Cross-border PPC, targeting US buyers from Canada under two privacy regimes

What to take away

Comparing PIPEDA with US state privacy laws for cross-border PPC

The Personal Information Protection and Electronic Documents Act (PIPEDA) sets the floor for how a Canadian business handles personal information in commercial activity. It applies to your ad accounts, your CRM, your lead forms and your retargeting lists, even when the person on the other end lives in Ohio.

The Privacy Commissioner of Canada publishes the ten fair information principles that underpin it: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure and retention; accuracy; safeguards; openness; individual access; and challenging compliance. Read them as the baseline you cannot opt out of by moving a server.

US state privacy laws work differently. There is no single federal statute. California's Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), came first, followed by Virginia's Consumer Data Protection Act (VCDPA), Colorado's Privacy Act (CPA), Connecticut's Data Privacy Act (CTDPA) and Texas' Data Protection and Security Act (TDPSA). Each applies only above its own revenue and consumer-count thresholds, so check the figure in each statute you might fall under before assuming you are outside it.

Most centre on rights: to know, to delete, to correct, and to opt out of targeted advertising or sale of personal information. That shape is different from PIPEDA, which is duty-led rather than rights-led.

The practical consequence for a Canadian advertiser is that a single campaign can trigger two compliance logics. Your Canadian office owes PIPEDA-style accountability for the data it holds. Your US-facing ad activity may owe state-specific notices and opt-out mechanisms to residents of particular states.

The comparative privacy background for cross-border tracking is worth understanding before you build anything. The EU's General Data Protection Regulation is often used as the reference point, and it is stricter than either regime you actually face.

Where the two regimes overlap is in purpose limitation. PIPEDA expects you to collect personal information for a reasonable purpose and not quietly repurpose it. US state laws expect you to disclose your purposes in a privacy notice and honour opt-outs when someone objects to targeted advertising.

If your pixel fires on a checkout page and the data flows into an audience you later use for prospecting, both regimes have something to say about it.

Quebec adds a provincial overlay on the Canadian side rather than a third regime in the comparison. Law 25, administered by the Commission d'accès à l'information, imposes consent and transparency duties that go further than PIPEDA in several respects, including privacy impact assessments and default deactivation of certain tracking technologies. If your team sits in Montreal, your internal standard may already be higher than what a US state requires.

One more body matters here: the Competition Bureau Canada enforces misleading advertising provisions under the Competition Act. Privacy compliance does not cover you if the ad claim itself is deceptive. Keep the two workstreams separate in your review process.

What PIPEDA actually asks of an ad account

That last item is where most Canadian teams slip. The platform is a processor for your data, but accountability for it stays with you.

Targeting settings for Canadian firms advertising to American buyers

Targeting settings are where compliance becomes operational. The first decision is location targeting, and the wording you click matters: Google Ads offers "Presence: People in or regularly in your targeted locations" against "Presence or interest: People in, regularly in, or who've shown interest in your targeted locations," while Meta offers "People living in this location" against "People living in or recently in this location." Pick the presence-only option, include the United States, and exclude Canada explicitly. Which option you choose changes who sees the ad and, in some cases, whether a state law applies to that impression.

Language and currency settings come next. Serving USD pricing to a Canadian visitor who wandered into the campaign creates a bad experience and muddies your conversion data. Segment by market so that currency, shipping terms and return policy match the buyer's location.

Audience exclusions deserve more attention than they usually get. If you have built a Canadian customer list and you upload it as a seed for a US lookalike, you have moved Canadian personal information into a US platform for a purpose the customer did not agree to.

Build the seed from US customers only, or get consent for the broader use.

Conversion tracking is the next trap. A Canadian firm running US campaigns often has one pixel firing across both domains, so Canadian visitors generate US-attributed events. Separate pixels or separate conversion actions per market keep the numbers honest, and they make paid media strategy development far easier to apply later.

Remarketing windows should differ by market too. US state opt-out regimes expect you to stop targeted advertising when someone objects, and long windows make that harder to honour. Shorter windows reduce exposure and usually perform better anyway.

Finally, review the platform's own restricted categories. Financial services, health claims and employment ads carry extra rules in the US that do not map neatly onto Canadian standards. Advertising Standards Canada and IAB Canada publish guidance that helps, but the platform policy is what gets your ad rejected.

A worked example: one campaign, two markets

Suppose a Toronto SaaS firm sells a scheduling tool to clinics in Ontario and Michigan. The structure below keeps the two markets from contaminating each other.

Two campaigns, two sets of settings, one reporting view that never mixes them.

Cross-border tax treatment of ad spend and management fees

Tax is where cross-border PPC stops being a marketing question. Start with GST/HST. Advertising services supplied to a Canadian business are generally subject to GST/HST, so the platform charges it and you claim it back as an input tax credit if you are registered and the expense is for commercial activity.

The Canada Revenue Agency sets out the GST/HST rebate rules, including the distinction between input tax credits and rebates for amounts you were charged in error or on non-commercial activity.

Google, Meta and other large platforms are registered for GST/HST in Canada, so you will see the tax on the invoice. That is a cash flow item, not a permanent cost, provided you are registered and claiming correctly.

The claiming GST/HST on Google Ads process is worth following closely, because the platform's billing entity and your registration status both affect what you can recover.

Management fees are different. If you pay a Canadian agency to run the campaigns, the agency charges GST/HST on its fee. If you pay a US agency, the place of supply rules determine whether Canadian tax applies, and self-assessment may be required.

This is where a bookkeeper who has not seen cross-border ad spend before will get it wrong.

US state sales tax on digital advertising is a moving target. Maryland taxes digital advertising gross receipts, while most states exempt advertising services and others keep debating new taxes; definitions and thresholds change with each legislative session. If your platform bills you from a US entity and you have nexus in a taxing state, exposure can appear.

Most Canadian advertisers never hit the threshold, but SaaS firms with US subsidiaries or US-based staff should check.

There is a policy overlay in 2026. British Columbia has published its B.C.'s response to unjustified US tariffs, which affects cross-border business planning and, indirectly, how Canadian firms budget US market entry.

Tariff uncertainty does not change your GST/HST obligations. It does change how much you commit to US campaigns in a given quarter.

Federal trade supports for exporters are catalogued in the Canada-United States overview, which is worth a read before you open a new state market.

Keep the tax question in your paid media strategy rather than treating it as an afterthought. The difference between a recoverable input tax credit and an unrecoverable cost changes the true cost per acquisition, and that number should feed your budget decisions.

Input tax credit or rebate

Consent and opt-out signals that differ between the two regimes

Consent under PIPEDA is meaningful, informed and tied to a purpose. It can be express or implied depending on sensitivity and context, and it can be withdrawn. Opt-out under US state laws works differently: processing is often allowed until the person objects, and the objection must be honoured across the businesses you share data with.

That difference matters for ad tracking. Under PIPEDA, dropping a pixel that builds a profile for advertising usually needs a consent basis, and the OPC expects you to be able to explain it. Under a US state law, you may run the same pixel provided you give notice and an opt-out, typically a "Do Not Sell or Share My Personal Information" link on your site and a route for an authorized agent to submit the request. You must also honour a global opt-out signal.

Global Privacy Control is the clearest example. It is a browser signal that expresses an opt-out of sale or sharing. Some US states require you to honour it. PIPEDA does not, but honouring it anyway is simpler than maintaining two tracking stacks.

It also reduces the risk that a Canadian visitor's signal is ignored while a US visitor's is respected.

Consent management platforms help, but they do not decide your legal basis. A banner that defaults to on does not produce valid consent under PIPEDA in most cases. A banner that only appears to US visitors leaves Canadian visitors unaddressed. Configure the platform by market, and log what each visitor saw.

Email and SMS consent sit on separate rules again. Canada's Anti-Spam Legislation (CASL) requires express or implied consent with specific identification and unsubscribe requirements, and the CRTC enforces it. US rules differ, and a single signup form rarely satisfies both. If your paid campaigns drive to a lead form, the form itself is part of the compliance surface.

Data transfer and processor terms in ad platform contracts

When you upload a customer list or fire a pixel, you are transferring personal information to a platform. Under PIPEDA, you remain accountable for that information even after it leaves your systems. That means the contract terms matter: what the platform may do with the data, how long it keeps it, and what happens when you terminate.

Most ad platforms position themselves as processors or service providers for advertiser data, with the advertiser as controller. Read that clause carefully. It usually means the platform will not use your uploaded list for its own purposes, but it also means you carry the obligations for lawful collection and notice.

The platform will not defend you if the list was collected without consent.

Data transfer terms also cover where processing happens. Data may be stored or processed in the United States or other countries, and cross-border transfer provisions in the contract describe the safeguards. PIPEDA does not prohibit transfers, but it expects comparable protection and transparency about the transfer in your privacy policy.

US state laws add contract requirements of their own. California, Virginia, Colorado, Connecticut and Texas all require specific terms in contracts with processors, covering the nature of processing, the types of data, and audit rights. If your platform's standard terms do not include them, you may need a negotiated addendum, and many platforms now publish one for state-law compliance.

For a fuller picture of how data moves through ad systems, paid media attribution covers the same transfer paths from the measurement side.

Retention and deletion terms deserve a calendar reminder. If the contract says the platform deletes your audience data after a set period of inactivity, verify it. Audiences that linger past their purpose are a liability in both regimes.

Questions to ask before you sign or renew

Structuring accounts so US and Canadian audiences stay separate

Account structure is the cheapest compliance control you have. Separate accounts or at least separate campaigns per market make it obvious which data belongs where, and they stop a Canadian audience from being used to target US buyers without a consent basis.

Start with the business manager or admin structure. If one business manager holds both Canadian and US pixels, both customer lists and both conversion actions, every new team member inherits access to all of it. Splitting by market limits the blast radius of a mistake and makes offboarding cleaner.

Naming conventions are not glamorous, but they are how you audit later. A prefix that states market, then channel, then objective lets you filter every report by regime. Without it, you will be guessing which campaigns carried Canadian consent and which did not.

Reporting should follow the same split. Blended dashboards hide the fact that two markets with two rulebooks are being measured as one. Separate views, then a rolled-up view that labels the split, give you the operational picture and the honest total, and they let you optimize each market against its own benchmarks instead of a blended average.

If you run programmatic advertising alongside search and social, the same logic applies to deal IDs and audience segments. Programmatic supply chains have more intermediaries, so the data transfer terms get longer, and the market split becomes more valuable, not less.

Finally, document the structure. A one-page diagram showing which pixel, which list and which consent basis belongs to which market will save hours when someone new joins or when a regulator or platform asks a question. Attribution work gets easier too, because the market split is already in the data model rather than reconstructed after the fact.

A short checklist for the split

Common questions