eCommerce & Marketplaces Compliance in Canada

Canada is open to online marketplaces and e-commerce sellers without a sector licence. The obligations come from tax law, consumer protection law, competition law, privacy law and product-specific age restrictions, split between federal and provincial governments.

The principal authorities are the Canada Revenue Agency for seller reporting and sales tax, the Competition Bureau for pricing and advertising, and the Office of the Privacy Commissioner of Canada for personal information. Provinces regulate consumer contracts and set minimum ages for alcohol, cannabis and tobacco.

The biggest practical obstacle for a new marketplace is the seller due diligence regime under Part XX of the Income Tax Act: it applies to non-resident platforms with Canadian sellers, requires verified tax identification data, and carries daily late-filing penalties.

1. Who regulates this sector

E-commerce has no single regulator: federal agencies set tax, competition, privacy and product rules; provinces regulate consumer contracts and age-restricted retail.

Provincial consumer ministries and liquor and cannabis authorities also have roles. Where a marketplace holds or pays out funds, the Bank of Canada and the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) may have jurisdiction.

2. Licensing and authorisation

No federal sector licence is needed. Registrations depend on the model:

CRA accounts

A reporting platform operator must obtain a business number and an information returns (RZ) program account before filing its first Part XX return; non-residents file through a Web Access Code. A distribution platform operator that crosses the $30,000 GST/HST threshold must register under the normal GST/HST regime.

Payments

Marketplaces that hold and pay out seller funds should assess whether that is a payment function not incidental to their business (Retail Payment Activities Act) or funds remittance (PCMLTFA).

Age-restricted goods

Cannabis may be sold only as authorised under the Cannabis Act and provincial law; a general marketplace cannot list it.

Unauthorised cannabis sales carry up to 14 years' imprisonment (Cannabis Act, s. 10(5)).

3. Identity framework (AML rules do not apply)

Online marketplaces and e-commerce sellers are not reporting entities under section 5 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). A platform enters that regime only if it carries on a listed business in its own right, such as remitting funds or dealing in virtual currencies (s. 5(h)); selling goods or connecting buyers and sellers does not.

The identity framework that does apply:

Seller due diligence (tax)

Part XX of the Income Tax Act (sections 282 to 295, in force 1 January 2024) requires reporting platform operators to identify sellers, verify the information and report it annually. It is the sector's closest equivalent to know-your-customer rules.

Buyer age checks

Laws on tobacco, vaping and cannabis make verified identification the defence. There is no general duty to identify buyers.

Product traceability

Anyone who sells a consumer product for commercial purposes must keep records of who supplied it for six years and report safety incidents to Health Canada within two days (Canada Consumer Product Safety Act, ss. 13 and 14).

Consumer contract identity

Québec and Ontario require the merchant to disclose its own identity, address and contact details before a distance or internet contract is concluded, so buyers know who they are dealing with.

4. Identity verification and onboarding

Who must verify sellers

A platform is software, including websites and apps, that connects sellers with users for the sale of tangible goods or for personal services and rentals; pure payment processors, classified boards and redirect sites are excluded. Operators resident in Canada are covered, as are operators outside Canada and its partner jurisdictions that serve sellers resident in Canada. According to the CRA guidance (2 December 2025), an operator based in a partner jurisdiction may instead elect to report to Canada.

Data to collect

The TIN or business registration number need not be collected where the seller's jurisdiction does not issue one; Canadian entities provide their business number, as Canada does not issue separate registration numbers. Where the operator relies on a government verification service to establish identity and residence, the address, TIN and date of birth need not be collected (s. 284(3)).

How to verify

The operator must determine whether the information is reliable using all records available to it and any publicly available electronic interface for validating the TIN (s. 285(1)). Where information from the CRA indicates that an item may be inaccurate, the operator must verify it with reliable, independent-source documents, data or information (s. 285(3)). The rules do not prescribe a method such as document checks or liveness.

Timing, reliance and refresh

Due diligence must be completed by 31 December of each reportable period (s. 288(1)). Earlier due diligence can be reused only if the primary address was verified or confirmed within the last 36 months and nothing suggests the data is wrong (s. 288(3)). A third-party service provider may perform the checks, but the obligation remains with the operator (s. 290).

Buyer age verification

Where a buyer's age matters, Canadian law tends to place the check at the point of delivery rather than at checkout. Under section 9 of the Tobacco and Vaping Products Act, no one may send or deliver a tobacco or vaping product to a person under 18. The sender's defence requires it to tell the courier what the parcel contains and instruct it to examine government-issued identification showing the recipient's name, photograph, date of birth and signature. The courier's defence requires it to have examined that identification and believed it authentic. The Cannabis Act allows a defence to selling cannabis or cannabis accessories to a young person only where the seller took reasonable steps to ascertain the buyer's age (ss. 10(3) and 32(2)). Provinces set higher minimum ages:

5. Digital channels: what's different

Bottom line: seller verification is an online-only obligation: the CRA guidance excludes sellers and buyers who connect through a physical location. Online sales also carry contract disclosure and delivery-time age checks that a shop counter does not.

Age checks move to the doorstep

For remote sales of tobacco and vaping products, section 9 requires the courier to examine identification at handover; an age gate at checkout is not, by itself, the defence. Québec goes further and bars online retail sales of these products altogether.

Distance contract rules

Ontario's Consumer Protection Act, 2002 requires prescribed disclosure before an internet agreement worth more than $50 (O. Reg. 17/05, s. 31), an express opportunity to accept, decline or correct errors, and a written copy afterwards (ss. 38 and 39); failure gives the consumer cancellation rights of seven or 30 days (s. 40). Québec's Consumer Protection Act sets out a longer list of disclosures, including any fees a third party may charge, such as customs duties (s. 54.4), and bars collecting payment before delivery unless the consumer can request a chargeback (s. 54.3).

What is changing

Bill S-209 [Bill, not enacted] would require commercial pornography sites to use prescribed age-verification or age-estimation methods. Bill C-34, the Safe Social Media Act [Bill, not enacted], targets social media services. Neither applies to general marketplaces today.

6. Data protection and biometrics

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to commercial activity except where a substantially similar provincial law applies.

Seller tax numbers. A reporting platform operator must not knowingly use or communicate a seller's TIN other than as the Income Tax Act requires or authorises, without the seller's written consent (s. 293(2)). Records gathered for Part XX must be kept for at least six years after the last year to which they relate, in electronically readable form (s. 294).

Biometrics. The Office of the Privacy Commissioner's Guidance for processing biometrics, for businesses (adopted, modified 11 August 2025) treats biometric information that can uniquely identify a person as sensitive, says express consent will generally be the appropriate form of consent, and requires alternatives where biometrics are not integral to the service.

Age assurance. The Commissioner's guidance Assessing whether and how to use age assurance (4 May 2026) expects websites to use age assurance only where a legal requirement or a child-specific harm justifies it, and in proportion to the risk. It accepts that biometric age estimation or government ID checks may be appropriate where the law requires a minor to be kept out. Results must not be reused for other purposes, such as advertising profiles, and users denied access must have an appeal mechanism. Comments closed on 4 August 2026; amendments are possible.

Québec. The Act respecting the protection of personal information in the private sector treats biometric information as sensitive, so express consent is needed to use it beyond its original purpose (s. 12). Consent for a child under 14 is given by the parent or tutor (s. 14). Privacy impact assessments are required for new systems (s. 3.3) and before sending data outside Québec, for example to a foreign verification provider (s. 17). Under the Act to establish a legal framework for information technology, biometric identity verification requires express consent and prior disclosure to the Commission d'accès à l'information, using the minimum characteristics needed, with destruction once the purpose is met (s. 44); a biometric database must be disclosed at least 60 days before it goes live (s. 45).

7. Sector-specific obligations

Platform reporting on sellers

Each reporting platform operator files a Part XX information return by 31 January for the previous calendar year and gives each reportable seller a copy of its own information by the same date (s. 291). The return covers each seller's identification data, financial account identifiers where available and required, total consideration and number of activities per quarter, and fees, commissions or taxes withheld (s. 292). Governmental and publicly traded entities are excluded, as are sellers of goods with fewer than 30 sales totalling no more than $2,800 in the year (CRA guidance, paragraph 3.7). No nil return is required. An operator may rely on another platform operator to report the same sellers only with adequate assurances, such as a written agreement (s. 291(3)).

GST/HST for distribution platforms

Since 1 July 2021, the Excise Tax Act makes distribution platform operators collect GST/HST on supplies of qualifying goods (for example goods in a Canadian fulfilment warehouse) made through their platforms by vendors that are not registered under the normal regime. The threshold is $30,000 over 12 months. The related information returns under sections 211.21 and 211.25 [Waived until further notice] are not currently required by the CRA.

Price display

Under sections 52(1.3) and 74.01(1.1) of the Competition Act, representing a price that cannot be attained because of fixed mandatory fees is false or misleading, unless the fees are taxes or charges imposed by statute. The Competition Bureau's guidance adds that variable fees can also raise concerns. In Kuling v. Ticketmaster, 2026 FC 1185 (22 September 2026; under appeal, Federal Court of Appeal file A-372-26), the Federal Court refused to certify a class action and held that section 52(1.3) does not impose all-inclusive pricing: fees shown separately but at the same time are not drip pricing (para. 119). Bureau cases against DoorDash and Canada's Wonderland continue. Québec's Consumer Protection Act separately requires the advertised price to include everything the consumer must pay, other than GST and QST (s. 224(c)).

Consumer contract reform in Ontario

The Consumer Protection Act, 2023 [Adopted, effective date not yet set] will replace the 2002 Act on a day to be named by proclamation. Until then, the 2002 Act's internet agreement rules apply.

8. Risk indicators and red flags

The indicators below come from Part XX, the CRA guidance and the Competition Bureau's Little Black Book of Scams.

Seller identity and reporting red flags

• TIN that fails validation: a number that does not pass the issuing jurisdiction's electronic check or does not match the seller's name.
• Home and billing address mismatch: the CRA treats the residence, not the billing address, as the primary address.
• Payout account in another name: consideration paid to an account held by someone other than the seller, which Part XX requires to be reported.
• Sales split to stay under thresholds: related accounts each kept below 30 sales or $2,800, which section 295 disregards.
• CRA notice of inaccurate data: triggers re-verification with independent-source evidence.
• Changed address or contact details: ends reliance on earlier due diligence.
• Prices far below market from new sellers: the Competition Bureau warns that fraudsters open marketplace accounts to sell counterfeit or non-existent goods.
• Requests to pay off-platform: removes buyer protection.
• Buyer overpayment and refund request: a classic scam against sellers using counterfeit payment instruments.

9. Enforcement and penalties

In the leading online case, the Competition Tribunal found on 23 September 2024 that Cineplex's mandatory $1.50 online booking fee was drip pricing and ordered a penalty of more than $38.9 million, equal to the fees collected; the Federal Court of Appeal dismissed the appeal on 21 January 2026. The Bureau's case against DoorDash (June 2025), alleging drip pricing and fees presented as taxes, is ongoing, and in June 2024 it obtained a second court order in an investigation into Amazon claims that may be influenced by reviews and ratings (Bureau cases and outcomes).

10. Recent changes and what to watch

• 21 October 2026: Bill C-34, the Safe Social Media Act, debated at second reading [Bill, not enacted]. Platforms with social features should track whether regulations extend its age-assurance duties to them.
• 24 September 2026: Senate Bill S-209 on online access to pornographic material debated at second reading in the House of Commons after passing the Senate on 15 April 2026 [Bill, not enacted]. Relevant to marketplaces selling or hosting adult content.
• 15 June 2026: Bill C-36, which would replace the privacy part of PIPEDA with a Protecting Privacy and Consumer Data Act, introduced [Bill, not enacted]. It remains at second reading; current privacy law still applies.
• 4 May 2026: the Privacy Commissioner published age assurance guidance for websites and for developers [Guidance published]. Comments closed on 4 August 2026 and amendments are possible; it sets the privacy baseline for any age check a marketplace deploys.
• 1 October 2026: Kuling v. Ticketmaster appealed [Under appeal]. The outcome will shape how fees may be shown.
• 21 January 2026: the Federal Court of Appeal upheld the Cineplex drip pricing penalty [Final].
• Ontario Consumer Protection Act, 2023: enacted in 2023 [Adopted, effective date not yet set]. Online contract terms will need review once a proclamation date is set.

11. What this means for identity verification

Verify sellers, not every buyer. Seller due diligence is the legal driver; capture the Part XX data set before enabling payouts.

Build in refresh triggers. Re-confirm addresses every 36 months, re-verify on changes of address or contact details, and keep records for six years.

Keep buyer age checks proportionate, following the Privacy Commissioner's guidance.

Handle biometrics as sensitive data. Obtain express consent, offer an alternative and, in Québec, declare the system to the Commission first.

Plan for provincial variation. Configure age thresholds (18, 19 or 21), product availability and contract disclosures by the buyer's province, and validate seller data with document and registry checks.