What the law actually asks of a REALTOR® website.

01PIPEDA — the one that governs your leads

• Canada's federal privacy law applies to you the moment your site collects a name and an email. It is not onerous, and it comes down to a few things you can actually check.
• Say what you collect and why. A privacy policy that a person could read and understand, not a wall of boilerplate.
• Collect only what you need. A contact form asking for a budget, a timeline and a mortgage pre-approval before someone has spoken to you is collecting for its own sake.
• Say if information leaves Canada. Almost every site relies on providers that process data elsewhere — a security network, an email service, analytics. If yours does, your policy should say so plainly.
• Let people ask what you hold, and delete it. You need a route for that, even if it is just an email address that reaches you.

Alberta has its own provincial act, PIPA, that runs alongside PIPEDA. In practice a policy that satisfies one is close to satisfying the other, but it is worth naming both if you practise here.

02CASL — the one with real penalties

• Canada's anti-spam legislation is stricter than most people expect, and the fines are not theoretical.
• Consent has to be given, not assumed. A pre-ticked box is not consent. Somebody handing you a card at an open house is not consent to a monthly newsletter.
• Every commercial email needs your identity and a working unsubscribe, and the unsubscribe has to be honoured promptly.
• Keep the record. If you cannot show when and how somebody consented, you cannot rely on it.
• This is exactly why listing alerts should be double opt-in: the subscriber confirms by email, and that confirmation is your record.

The open-house sign-in sheet is the usual weak point. A paper list of names is not a mailing list, and treating it as one is the most common CASL mistake in this business.

03Cookies and analytics consent

• Canada does not have a cookie law as prescriptive as Europe's, but the direction of travel is clear and Google's own tools now expect a consent signal.
• Analytics should wait for a choice. Load tracking only once a visitor has accepted, and pass the refusal through rather than ignoring it.
• A banner should not hold the page hostage. A dismissible notice that remembers the answer is enough; a full-screen wall is both bad manners and bad for conversion.
• Link the policy from the banner, so someone who wants the detail can find it.

04CREA's rules, which are separate again

• Displaying MLS® listings brings its own set of obligations, and they sit with you as the DDF® participant rather than with whoever built the site. The DDF® guide covers them in full — the trademark statement, the REALTOR.ca link on each listing, the brokerage name, the watermarks, the required notices, the refresh cadence and the reporting.
• The point worth repeating here: CREA can suspend access for rule violations, and a suspension takes your listings down. That is not a compliance abstraction, it is your website going blank.

05What this looks like on a PropertyConnector site

• A starter privacy policy written for a real estate site, which you review and make your own. It is a template, not legal advice, and it says so.
• A consent banner wired to analytics, so a refusal actually stops the tracking rather than just hiding the notice.
• Double opt-in on listing alerts, with the confirmation kept as your consent record, plus one-click unsubscribe.
• The CREA display requirements handled — trademark statement, Terms page, REALTOR.ca badge, brokerage identification and activity reporting.
• A route for access and deletion requests, so you are not improvising when one arrives.

We are not lawyers and this is not legal advice. It is what we have learned building compliant sites, and the parts we have automated because getting them wrong is expensive.