AI and privacy at Canadian car dealer­ships: the basics

Buyer information now moves through Messenger, web forms, CRMs, AI chat and follow-up texts. AI doesn't change the rules: Canada's privacy commissioners have said that generative AI tools don't sit outside the privacy laws already in force.

This guide is general information, not legal advice. It summarizes the official sources linked in the text, as of October 2026. Laws change, and your obligations depend on your dealership: ask a lawyer about your own case.

Which law applies to your dealership

According to the Office of the Privacy Commissioner of Canada (OPC), PIPEDA applies to private-sector organizations across Canada that collect, use or disclose personal information in the course of commercial activity, which includes selling vehicles.

Alberta, British Columbia and Quebec have their own private-sector privacy laws, which the OPC describes as substantially similar to PIPEDA. Businesses covered by them are generally exempt from PIPEDA for information handled within the province, but PIPEDA still applies when personal information crosses provincial or national borders in the course of commercial activity.

• Ontario and the other provinces without their own private-sector law: PIPEDA.
• Quebec: the Act respecting the protection of personal information in the private sector, as amended by Law 25, plus PIPEDA for information that crosses borders.
• Alberta and BC: their own provincial laws, not covered here.
• Everywhere in Canada: CASL for commercial texts and emails.

PIPEDA basics for dealers

PIPEDA rests on ten fair information principles, set out in Schedule 1 of the Act. At a dealership, a few do most of the work:

• Say why you collect. Answering about a vehicle, booking a test drive, following up, preparing a financing application.
• Get consent. The Act requires the individual's knowledge and consent to collect, use or disclose personal information, except where inappropriate.
• Collect only what you need. A Marketplace chat doesn't need a date of birth. Credit details belong in your financing process.
• Get rid of what you no longer need. Destroy, erase or anonymize it, as the Act puts it.
• Protect it. Safeguards must match the sensitivity of the information, and employees must know the importance of keeping it confidential.
• Stay responsible for your vendors. You remain responsible for personal information you transfer to a third party for processing, such as a CRM, chat tool or AI service.

Breaches. The OPC says a breach of security safeguards that creates a real risk of significant harm must be reported to the Privacy Commissioner and to the affected people, and a record of every breach must be kept for two years.

Quebec: the private-sector law as amended by Law 25

According to the Commission d'accès à l'information (CAI) (page in French), Law 25 was adopted in 2021 and its new rules came into force in stages from September 2022 to September 2024. For a Quebec dealership, the main points of the Act:

• A person in charge of privacy. By default, the person with the highest authority in the business, who can delegate the role in writing. Their title and contact information go on your website (section 3.1).
• Published policies. Your governance policies, including rules for keeping and destroying information and a complaints process, are described on your website (section 3.2), along with a privacy policy if you collect through a web form or chat (section 8.2).
• Inform at collection. Tell buyers the purposes, the means, their rights of access and correction, their right to withdraw consent and, where applicable, whether the information could go outside Quebec (section 8).
• Consent for each purpose. Clear, free and informed, requested for each specific purpose in simple language (section 14).
• No prospecting without consent. Information is used for the purposes it was collected for unless the person consents or an exception applies, and the Act says commercial prospection is not a consistent purpose (section 12). Before marketing to a buyer beyond what they asked about, check that you have consent.
• Need-to-know access. Employees access personal information without consent only if their duties require it (section 20).
• Destroy when done. Once the purposes are achieved, destroy the information or anonymize it under the regulation, subject to retention periods set by law (section 23).
• Confidentiality incidents. If there's a risk of serious injury, promptly notify the CAI and the people concerned, and keep a register of all incidents (sections 3.5 and 3.8).

Under section 90.12, administrative monetary penalties for a business can reach $10 million or, if greater, 2% of worldwide turnover for the preceding fiscal year.

Decisions made by automated processing alone

Section 12.1 is the rule people usually mean by "Law 25 and AI." A business that uses personal information to make a decision based exclusively on automated processing must tell the person no later than when it informs them of the decision. On request, it must also say which information was used, the reasons and principal factors behind the decision, and that the person can have the information corrected. The person must be able to submit observations to a staff member who can review the decision.

So ask of every tool: does it decide anything about a person on its own? A system that automatically declines a financing application would bring this rule into play. A chat that gathers answers and passes the lead to your team, where a person decides, is a different situation. If you're unsure, ask the vendor how the tool works, and ask your lawyer.

DriveGood AI asks buyers about financing, but it doesn't approve credit, set prices or negotiate. Those decisions stay with your team and your lenders.

Before you adopt a new AI tool in Quebec

The Act requires a privacy impact assessment, proportionate to the sensitivity of the information, for any project to acquire, develop or overhaul an information system involving personal information (section 3.3). A new CRM, chat or AI tool can qualify. If information will be communicated outside Quebec, including to a provider that keeps or uses it there for you, an assessment and a written agreement come first (section 17). A provider that handles personal information for you needs a written mandate that spells out the confidentiality measures (section 18.3).

CASL: the rules for follow-up texts and emails

CASL covers commercial electronic messages sent to an electronic address, which the Act defines to include email, instant messaging and telephone accounts. The CRTC's CASL FAQ confirms this includes text messages and lists three requirements:

• Consent. Express consent doesn't expire until it's withdrawn. Implied consent exists only in specific cases: under section 10 of the Act, a purchase or lease within the past two years, or an inquiry or application within the past six months, creates an existing business relationship (see the CRTC's guidance on implied consent). A request for express consent must state its purpose, identify who is asking and say the person can withdraw consent, and the CRTC says a pre-checked box can't be used to get it.
• Identification. Your dealership's name, a mailing address and a phone number, email or web address. If that doesn't fit in a text, the regulations allow a clear link to a web page that has it.
• Unsubscribe. An easy opt-out in every message, processed without delay and no later than 10 business days after the request.

Under the Act, a message that only provides a quote the buyer asked for doesn't need consent, but still needs identification and an unsubscribe. The CRTC adds that the sender must prove consent, and that penalties can reach $1 million per violation for individuals and $10 million for businesses.

For a follow-up plan built on these rules, see how to use AI to follow up with car buyers.

Practical rules for using AI with buyers' information

1. Keep private customer data out of general AI tools. Names, phone numbers, addresses, driver's licence details, credit applications and income stay out of ChatGPT, Gemini, Copilot or Meta AI. Write "the buyer" and use only vehicle details. In their principles for generative AI, Canada's privacy commissioners ask organizations to use anonymized or de-identified information in prompts where possible, and to enter personal information only where authorized. Our guide to ChatGPT for car dealers shows what to use it for instead.
2. Keep conversations in your DMS. Not on a personal phone, a personal Messenger account or an AI tool's chat history. One record per lead lets you answer access requests, prove consent and delete what you no longer need.
3. Decide who sees what. Salespeople see their leads, the finance manager sees financing documents, and access ends the day someone leaves.
4. Check every AI output before a buyer sees it. Prices, kilometres, options, financing terms. The commissioners also ask organizations to take reasonable steps to make sure generative AI outputs are accurate.
5. Be open with buyers. The same principles ask organizations to make sure people know when they're interacting with a generative AI tool. Decide how your dealership handles this, and answer honestly when a buyer asks.
6. Read your vendors' terms. Where is the data kept, who sees it, and what happens to it when the contract ends?

Where DriveGood AI fits

DriveGood AI follows two fixed rules, and one of them is about privacy:

Every conversation it has with a buyer is saved with the lead in your DMS, so your team can read exactly what was said (see the Drive Good DMS). Dealers never log in to DriveGood AI; you see leads, booked test drives and reports. See how it handles lead qualification and lead follow-up.

No AI tool, DriveGood AI included, makes a dealership compliant on its own. Your privacy policy, consent records and person in charge of privacy remain your responsibility. Read Drive Good's privacy policy, see how DriveGood AI approaches responsible AI, or compare it with a general AI assistant.