Free compliance risk scan
Is your website privacy compliant?
The privacy law that covers your website depends on where you are: PIPEDA in most of Canada, PIPA in Alberta and British Columbia, Law 25 in Quebec. Pick your province and the scan checks your site against the one that applies. It reads up to 10 pages and lists the gaps it can see, each one linked to its legal source. Free and almost instant.
What the scan checks
Seven things it looks for
Each check maps to a specific obligation in the law for your province. When one comes up in your report, it links to the source, so you can read the law yourself instead of taking our word for it.
01
Trackers that run before anyone gets a choice
The scan loads your homepage without clicking anything and watches for analytics and ad trackers (Google Analytics, Meta Pixel, LinkedIn, Hotjar, Clarity and a few others) setting identifying cookies before the visitor has made a choice. Outside Quebec the rules are looser. The federal privacy commissioner accepts opt-out consent for behavioural advertising only where the information isn't sensitive, the notice is clear and tracking isn't a condition of using the site, and Alberta and BC allow an opt-out model on similar terms. So the scan rates this lower than it does under Law 25, but tracking with no notice and no way to opt out doesn't fit any of them.
02
A privacy policy people can find
Under PIPEDA, information about your privacy practices has to be readily available, including who's accountable and how to complain. Alberta and BC ask for written policies you make available on request, and BC's commissioner expects a policy that explains online collection. The scan looks for one in your links and at the usual addresses (/privacy, /privacy-policy, /legal), and flags a policy that's missing or too short to cover the basics. Under PIPEDA it also flags a policy that nothing on the site links to.
03
The tools your policy names
If the scan finds a tracker or a chat widget running on your site (HubSpot, Intercom, Tawk.to and the like), it checks whether your policy mentions it. Under PIPEDA you stay accountable for information you hand to a service provider, including one outside Canada. Alberta requires you to tell people when a provider outside Canada handles their information, and BC expects your policy to name third-party recipients, including ones in other countries.
04
Consent wording on your forms
A form that collects a name or an email needs consent, and consent only counts if the person knows what it's for. Alberta requires you to state the purpose and a contact person at the moment you collect. In BC, consent isn't valid until you've given that notice. The scan reads each form it can see for that wording.
05
A named person in charge of privacy
All three laws require you to designate someone accountable for privacy. PIPEDA expects their name or title and address in the information you publish, and BC requires their title and contact details to be public. The scan looks for a privacy contact on your site.
06
A secure connection
The scan checks that your site uses HTTPS and doesn't load parts of the page over plain HTTP. All three laws require security safeguards for the personal information you hold (PIPEDA scales them to how sensitive it is), and a page that sends form data unencrypted is missing the most basic one.
07
French, in Quebec and New Brunswick
Pick Quebec and the scan runs the Law 25 checks, including the French version the Charter of the French Language requires (the Law 25 page explains those). Pick New Brunswick and it checks for a French version too, and reports a missing one as a recommendation, not as a legal finding.
How it works
01
Enter your site
Your web address, your business or organization name, your province and an email for your copy of the report. Nothing to install.
02
The scan reads it
It fetches up to 10 public pages, including your privacy policy and contact pages when it can find them, and loads your homepage in a browser to see what sets cookies before anyone makes a choice. It usually takes under a minute.
03
You get a risk list
Each risk comes with a severity, a plain explanation and its source in your province's law. The list shows on the page, a copy goes to your email, and you can save it as a PDF for whoever looks after your site.
What the scan can't see
Most checks read the HTML your server sends. A form that a script builds after the page loads can slip past them, and we know because it happened: the scan once reported a site's forms as fine when it couldn't see them at all. We fixed the report so it says exactly what it read.
It also can't see anything behind your website: where the data goes, how long you keep it, your contracts with vendors, what your staff do with it, or how you'd handle a breach. A short list of risks is a good sign. It isn't proof that you comply, and no automated tool can give you that.
If the scan finds something
Compliance Sprint, $447 one time
Several of the risks the scan can flag come back to the privacy policy: there isn't one, nobody can find it, or it doesn't name the tools your site runs. The Sprint fixes that, for whichever law applies to you. We scan your site, compare what we find with your answers to a short intake form, and write a policy that matches what's actually running on it. If your practices change later, an update is a flat $149.
Trackers, form wording and HTTPS are fixes to the site itself, not the policy. If you'd like us to handle those too, say so when you get in touch.
Who runs this
Studio Signal is a small studio in Montreal. We build and run websites for businesses and nonprofits.
Every risk the scan can report traces back to a section of a statute or a regulator's guidance (the federal privacy commissioner, BC's commissioner and others), kept in a source file for each law. When one of those sources changes, we get an alert, and any change to the report wording is reviewed before it goes live.
Common questions
It depends on your province. Alberta and British Columbia have their own private-sector laws (PIPA), and so does Quebec (Law 25). They apply instead of PIPEDA for most of what a business does inside the province, but PIPEDA still covers information that crosses borders and businesses that are federally regulated. Everywhere else, PIPEDA applies to personal information collected in the course of commercial activity.
In BC, yes: PIPA covers every organization, nonprofits included, with no commercial-activity threshold. Under PIPEDA and Alberta's PIPA, a nonprofit is usually outside the law unless it engages in commercial activity (selling or renting its donor or member lists is the federal example). The scan reports the same risks either way, and under PIPEDA the report says how to read them.
Not necessarily an opt-in one. Outside Quebec, opt-out consent can work for tracking: the federal privacy commissioner accepts it for behavioural advertising only where the information isn't sensitive, the notice is clear and tracking isn't a condition of using the site. What doesn't work anywhere is tracking that runs with no notice and no way to say no. If you also do business in Quebec, Law 25's opt-in rule may apply to you as well, and it's the stricter one.
Much lower than Quebec's. The federal privacy commissioner can't fine anyone under PIPEDA. A complainant or the commissioner can take an organization to Federal Court, which can order changes and award damages, and knowingly breaking the breach-reporting rules is an offence with fines up to $100,000. Alberta and BC have no administrative penalties either. Their offence fines go up to $100,000 for an organization, and their commissioners can order you to stop a practice and destroy information collected in breach of the law. Quebec's Law 25 is the outlier, with administrative penalties up to $10 million or 2% of worldwide turnover.
Under PIPEDA, a breach that creates a real risk of significant harm has to be reported to the federal privacy commissioner and to the people affected, and you have to keep a record of every breach, serious or not. Alberta also requires you to report real-risk breaches to its commissioner. BC has no mandatory breach-reporting duty for now. The scan can't check any of this: it's about your procedures, not your website.
Possibly. The last attempt, Bill C-27, died in January 2025. Its successor, Bill C-36, was tabled on June 15, 2026 and was still before Parliament in early October 2026. Until it passes, PIPEDA is the law the scan checks against, and we're watching the bill.
No. It's an automated check of what's visible on your public pages, and it doesn't establish that your site complies or doesn't. For advice on your situation, talk to a lawyer.