Age Verification Online in Canada: FINTRAC, PIPEDA and Provincial Laws

Online age verification in Canada operates under a combination of federal statutes, provincial legislation, and sector-specific regulatory guidance — with significant variation across provinces and between English and French Canada. The primary federal instruments are the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) for financial services, the Personal Information Protection and Electronic Documents Act (PIPEDA) for privacy, and the Criminal Code of Canada for content offences.

Canada does not yet have a single federal online age verification law equivalent to the UK's Online Safety Act. However, Bill C-63 (Online Harms Act), introduced in February 2024, proposed mandatory age verification for adult content platforms. As of April 2026, Bill C-63 has not passed (Parliament of Canada, Bill C-63 status).

Our platform processes over 180,000 documents per month across 32 jurisdictions. Integrating compliant age checks reduces identity verification processing time by 83% (CheckFile internal data, March 2026).

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice.

---

What is the Canadian legal framework for online age verification?

Canada's framework is federal-provincial in structure, with meaningful differences between provinces — particularly Quebec, which has its own privacy law (Loi 25) and unique language requirements.

The Criminal Code of Canada prohibits making obscene material available to persons under 18 (s. 163.1) and criminalises child sexual exploitation material. The RCMP (Royal Canadian Mounted Police) and provincial police forces enforce these provisions.

PIPEDA governs the collection, use, and disclosure of personal information by private sector organizations in Canada in the course of commercial activity. PIPEDA applies to federally regulated industries nationally and to provincially regulated industries in provinces without substantially similar legislation. It requires meaningful consent for data collection, with heightened requirements for children's data.

Quebec's Loi 25 (Act respecting the protection of personal information in the private sector, as amended in 2021) is substantially similar to PIPEDA but introduces additional requirements: mandatory privacy impact assessments for biometric systems, a data protection officer requirement, mandatory breach notification within 72 hours, and stricter rules for cross-border data transfers. Loi 25's full requirements came into force on 22 September 2023.

FINTRAC (Financial Transactions and Reports Analysis Centre of Canada) oversees AML/CTF compliance for financial services entities, where age verification is a component of Know Your Customer (KYC) requirements under the PCMLTFA.

---

How does online age verification work in Canada?

Age verification methods in Canada must comply with both federal PIPEDA (or provincial equivalents) and the specific requirements of the service category. The following methods are widely used.

Government-Issued ID Verification

The user submits a scan of a Canadian passport, provincial driver's licence, or provincial photo ID card. An OCR engine extracts the date of birth; an AI model verifies document authenticity. Our platform supports all Canadian provincial driver's licences and national passports, achieving 94.3% field extraction accuracy and 94.8% fraud detection recall (CheckFile internal data, 2026).

Canadian provincial driver's licences vary significantly in format between provinces — Alberta, Ontario, and Quebec use different security features and layout conventions. A compliant age verification system must support all 13 provincial and territorial formats.

Social Insurance Number (SIN) — Limited Use

The Social Insurance Number (SIN) is the Canadian equivalent of the UK's National Insurance number. Unlike in the US, where SSN-based age verification is common, the use of SIN for age verification is heavily restricted in Canada: the federal Privacy Act and provincial privacy laws prohibit collection of SIN numbers except for specific statutory purposes (employment, government benefits). SIN-based age verification for consumer digital services is generally not lawful under PIPEDA.

Open Banking / Bank-Verified Identity

Canada's Open Banking framework (Consumer-Driven Banking) was formally enacted through the Budget Implementation Act in 2024, with implementation regulations expected in 2025-2026. Once operational, banks will be able to share age-pass signals via API, allowing services to verify majority without accessing account data.

Facial Age Estimation

Biometric algorithms estimate age from a video selfie in 3-5 seconds. Quebec's Loi 25 requires a Privacy Impact Assessment (PIA) before deploying biometric systems that process personal information, as biometric data is classified as sensitive personal information under Loi 25. The CAI (Commission d'accès à l'information du Québec) must be notified before such systems go live in Quebec.

Permanent Resident Card (PR Card) / Immigration Documents

For non-citizen residents, age verification can be performed using a Permanent Resident Card (PR Card) or an Immigration, Refugees and Citizenship Canada (IRCC) document. Our platform supports IRCC-issued documents alongside provincial ID.

---

What are the penalties for non-compliance in Canada?

Canada's penalty structure reflects the federal-provincial division of authority.

Under PIPEDA: the Office of the Privacy Commissioner of Canada (OPC) can investigate complaints and make findings, but cannot directly impose fines. However, the federal court can issue compliance orders, and the OPC can accept enforceable compliance agreements. The proposed Bill C-27 (Consumer Privacy Protection Act), if enacted, would introduce fines of up to 5% of gross global revenue or CAD $25 million, whichever is greater.

Under Quebec's Loi 25: the CAI can impose administrative monetary penalties of up to CAD $25 million or 4% of worldwide turnover for serious violations, including unauthorized processing of children's personal information or biometric data without a PIA.

Under the Criminal Code: making obscene material accessible to minors can result in criminal prosecution with imprisonment terms and substantial fines.

Users on Canadian compliance forums ask frequently: "Does my app need to verify age differently in Quebec vs. Ontario?" Yes — Quebec's Loi 25 imposes stricter requirements than PIPEDA for biometric data processing (mandatory PIA, CAI notification) that do not apply in Ontario under PIPEDA alone.

---

What must Canadian digital service providers implement?

The compliance pathway for a regulated service in Canada involves four concrete steps.

Step 1 – Scope assessment: Identify which content or features require age verification under the Criminal Code, PIPEDA, provincial privacy laws, and sector-specific regulation. Assess whether biometric methods require a Quebec Loi 25 PIA.

Step 2 – Select a compliant method: The service should receive only a verification token — not the user's identity documents or biometric data. Self-declaration alone is not sufficient for high-risk content. Consider provincial variation: Quebec's Loi 25 imposes additional requirements for biometric systems.

Step 3 – Technical integration: The CheckFile document verification API supports Canadian passports, provincial driver's licences, PR Cards, and IRCC documents, returning only a signed pass/fail token. The 99.94% uptime SLA and 4.2-second average verification time meet the standards expected by Canadian financial services and regulated digital platforms. Our security architecture avoids retaining documentary data after verification.

Step 4 – Record-keeping: Maintain PIPEDA/Loi 25-compliant privacy policies, vendor contracts, processing records, and, where required by Loi 25, the CAI notification records for biometric systems.

For more on biometric verification methods and KYC requirements, see our dedicated guides. Also review our complete guide to document verification.

The CheckFile verification platform supports compliant age check integrations for the Canadian market — see pricing and plans for API access.

---

Frequently Asked Questions

Does Canada have a national online age verification law?

Not yet. Bill C-63 (Online Harms Act), introduced in February 2024, proposed mandatory age verification for adult content platforms, but had not passed as of April 2026. Age verification obligations currently derive from the Criminal Code (obscene material), PIPEDA (data collection from children), sector-specific rules (gambling, alcohol), and Quebec's Loi 25.

How does Quebec's Loi 25 differ from PIPEDA for age verification?

Loi 25 is more stringent in several respects: it classifies biometric data as sensitive personal information requiring specific consent and a Privacy Impact Assessment before deployment; it mandates notification to the CAI (Commission d'accès à l'information du Québec) before any biometric system goes live; and it requires designation of a privacy officer. PIPEDA imposes meaningful consent requirements but lacks these specific biometric provisions.

Can a Social Insurance Number (SIN) be used for age verification?

Generally no. Canadian privacy laws (PIPEDA, provincial laws) restrict SIN collection to specific statutory purposes. Using SIN for consumer digital age verification is not a recognized lawful purpose under PIPEDA. The preferred alternatives are government-issued photo ID, Open Banking age signals, or biometric estimation with appropriate PIAs.

Do US state age verification laws apply to Canadian platforms?

Not directly, but Canadian platforms serving US users — particularly in Louisiana, Texas, Virginia, and other states with age verification laws for pornographic content — should assess their exposure to US state laws based on the state's assertion of jurisdiction. Several US state AGs have pursued non-US operators for failure to implement age verification.

What is the Open Banking timeline for age verification in Canada?

Canada's Consumer-Driven Banking (Open Banking) framework was enacted in 2024, with FINTRAC-supervised phased implementation expected through 2025-2026. Once fully operational, banks will be able to share age-pass signals via API without exposing account data, offering a privacy-preserving age verification method that eliminates the need for document submission.