Canadian Dealership Compliance Guide: Navigating Provincial Regulations in 2026
TLDR: Canadian dealerships face a tightening patchwork of provincial regulations, federal privacy laws, and anti-spam rules – non-compliance carries penalties ranging from $25,000 to $25 million depending on the violation and jurisdiction.
- All-in pricing is Ontario’s most common MVDA violation – a 2025 CBC Marketplace investigation found 40% of tested GTA dealerships charged more than their advertised price
- Vehicle disclosure thresholds vary by province: $3,000 in Ontario and Manitoba, $2,000 in BC, 20% of asking price in Saskatchewan – missing a single required disclosure can trigger deal rescission
- CASL imposes penalties up to $10 million per violation for organizations; implied consent expires after 24 months from a transaction or 6 months from an inquiry, and consent is channel-specific (email consent does not cover SMS)
- Quebec’s Law 25 carries penalties of up to $25 million or 4% of worldwide turnover, requires 72-hour breach notification, mandatory Privacy Impact Assessments, and applies to any organization handling Quebec residents’ data
- PIPEDA requires mandatory breach reporting, 24-month breach record retention for all incidents regardless of severity, and compliance with 10 fair information principles
- Ontario’s OMVIC launched mandatory CPD on April 1, 2026 – all registered dealers and salespersons must complete it before their license renewal starting July 1, 2026
Canada’s 3,200 franchised dealerships employ between 140,000 and 160,000 people and contribute roughly $28 billion to GDP annually. That scale comes with regulatory obligations that vary by province, overlap at the federal level, and change faster than most dealers can track. For an overview of the provincial regulators and federal laws every Canadian dealer needs to understand, see our pillar guide: Canadian Dealership Compliance.
In 2026, the compliance landscape is tightening. Ontario’s OMVIC launched mandatory Continuing Professional Development on April 1. Quebec’s Law 25 privacy regime now carries penalties of up to $25 million. And a CBC Marketplace investigation in late 2025 found that 6 of 15 GTA dealerships charged more than their advertised prices, putting all-in pricing enforcement squarely back in the spotlight.
This guide breaks down what Canadian dealers need to know across every major compliance domain, from provincial licensing and vehicle disclosure to federal privacy and anti-spam rules.
Provincial Regulatory Bodies: Who Governs What
Each province has its own motor vehicle dealer regulatory body, each with different rules, enforcement powers, and penalty structures. Here are the major ones:
Ontario – OMVIC
The Ontario Motor Vehicle Industry Council regulates all registered motor vehicle dealers and salespersons in Ontario. OMVIC operates under the Motor Vehicle Dealers Act (MVDA) and has among the most prescriptive disclosure and advertising rules in Canada. Penalties can reach $25,000 for discipline fines and $250,000 for prosecutions. OMVIC also administers a Compensation Fund that pays up to $45,000 per consumer claim when a registered dealer fails to meet their obligations.
Alberta – AMVIC
The Alberta Motor Vehicle Industry Council enforces the Consumer Protection Act and the Automotive Business Regulation. AMVIC issued approximately $300,000 in penalties during the 2024-2025 period and has a distinctive enforcement tool: its investigators are peace officers who can lay Criminal Code charges, not just regulatory penalties.
British Columbia – VSA
The Vehicle Sales Authority of BC oversees dealers under the Motor Dealer Act. BC’s disclosure regime is notable for requiring dealers to disclose any “material facts” about a vehicle, regardless of dollar amount, in addition to a formal $2,000 damage threshold.
Saskatchewan – FCAA
The Financial and Consumer Affairs Authority regulates dealers under The Motor Dealers Act. Saskatchewan uses a unique disclosure threshold tied to 20% of the asking price, which scales with vehicle value.
Manitoba – MPI / Consumer Protection Office
Manitoba’s framework involves both Manitoba Public Insurance and the Consumer Protection Office, which administers The Consumer Protection Act. The province uses a $3,000 damage disclosure threshold.
Quebec – OPC
The Office de la protection du consommateur enforces the Consumer Protection Act (CPA) alongside Quebec’s own privacy legislation. Quebec’s regulatory environment is the most distinct in Canada, operating under civil law rather than common law, with language requirements that add another layer of complexity.
Vehicle Disclosure Requirements by Province
Disclosure is where provincial rules diverge the most and where non-compliance carries the greatest risk. A vehicle sold in Ontario with undisclosed damage history that would have been legal to omit in Saskatchewan can generate a regulatory complaint, a Compensation Fund claim, and reputational damage.
Damage Disclosure Thresholds
| Province | Threshold | Notes |
|---|---|---|
| Ontario | $3,000 | 22+ mandatory written disclosures |
| British Columbia | $2,000 | Plus any material facts regardless of amount |
| Saskatchewan | 20% of asking price | Scales with vehicle value |
| Manitoba | $3,000 | Aligned with Ontario threshold |
| Alberta | Varies | AMVIC requires material fact disclosure |
Ontario’s 22+ Mandatory Disclosures
Ontario is the most prescriptive province. Dealers must provide written disclosures that include, at minimum:
- Vehicle Identification Number (VIN)
- Odometer reading and any discrepancies
- Branded title status (salvage, rebuilt, irreparable)
- Accident and damage history exceeding $3,000
- Out-of-province registration history
- Whether the vehicle was used as a rental, taxi, police, or emergency vehicle
- Lien status
- Material mechanical defects known to the dealer
Missing even one of these on a used vehicle transaction can result in an OMVIC complaint. The standard remedy is rescission of the sale, which means unwinding the entire deal.
National Vehicle Branding
Vehicle branding – the classification of a vehicle as salvage, rebuilt, or irreparable – is tied to the VIN at the national level through the Canadian Vehicle Information Exchange (CVIE). A vehicle branded in one province carries that brand nationally. Dealers cannot circumvent a brand by registering a vehicle in a different province.
This matters particularly for inter-provincial sales. A vehicle purchased at auction in Alberta that was branded as rebuilt in Manitoba will carry that brand when titled in Ontario. Dealers who fail to check and disclose brand status face penalties in every jurisdiction.
All-In Pricing: Ontario’s Most Common Violation
All-in pricing – the requirement to advertise the full price a consumer will pay, excluding only HST and licensing fees – is the single most commonly violated provision of the Motor Vehicle Dealers Act in Ontario.
What Must Be Included
The advertised price must include:
- All dealer fees (administration, documentation, PDI, delivery)
- OMVIC transaction fees
- Any mandatory add-ons or accessories
- Freight and pre-delivery inspection charges
- RDPRM/PPSA fees
The only items that may be excluded are:
- HST
- Provincial licensing and registration fees
The CBC Marketplace Problem
In November 2025, CBC Marketplace conducted an undercover investigation visiting 15 dealerships across the Greater Toronto Area. Six of the 15 – 40% of those investigated – charged more than their advertised price. The violations ranged from undisclosed administration fees to mandatory “protection packages” added to the final price.
This kind of investigation drives enforcement cycles. Dealers who are currently non-compliant should expect increased scrutiny throughout 2026.
Practical Compliance Steps
- Audit every advertisement, including website listings, third-party portals, and social media posts
- Ensure all mandatory fees are included in every displayed price
- Train staff that verbal disclosure does not satisfy the written advertising requirement
- Review third-party listing integrations to ensure prices passed to AutoTrader, Kijiji, and other platforms include all fees
A platform like READY HUB that centralizes inventory data and integrates with listing services can help ensure pricing consistency across channels, reducing the risk of discrepancies between your DMS price and what appears on external sites.
PIPEDA: Federal Privacy Obligations
The Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activity. Every Canadian dealership is subject to PIPEDA (or substantially similar provincial legislation in Alberta, BC, and Quebec).
The 10 Fair Information Principles
PIPEDA is built on 10 principles that dealers must follow:
- Accountability – Designate a privacy officer responsible for compliance
- Identifying Purposes – State why you are collecting information before or at the time of collection
- Consent – Obtain meaningful consent for collection, use, and disclosure
- Limiting Collection – Collect only what is necessary for the stated purpose
- Limiting Use, Disclosure, and Retention – Use information only for the purpose stated; retain only as long as necessary
- Accuracy – Keep personal information accurate, complete, and current
- Safeguards – Protect information with appropriate security measures
- Openness – Make privacy policies readily available
- Individual Access – Give individuals access to their own information on request
- Challenging Compliance – Provide a process for individuals to challenge compliance
Mandatory Breach Notification
Since November 1, 2018, organizations must:
- Report breaches of security safeguards involving personal information to the Privacy Commissioner of Canada
- Notify affected individuals when a breach creates a “real risk of significant harm”
- Keep records of all breaches – whether reported or not – for a minimum of 24 months
That last requirement catches many dealers off guard. Even breaches that do not meet the threshold for notification must be documented and retained. An employee accessing a customer file without authorization, a misdirected email containing personal information, a USB drive left in a vehicle – all of these are breaches that must be recorded.
Record Retention
PIPEDA does not prescribe a single retention period, but other federal requirements create practical minimums. The CRA requires tax records to be kept for six years. When you combine that with PIPEDA’s breach record requirements and provincial regulatory retention obligations, most dealerships should plan for a minimum six-year retention policy with clear destruction procedures after that period.
Understanding your data handling and privacy obligations is essential, particularly when customer data flows through multiple systems and integrations. For a detailed look at the security controls required to protect that data, see our dealership cybersecurity guide.
CASL: Marketing Communication Compliance
Canada’s Anti-Spam Legislation (CASL) is one of the strictest anti-spam laws in the world, and it applies directly to how dealerships communicate with customers and prospects via email, SMS, and other electronic channels.
Consent Types
Express consent is required for sending commercial electronic messages (CEMs). Express consent does not expire and must be obtained through a clear, affirmative action by the recipient.
Implied consent is time-limited:
- 24 months from the date of last purchase, lease, or other transaction
- 6 months from the date of an inquiry or application that did not result in a transaction
After these windows close, you must have express consent or stop sending commercial messages.
Channel-Specific Consent
A critical detail many dealerships miss: consent is channel-specific. A customer who consents to receive emails has not consented to receive text messages. Each channel – email, SMS, social media messaging – requires its own separate consent.
Penalties
CASL penalties are severe:
- Up to $1 million per violation for individuals
- Up to $10 million per violation for organizations
“Per violation” means per message. A single email blast to 5,000 recipients without proper consent could theoretically generate 5,000 separate violations. The maximum penalties are rarely applied, but the CRTC has levied fines in the hundreds of thousands of dollars against companies of all sizes.
Practical Steps
- Audit your CRM and marketing platforms for consent records
- Implement consent capture at every customer touchpoint (showroom, service, web forms)
- Track consent type (express vs. implied) and expiration dates for implied consent
- Ensure every commercial message includes a functioning unsubscribe mechanism
- Train BDC and sales staff that verbal consent is insufficient – consent must be documented
Proper system integrations between your CRM, DMS, and marketing platforms are essential for maintaining accurate consent records across touchpoints.
Quebec Law 25: Canada’s Strictest Privacy Regime
Quebec’s Act to modernize legislative provisions as regards the protection of personal information, commonly known as Law 25, has been fully in force since September 22, 2024. It is the most stringent privacy law in Canada and in many ways mirrors the European Union’s GDPR.
Key Requirements
- Privacy Impact Assessments (PIAs) are mandatory before any new project involving personal information
- Consent must be obtained separately for each purpose; bundled consent is invalid
- Data portability rights allow individuals to request their data in a structured format
- De-identification and anonymization standards are prescribed
- Breach notification within 72 hours to the Commission d’acces a l’information (CAI)
- Privacy officer designation is mandatory, and the officer’s contact information must be published on the organization’s website
Penalties
Law 25 penalties dwarf those under PIPEDA:
- Up to $25 million, or
- 4% of worldwide turnover, whichever is greater
For a large dealership group with operations in Quebec, this creates material financial risk. Even single-point dealers in Quebec face penalty exposure well beyond anything in other provinces.
What This Means for Dealers
Any dealership operating in Quebec – or selling vehicles to Quebec residents – must:
- Appoint and publicly identify a privacy officer
- Conduct PIAs for any new system implementation, vendor onboarding, or process change involving customer data
- Revise consent forms to separate each purpose (marketing, financing, service reminders, data sharing with manufacturers)
- Implement data portability processes
- Review and update breach response plans to meet the 72-hour notification window
Sales Tax Complexity Across Provinces
Canada’s patchwork of sales taxes adds another layer of compliance complexity, particularly for inter-provincial transactions.
Provincial Tax Rates
| Province/Territory | Tax Type | Rate |
|---|---|---|
| Alberta | GST only | 5% |
| Ontario | HST | 13% |
| Quebec | GST + QST | 14.975% |
| British Columbia | GST + PST | 12% |
| Saskatchewan | GST + PST | 11% |
| Manitoba | GST + PST | 12% |
| New Brunswick | HST | 15% |
| Prince Edward Island | HST | 15% |
| Newfoundland & Labrador | HST | 15% |
| Nova Scotia | HST | 15% |
Inter-Provincial Sales
When a vehicle is sold to a buyer who will register it in a different province, the applicable tax is generally based on the buyer’s province of registration, not the province where the sale takes place. This creates complexity for dealers near provincial borders and for online or remote sales.
A dealer in Alberta (5% GST) selling to an Ontario buyer must ensure the correct tax treatment is applied. Getting this wrong creates problems for the buyer at registration and potential audit exposure for the dealer.
Practical Implications
- Train F&I staff on inter-provincial tax rules
- Verify buyer’s province of registration at the time of sale
- Document tax treatment decisions for audit purposes
- Review DMS tax configuration regularly, especially after provincial rate changes
OMVIC’s 2026 Continuing Professional Development Program
One of the most significant regulatory changes of 2026 is OMVIC’s mandatory Continuing Professional Development (CPD) program, which launched on April 1, 2026.
What Changed
- All registered salespersons and dealers in Ontario must complete CPD courses
- CPD completion becomes mandatory for license renewals starting July 1, 2026
- The program covers ethics, disclosure obligations, advertising compliance, and consumer protection
- Courses are available through OMVIC’s online learning platform
Why It Matters
This is a significant shift. Previously, Ontario required initial certification to become registered but had no ongoing education mandate. The CPD program means that compliance is no longer a one-time hurdle – it is an ongoing obligation tied directly to licensure.
Dealers should:
- Identify all registered staff who need to complete CPD
- Build CPD completion into performance management and HR tracking
- Establish internal deadlines well ahead of the July 1 renewal requirement
- Use CPD as an opportunity to reinforce internal compliance culture
Common Compliance Failures and How to Avoid Them
Based on regulatory enforcement patterns across provinces, these are the most frequent compliance failures at Canadian dealerships:
1. Inconsistent Pricing Across Channels
A vehicle listed at one price on your website, a different price on AutoTrader, and yet another price on the showroom window sticker. Each inconsistency is a potential all-in pricing violation. The fix is centralized inventory and pricing management that pushes consistent data to all channels.
2. Stale or Missing Consent Records
CRM systems filled with customer records that have no documented consent, or where implied consent has expired. Regular consent audits and automated expiration tracking are essential.
3. Incomplete Disclosure Documentation
Disclosure forms that are partially completed, missing signatures, or that omit required fields. Templated, system-enforced disclosure workflows reduce this risk.
4. No Breach Record
Many dealers have no process for recording privacy breaches, even minor ones. PIPEDA requires a 24-month breach record regardless of severity.
5. Tool Sprawl Creating Compliance Gaps
The CADA CARTS study found that the average Canadian dealership runs 25 or more tools, with 12 or more used actively. Of those dealers, 59% underutilize their tools and 55% cite integration challenges. When customer data flows through a dozen disconnected systems, maintaining consistent privacy practices, consent records, and audit trails becomes extremely difficult.
Consolidating your operational tools through a platform like READY HUB reduces the number of systems handling sensitive data, simplifies compliance workflows, and creates clearer audit trails.
The Bottom Line
Compliance in the Canadian automotive retail sector is not getting simpler. Provincial disclosure rules vary significantly. Federal privacy and anti-spam laws carry escalating penalties. Quebec has introduced a privacy regime that rivals the GDPR. And Ontario’s new CPD program signals a broader trend toward ongoing regulatory accountability.
The dealerships that manage this well share a few characteristics: they centralize data, they automate compliance workflows where possible, they train staff continuously, and they treat compliance as an operational discipline rather than a box-checking exercise.
If your dealership needs help mapping compliance requirements to your operational systems, or if you want to understand how READY HUB can reduce compliance risk through better data management and integration, get in touch with our team.
Frequently Asked Questions
What is the most common MVDA violation in Ontario?
All-in pricing violations are the most frequently cited infraction under the Motor Vehicle Dealers Act. Dealers must advertise the total price a consumer will pay, including all fees, with only HST and licensing excluded. The November 2025 CBC Marketplace investigation found that 40% of tested GTA dealerships failed to comply with this requirement. OMVIC penalties for advertising violations can reach $25,000 for discipline proceedings and $250,000 for prosecutions.
How long does implied consent last under CASL?
Implied consent is valid for 24 months from the date of a completed transaction (purchase, lease, or service) or 6 months from the date of an inquiry that did not result in a transaction. After these periods expire, dealers must obtain express consent before sending commercial electronic messages. Consent is also channel-specific: email consent does not cover SMS, and vice versa.
Does Quebec’s Law 25 apply to dealerships outside Quebec?
Law 25 applies to any organization that collects, uses, or discloses the personal information of Quebec residents, regardless of where the organization is located. A dealer in Ontario selling a vehicle to a Quebec buyer and collecting their personal information is subject to Law 25’s requirements, including Privacy Impact Assessments, consent obligations, and the 72-hour breach notification window. Penalties can reach $25 million or 4% of worldwide turnover.
What are the new OMVIC CPD requirements for 2026?
OMVIC launched its mandatory Continuing Professional Development program on April 1, 2026. All registered motor vehicle salespersons and dealers in Ontario must complete CPD courses covering ethics, disclosure, advertising compliance, and consumer protection. Starting July 1, 2026, CPD completion will be required for license renewals. This is the first time Ontario has mandated ongoing education for licensed automotive professionals.