need a legal entity to hold them. Most Canadian ecommerce founders choose between three structures:
- Sole proprietorship: Simple and inexpensive, but you and the business are legally the same person, so your personal assets are exposed if the business is sued or runs up debt.
- Partnership: Useful when two or more people build the business together, but each partner can generally be held liable for the others’ actions, which makes a formal partnership agreement essential.
- Corporation: The most common choice once a store gains real traction. Incorporating creates a separate legal entity, shielding your personal assets, potentially offering tax planning advantages, and looking more credible to suppliers and payment processors.
The right structure depends on your risk tolerance, growth plans, and tax situation. It’s worth discussing with a lawyer or accountant early, since unwinding the wrong structure later is far more expensive than choosing correctly at the outset.
Terms and Conditions & Terms of Sale
However, despite their being lumped together in one contract, there is a difference between the two. Terms and Conditions dictate the terms of using the website, including acceptable use, intellectual property rights, accounts, limitation of liability, and dispute resolution. Terms of Sale (which can be included in one contract together with the first mentioned or separately), dictate the conditions of the actual purchase: prices, means of payment, acceptance of orders, shipping times, risk of loss, and return policy.
These are the minimum things that should be covered in a properly prepared package: contract formation and its conditions; pricing, currency, and taxes; shipping schedule and consequences of loss or damage during shipping; return/exchange/refund policy that meets minimum provincial standards; limitation of liability to the maximum extent allowed by the law; governing laws and dispute resolution; and ownership of website content and pictures.
Generic templates copied from another website are a common source of trouble- often drafted for a different jurisdiction or business model, leaving real gaps or, worse, unenforceable clauses. A properly tailored terms of sale document is one of the cheapest forms of legal insurance an online retailer can buy.
What Does Quebec Law 25 Mean For E-Commerce Businesses?
If you sell to customers in Quebec, even from an office in Ontario or British Columbia- you need to pay attention to Law 25, which substantially overhauled Quebec’s Act respecting the protection of personal information in the private sector between 2021 and 2023. It is now widely considered the strictest privacy regime in Canada, and its requirements go noticeably further than the federal standard.
Under Law 25, any business collecting, using, or disclosing personal information from Quebec residents in the course of ecommerce activity must maintain a privacy policy that meets specific transparency requirements, in clear and accessible language. If your site uses cookies or other profiling technology, you need a mechanism typically a cookie banner plus a cookie policy that discloses this and lets users control it. Certain uses may require separate, specific consent rather than a blanket policy acknowledgment.
Organizations are responsible for governance as well- appointment of a privacy officer (who may be nothing but the proprietor himself in case of small companies as long as it is documented), maintenance of a list of activities that involve personal data processing, maintenance of records of confidentiality breaches and conducting a privacy impact assessment prior to starting of any major project. The penalty for the violation of Law 25 starts from a fine of up to $10 million or 2% of total worldwide revenue for regular cases and rises to up to $25 million or 4% for severe ones.
Privacy Law: PIPEDA And What It Means For Your Store
Outside Quebec, the primary privacy law governing most commercial ecommerce activity is the federal Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA applies to virtually any business that collects customer information- names, addresses, email addresses, payment details, browsing behavior- in the course of commercial activity, and it rests on ten fair information principles: accountability, identifying purposes, meaningful consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and the ability to challenge compliance.
“Meaningful consent” is where many online businesses run into trouble, particularly around sharing customer data with third-party advertising and analytics platforms.
In reality, compliance with PIPEDA involves having an effective privacy policy stating what is collected and for what reason, proper consent prior to passing any information to the advertising or marketing platforms, appropriate security measures, as well as procedures for dealing with access requests and breaches posing risks of significant harm.
CASL: Canada’s Anti-Spam Legislation
If your ecommerce business sends promotional emails, texts, or other commercial electronic messages, Canada’s Anti-Spam Legislation (CASL) applies and it is enforced with real teeth. CASL generally requires that before sending a commercial electronic message, a business must have either express or implied consent from the recipient, must clearly identify itself (including a valid mailing address and contact method), and must include a functional unsubscribe mechanism that takes effect within 10 business days.
CASL is not merely an enacted statute that exists in name alone. One of the first and biggest enforcement actions brought by the CRTC against non-compliant businesses under CASL was Compu-Finder’s $1.1 million fine in 2015 for sending emails without consent and employing dysfunctional unsubscribe methods. Additionally, the constitutionality of CASL has been successfully challenged. 3510395 Canada Inc. v Attorney General of Canada, 2020 FCA 103, is a decision of the Federal Court of Appeal that found CASL to be valid and within the scope of federal jurisdiction and not violating the Canadian Charter of Rights and Freedoms.
Practical CASL compliance usually comes down to a few habits: only adding customers to a marketing list with clear consent (a purchase creates implied consent for a limited period, but a website visit or giveaway entry may not); keeping records of when and how consent was obtained; and making sure every promotional email has accurate sender identification and a working one-click unsubscribe.
Consumer Protection: Returns, Refunds & Advertising
Beyond the baseline disclosure requirements discussed earlier, two areas deserve particular attention: return and refund policies, and advertising claims.
Canada does not have a nationwide “cooling-off period” that automatically applies to every online purchase, as many assume. Your return and refund policy is largely a matter of contract- what you disclose to the customer before they buy is generally what governs, provided it doesn’t fall below provincial minimums. That means the policy needs to be clearly displayed before checkout, not buried in a footer link discovered only after a dispute arises.
Regarding advertisements, provincial legislation and the federal Competition Act make it illegal to engage in misleading or deceptive practices, such as overrating performance capabilities, creating false countdowns, artificial scarcity, and the use of an unproven “Made in Canada” label. From the Cineplex and Amazon.ca cases mentioned above, it is clear that the Competition Bureau considers price transparency a real issue for enforcement action, and not merely a technical one. Every price you advertise must be what your customer actually pays.
Sales Tax for Online Sellers: GST/HST and PST
Sales tax is often the part of ecommerce compliance that gets overlooked longest and it can create the largest retroactive liability. Every business selling taxable goods or services in Canada generally must register for and collect GST/HST once its total taxable revenue (worldwide) exceeds $30,000 over four consecutive calendar quarters, though voluntary earlier registration is available and can help with input tax credits.
The structure differs per province: Ontario, New Brunswick, Nova Scotia, Newfoundland and Labrador, and Prince Edward Island levy a combined Harmonized Sales Tax (HST); others levy GST and a separate Provincial Sales Tax (or Quebec Sales Tax in Quebec). This means that British Columbia, Saskatchewan, Manitoba, and Quebec require separate registrations and payments. Since 2021, federal laws have required foreign and online businesses to become part of the GST/HST structure, levying GST/HST regardless of their physical presence in Canada.
Getting the destination province right matters, because tax is generally charged based on where the customer takes possession of the goods, not where your business is located — so an ecommerce business shipping nationally needs a system that correctly applies the right combination of taxes for every province.
Shipping, Cross-Border Sales & Product Compliance
Once a product physically leaves your warehouse, a different set of rules kicks in. Packaging and labelling for many consumer goods must comply with the federal Consumer Packaging and Labelling Act, which requires bilingual (English and French) labelling regardless of which province the goods are sold in- a rule that trips up many online sellers who assume English-only packaging is fine outside Quebec. Certain categories- food, cosmetics, textiles, children’s products, and toys face additional federal safety and labelling standards under legislation such as the Canada Consumer Product Safety Act.
Selling into Quebec adds another layer: since the Charter of the French Language was tightened by Bill 96, product packaging, ecommerce websites, and advertising directed at Quebec consumers generally must be available in French, presented at least as prominently as any other language.
For cross-border sales, businesses need to work out customs duties, who’s responsible for them, import restrictions on certain product categories, and how those costs are disclosed before checkout since undisclosed customs fees can themselves raise drip-pricing concerns under the Competition Act.
Website Accessibility Requirements
Accessibility compliance is often treated as optional by smaller ecommerce businesses, but in several provinces it isn’t. In Ontario, the Accessibility for Ontarians with Disabilities Act (AODA) requires businesses with 50 or more employees to make their websites conform to the Web Content Accessibility Guidelines (WCAG) 2.0 Level AA, and requires all organizations, regardless of size, to provide accessible customer service. Similar obligations exist under Manitoba’s and Nova Scotia’s accessibility legislation, and federally regulated organizations fall under the Accessible Canada Act.
However, even at sizes smaller than the threshold at which formal requirements kick in, there is a clear need for accessibility features simply because it makes good business sense- it increases the customer base, eliminates human rights complaints, and is much more cost-effective to incorporate accessibility in the design stage than to add it later on. Typical deficiencies on e-commerce websites would include lack of alternative text for images, inability to complete a purchase process via keyboard input alone, and poor color contrast.
Protecting Your Brand: Trademarks And Ip
Your brand name, logo, and product packaging are often among the most valuable assets an ecommerce business owns, and among the most vulnerable if left unprotected. Registering a trademark with the Canadian Intellectual Property Office gives you a nationwide, statutory right to prevent others from using a confusingly similar name or logo for similar goods or services, and makes enforcement far more straightforward than relying on common law rights alone.
Even without a registered trademark, Canadian law recognizes the tort of “passing off,” which protects the goodwill a business has built in its brand. The Supreme Court of Canada set out the modern test for passing off in Ciba-Geigy Canada Ltd v Apotex Inc, 1992 CanLII 33 (SCC), holding that a claimant must show goodwill attached to their goods or services, a misrepresentation by the defendant leading (or likely to lead) the public to believe the defendant’s goods are the claimant’s, and actual or potential damage as a result. So, an unregistered brand name can, in the right circumstances, be defended in court, though registration remains the stronger route.
Trademark disputes involving online and parody brands are increasingly common. In Subway IP LLC v Budway, Cannabis & Wellness Store, 2021 FC 583, the Federal Court found that a cannabis retailer’s “Budway” branding closely mimicking Subway’s colour scheme, font, and store layout- infringed Subway’s trademark rights and depreciated its brand goodwill, despite the retailer’s parody defence. For ecommerce businesses building a brand identity, the case is a reminder that clever “inspired by” branding carries real legal risk, and registering your own trademarks early is one of the most effective ways to protect your brand equity.
When To Bring In An E-Commerce Lawyer
Some of what’s covered in this guide- choosing a business structure, registering for sales tax — can be started on your own. But several moments in the life of an online business genuinely call for an experienced ecommerce lawyer:
- At launch, to make sure your terms and conditions, terms of sale, privacy policy, and return policy are properly drafted for your business model and the provinces you plan to sell into, rather than adapted from a generic template.
- Before a major marketing push, particularly email marketing, retargeting pixels, or loyalty and subscription programs that touch CASL, PIPEDA, or Quebec’s Law 25.
- When expanding into Quebec, given the added layers of French-language and privacy compliance.
- When you receive a complaint, demand letter, or regulatory inquiry from the Competition Bureau, the CRTC, a privacy regulator, or a competitor alleging trademark infringement, since early, well-informed handling often prevents a manageable issue from becoming an expensive one.
- Before scaling internationally, where cross-border shipping, customs, and foreign consumer protection laws add further complexity.
An ecommerce lawyer in Toronto, or anywhere else in Canada, isn’t just there to clean up problems after they happen. Getting the right advice at the design stage is consistently the most cost-effective way to avoid the penalties, disputes, and reputational damage that come from getting these rules wrong. Book a consultation with us!
