Enforcement replays
What a reasonable agent should have refused
Two replays walk published Canadian privacy enforcement decisions step by step; one is built from the regulator's guidance with a fictional scenario. At each step, we ask what a reasonable agent should have refused to do. The scoring comes from the decision or guidance text itself, not from anyone's paraphrase of it.
Replay #1: the e-receipt that fed Meta
OPC PIPEDA Findings #2023-001, Home Depot and Meta Offline Conversions. Why a reasonable agent refuses to activate a server-side e-receipt feed to an ad platform without upfront express opt-in consent. Walk the case.
Replay #2: the banner that accepted itself
Quebec Law 25, section 8.1, and the CAI's guidance on deceptive interfaces. Why a reasonable agent refuses pre-activated profiling trackers and one-sided consent banners. Walk the case.
Replay #3: Facebook and AggregateIQ: when the agent must refuse
OPC PIPEDA Findings #2019-002 (Facebook) and #2019-004 (AggregateIQ). Why a reasonable agent refuses to hand personal information downstream without a verified consent scope and contractual safeguards. Walk the case.