Canada wants to stop companies from using your data to charge you more, but the details are still missing

The Canadian government introduced legislation on Monday to overhaul the country’s private-sector privacy laws, including new restrictions on businesses that use personal data to charge individual consumers higher prices. Bill C-36, the Protecting Privacy and Consumer Data Act, would replace the Personal Information Protection and Electronic Documents Act, a law first enacted in 1998 that has been widely criticised as outdated in the age of algorithmic pricing and large-scale data collection.

Artificial Intelligence and Digital Innovation Minister Evan Solomon said the bill targets so-called surveillance pricing, the practice of using a consumer’s browsing history, location, device type, or purchasing behaviour to set individualised prices. “Companies should not have the ability to use your behaviour, your location, your profile, your vulnerabilities, or your personal information to charge unfair prices,” Solomon told reporters. “Your personal information should not be used against you for price gouging.”

The bill does not ban surveillance pricing outright. Solomon said the legislation aims to bar the use of data to target consumers with individualised prices when the harms outweigh the benefits, but the government does not want to prevent companies from rewarding consumers with better prices through loyalty programmes or promotional discounts. Surveillance pricing is not specifically mentioned in the bill’s text, according to BetaKit, and Solomon will instead ask the new regulator to draft guidance on the issue once it is operational.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!

That regulatory gap is significant. The bill creates a new body called the Digital Safety and Data Protection Commission to oversee compliance with both the privacy legislation and the proposed Digital Safety Act, which aims to safeguard children online. The Office of the Privacy Commissioner of Canada would retain responsibility for overseeing government compliance with federal privacy laws, but the new commission would handle the private sector.

The penalties are substantial on paper. The commission could impose fines of up to C$10 million ($7.1 million) or 3% of global revenue, whichever is greater, for non-compliance. The most serious offences could face fines of up to C$25 million or 5% of global revenue. Whether those penalties are ever applied will depend on whether the bill passes Parliament and how aggressively the commission interprets its mandate.

Beyond surveillance pricing, the bill introduces several consumer protections that bring Canada closer to the European Union’s General Data Protection Regulation. Canadians would gain the right to have their personal information deleted under certain circumstances. Organisations would be required to disclose more information about automated decisions affecting consumers. Children’s data would be classified as sensitive, requiring a higher standard of care from any business that collects it.

Canada is not moving in isolation. Manitoba’s provincial government introduced Bill 49 in March, which would prohibit retailers from using personal data to increase prices for individual consumers both online and in stores. In the United States, Maryland became the first state to enact a surveillance pricing ban when Governor Wes Moore signed HB 895, prohibiting food retailers with locations larger than 15,000 square feet and third-party delivery services from using personal data to raise prices on individual shoppers. That law takes effect on 1 October.

Public opinion in Canada strongly favours action. An Abacus Data poll conducted in early March surveyed 1,931 Canadians and found that 52% said surveillance pricing should be banned outright, while 31% said it should be allowed but more strictly regulated. The bill’s approach, restricting rather than banning, positions the government closer to the minority view, though Carney’s broader $2.3 billion national AI strategy had already signalled that new privacy legislation was coming without specifying how far it would go.

The privacy bill arrives less than two weeks after the AI strategy launch and days after Carney warned at the G7 about the systemic risks of AI dependence. The timing suggests the government is attempting to build a coherent regulatory framework across AI investment, data sovereignty, and consumer protection simultaneously. Whether those pieces fit together or contradict each other, spending $2.3 billion to accelerate AI adoption while restricting how AI-driven pricing can use consumer data, will depend on the details that the new commission eventually produces.

The bill still needs to pass Parliament. Canada’s previous attempt at modernising its privacy framework, the Artificial Intelligence and Data Act within Bill C-27, never made it through the legislative process and has not been revived. If Bill C-36 meets the same fate, the country will continue operating under a privacy law written before smartphones existed, while other jurisdictions move ahead with enforcement of their own digital protection regimes.