“To serve you better” isn't a disclosure. PIPEDA sets a precision standard, not a good-faith one.
Short answer
Before or at the time you collect a client’s personal information, PIPEDA’s meaningful-consent standard requires telling them, with real precision: what you’re collecting, who else it might be shared with, and why. Where the information is sensitive, or the use falls outside what the client would reasonably expect, that disclosure has to support express consent, not merely implied consent.
Per the Privacy Commissioner’s guidelines for meaningful consent, an organization must make clear, with “sufficient precision for individuals to meaningfully understand” — rejecting vague catch-alls like “service improvement” — three things: what information is collected, with whom it is shared, and for what purposes it is collected, used or disclosed. A fourth element, the risk of harm, must also be disclosed where meaningful residual risk exists — explicitly including “bodily harm, humiliation, damage to reputation or relationships, loss of employment.”
Express consent is required whenever the information is sensitive, when the collection or use falls outside the client’s reasonable expectations, or where there is meaningful residual risk of significant harm. The guidance is explicit there is “no bright line” for what counts as sensitive — health, financial, and similarly personal information are named as presumptively sensitive, but context governs the rest. Implied consent survives only in the narrow remaining band: non-sensitive information, squarely within what the client already expects.
This is exactly the gap that catches agents putting a client’s negotiating position into a third-party AI tool: doing so is a disclosure to a party the client likely never contemplated, which is why CREA’s own AI guidance states plainly that “all use of AI with personal information must continue to comply with applicable privacy law” and directs members to check the vendor’s terms before uploading client data at all. See the fuller AI-and-consent question for the practical mechanics.
PIPEDA’s application does not turn on size — a solo agent collecting so much as a client’s email address is inside the Act, so the ten fair information principles apply the same way to a one-person brokerage as to a national one. See whether PIPEDA applies to a solo agent for the full application test.
See also: can you put client details into an AI tool and does PIPEDA apply to a solo agent.
A 30-minute call is enough to check your intake disclosures against PIPEDA's own test.
