How Online Casino Privacy Works in Canada — What Personal Data Casinos Collect

Online casino privacy in Canada is more complicated than most players expect. What personal data casinos collect is shaped by several overlapping legal frameworks: federal privacy law, provincial statutes, financial intelligence obligations, and gaming regulator requirements. This page explains the main categories of personal data that Canadian operators hold and identifies which law drives each type of collection. By the end, you’ll be able to read the disclosures in your own account documentation and understand why certain information is being asked for.

Categories of Personal Data Canadian Online Casinos Collect

Canadian online casino operators hold personal data in several distinct categories. The reason each category is collected varies depending on whether the trigger is identity verification, federal financial intelligence law, gameplay recording, or passive technical tracking. Each category has its own legal basis, its own retention rules, and its own disclosure pathway to regulators. A single account registration activates obligations under multiple separate laws at the same time, which is why understanding these categories matters when you’re reading an operator’s privacy notice.

Identity and Demographic Information

Identity and demographic data confirms that an account holder is a real person, of legal age, and a Canadian resident whose identity can be verified against a government-issued document. This is the most exposed category at registration and the data most often used when operators respond to regulatory disclosure requests. Fields are captured at signup and checked against a physical or scanned ID before the account goes live. When a privacy notice lists a long series of identity fields, it’s documenting a single legally structured verification process, not arbitrary data collection. Each field maps to a specific requirement under anti-money-laundering guidance or provincial gaming licensing conditions.

The fields below represent the typical identity and demographic categories drawn from Canadian operator privacy disclosures, including those published by Great Canadian Entertainment, Pure Casino, Gateway Casinos, and iGaming Ontario operators.

• Full name: primary identifier used across all regulatory and account records
• Date of birth: confirms the account holder meets the minimum age requirement for gambling in the relevant province
• Residential and mailing address: establishes Canadian residency and supports identity document cross-referencing
• Phone number: contact method retained for account communications and verification callbacks
• Email address: primary digital contact channel and account login credential
• Gender: demographic field collected as part of the account profile
• Government-issued identification number and document type: the specific ID reference and document category (e.g., driver’s licence, passport) recorded to satisfy identity verification requirements
• Photographs or video images: captured during in-person or remote identity verification to confirm the document holder matches the account applicant
• Vehicle plate or description: collected where the operator’s group includes physical premises, as disclosed by Great Canadian Entertainment

Financial and Transactional Data

Financial and transactional data covers the banking instruments used to fund and withdraw from an account, plus every deposit, withdrawal, and internal balance movement recorded against it. This category is more tightly tied to federal financial intelligence reporting obligations than to the operator’s own commercial purposes. Payment instrument details are captured at the first transaction, and every subsequent movement is recorded automatically. A large portion of this data is kept because federal record-keeping law requires it. Once a qualifying transaction occurs, operators have no choice about whether to keep these records.

These are the transactional categories consistently disclosed across Canadian operator privacy notices, including those of iGaming Ontario operators, Gateway Casinos, and Pure Casino.

• Payment instrument identifiers: card numbers, bank account references, or e-wallet identifiers linked to the account
• Deposit and withdrawal amounts and timestamps: the value and exact timing of every funds movement into or out of the account
• Account balance movements: internal credits, debits, and adjustments recorded against the player’s balance
• Currency conversion records: exchange details captured where a transaction involves conversion between currencies
• Loyalty or rewards account transaction records: points earned, redeemed, or adjusted, recorded as part of the transactional history

Gaming Activity and Behavioural Records

Gaming activity and behavioural records document what a player does inside the platform: every wager, session, game selection, and pattern of play, along with behavioural signals derived from that activity. This category is the least visible to the player but the most detailed on the operator side. Alberta’s privacy watchdog raised concerns about the scope of behavioural and demographic data being stored in connection with online gambling activity. Gameplay events are logged server-side in real time, aggregated into session and lifetime records, and in some cases combined with tracking signals collected from third-party websites. So when a privacy notice says “gaming history,” it describes a much richer record than the transaction list you can see in your account dashboard.

The following categories fall within this class, as reflected in disclosures from Gateway Casinos, iGaming Ontario operators, and Pure Casino.

• Individual wager and outcome logs: a timestamped record of each bet placed and its result
• Session duration and frequency: the length and timing of each login session, aggregated over the account lifetime
• Game and product selection history: the specific games, tables, or products accessed during each session
• Loyalty-point-earning activity: the gameplay events that generate or affect loyalty point balances
• Behavioural tracking signals: signals collected across the operator’s own properties and, in some cases, third-party websites, as disclosed by Pure Casino

Technical, Device, and Location Data

Technical, device, and location data is the digital fingerprint of the device and connection used to access the platform during each session. The Office of the Privacy Commissioner of Canada treats IP address, location data, and cookie-stored information as personal information subject to Canadian privacy law. That means a cookie banner on a casino site is a regulated consent mechanism, not a formality. These signals are captured passively during every session, often without a separate consent prompt for each individual field. Under Canadian privacy law, this data is not anonymous metadata. It’s regulated personal information, and operators are required to get meaningful consent before collecting and using it.

The following categories fall within this class, as reflected in disclosures from Gateway Casinos, Pure Casino, and iGaming Ontario operators, and confirmed by Office of the Privacy Commissioner guidance.

• IP address: the network identifier of the device at the time of each session
• Approximate and precise geolocation: location data derived from the IP address or device sensors, used in part to confirm the player is within a permitted jurisdiction
• Device type and operating system: hardware and software identifiers captured at connection
• Browser type and version: the browser application and version used to access the platform
• Cookie identifiers and equivalent tracking technologies: persistent or session-based identifiers stored on the device and read on subsequent visits
• Cross-site behavioural signals: tracking data collected beyond the operator’s own platform where the operator’s disclosures indicate such collection occurs

The Canadian Legal Framework Governing Casino Data Collection

Canadian online casino data collection is not governed by a single law. A layered system applies: a federal private-sector privacy law sets the baseline, some provinces have enacted their own substantially similar private-sector privacy laws that replace the federal statute within those provinces, and Quebec has introduced additional requirements through recent legislative changes. Canada has at least 29 federal, provincial, and territorial privacy statutes covering personal information across private, public, and health sectors. That’s before any gaming-specific obligations are added.

Federal Baseline and Provincial Private-Sector Statutes

The federal baseline statute governs the collection, use, and disclosure of personal information by private-sector organisations in the course of commercial activity across Canada. Where a province has enacted a substantially similar private-sector privacy law, that provincial statute applies instead of the federal law for provincially regulated activity within that province. The applicable statute follows the player’s province of residence, not the operator’s headquarters. So reading a privacy policy means figuring out which of the four regimes below actually governs your account.

The table below maps each of the four applicable regimes to the scope of organisations it covers, the core collection requirement it imposes, and the authority responsible for oversight.

Meaningful Consent as the Governing Standard

Federal privacy guidance from the Office of the Privacy Commissioner of Canada sets meaningful consent as the standard operators must meet before they can collect, use, or disclose personal information. That means consent must be informed, specific to the stated purpose, and written in language an ordinary account holder can actually understand. Consent must be obtained before collection begins, not after the fact, and the operator is responsible for communicating purposes clearly enough that a non-specialist reader knows what they’re agreeing to.

Federal guidance also addresses age: children under 13 generally cannot provide valid consent, and any service directed at that age group requires parental consent instead. For an adults-only product like an online casino, this works as a hard age gate. The consent mechanism is legally inoperative for anyone below that threshold, which is why age verification comes before the consent screen rather than after it.

A click-through consent screen at account registration is doing legal work, not marketing work. The operator is establishing the lawful basis for every subsequent data operation tied to that account, from session logging to financial record-keeping.

Quebec’s updated requirements impose a stricter standard. Since 22 September 2023, the Quebec Private Sector Act as amended by Bill 64 requires opt-in consent (not opt-out) for any tracking, localisation, or profiling technology, including cookies. The highest privacy settings must be enabled by default, meaning a Quebec-resident player who takes no action at all gets the most protective configuration rather than the least.

Federal Financial-Intelligence Record-Keeping Obligations

Canadian casino operators, including online products where applicable, are designated reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, which is administered by FINTRAC, the federal financial intelligence agency. This designation imposes record-keeping and reporting duties that run in parallel with privacy preferences and cannot be waived by a player’s consent choices. The Act explicitly permits a reporting entity to collect or use an individual’s personal information without their knowledge or consent for the purposes of the Act. Specific transaction types and thresholds trigger specific reporting obligations, which are detailed below.

Records and Reports Required at Transaction Triggers

Before conducting certain transactions, FINTRAC requires casino operators to record a defined set of identity fields: the individual’s name, date of birth, address, principal occupation, type of identification document, and identification reference number. Operators must file reports with FINTRAC based on the nature and value of the transaction. The obligation attaches automatically once the trigger fires, with no room for operator discretion. This is why fields like occupation and identification reference number appear in an operator’s records. Federal law requires their capture at the point of a qualifying transaction, not because the operator collected them for commercial or marketing purposes.

The table below sets out the four report types casinos must file, the condition that triggers each, the identity fields recorded, and the applicable threshold.

Disclosure of Player Data to Provincial Gaming Regulators

On top of federal financial intelligence reporting, operators are required by provincial gaming statutes to share personal information with the provincial gaming authority that licences or oversees them. This is a legally required obligation under the relevant provincial statute, not something the operator can opt out of. The specific receiving authority varies by province.

Provincial Gaming Authority Data-Sharing Requirements

A provincial gaming authority receives personal information that the operator has collected, with the disclosure authorised or required under that province’s gaming statute. Because this flow goes to a government body, a player’s data reaches a provincial authority regardless of what the operator’s own privacy policy says. When a privacy notice states that personal information may be shared with “regulators,” that language refers to a specific statutory body named in provincial gaming legislation, and the sharing is grounded in that statute rather than in the operator’s discretion. Operators also disclose that personal information may be stored outside the player’s province or outside Canada entirely, a point confirmed in iGaming Ontario’s privacy policy.

The table below maps each province to its receiving authority, the enabling statute, and the nature of the data shared as identifiable from the research sources.