Based on the rules from PIPEDA and CASL, plus the guidance provided by the OPC, we can conclude that: You must provide clear information about cookies at the time of collection. Your cookie notice must not simply be a link to your general privacy policy. You must provide a way for users to opt out of cookies.