The key terms of privacy protection, cybersecurity and data law, explained simply. Each definition places the idea in a Canadian and Quebec context and points to the site's tools and guides.
A browser extension or DNS filter that stops ads from displaying and, above all, blocks the third-party trackers that feed advertising networks. It reduces cross-site tracking and often speeds up page loading.
See also: Article: targeted advertising
A set of instructions that lets software compute a result or make a decision. In privacy, personalization algorithms use behavioural data to target ads, rank content or assign scores (credit, hiring).
See also: Article: targeted advertising
The requirement to explain, in understandable terms, how an automated system reaches a decision that affects you. It ties in with the right to be told of an automated decision and to ask a person to review it.
See also: Article: Quebec's Law 25
An irreversible transformation of personal information: the person can no longer be identified, even by cross-referencing other sources. It differs from pseudonymization, which is reversible. Law 25 strictly limits what can be called “anonymized”: the risk of re-identification must be practically nil.
See also: Article: online anonymity
A decision made solely by automated processing, with no human involvement (credit refusal, application screening). In Quebec the organization must tell you when it is made and, on request, say which information was used and let you present your observations to someone who can review it.
See also: Article: Quebec's Law 25
Identification or authentication based on a physical or behavioural trait: fingerprint, face, iris, voice, gait. These are sensitive data: you cannot change your face the way you change a password. In Quebec, creating a database of biometric characteristics must be reported to the CAI, and consent must be express.
See also: Article: biometric data
A tracking technique based on the unique combination of technical traits of a browser and device: screen size, fonts, time zone, language, graphics card. Unlike a cookie, it is not stored on your device, so it cannot be cleared. You can measure yours with the site's tool.
See also: Tool: browser fingerprint check · Guide: browser fingerprinting
The agency that oversees Quebec's access-to-information law and its personal-information protection laws. It receives complaints and incident reports, and can investigate, issue orders and impose penalties.
See also: Article: Quebec's Law 25
A Law 25 term: access to, use of or disclosure of personal information not permitted by law, loss, or any other breach of its protection. Where there is a risk of serious harm, the organization must notify the CAI and the people affected promptly, and keep a register of all incidents.
See also: Article: Quebec's Law 25 · Guide: data breaches
A free, informed agreement, given for specific purposes, to the collection, use or disclosure of personal information. In Quebec it must be requested for each purpose, in plain terms, and it can be withdrawn. A pre-ticked box or consent buried in long terms is not valid.
See also: Article: Quebec's Law 25
A small file a site stores in your browser to remember information between visits. Third-party cookies, set by a domain other than the one you are visiting, are mostly used for ad tracking. Safari and Firefox already limit cross-site tracking by default; Chrome keeps third-party cookies and leaves the choice to the user.
See also: Article: targeted advertising
The practices and technologies that protect systems, networks and data against unauthorized access and attacks. It complements privacy protection: a security flaw often becomes a privacy incident.
See also: Guide: data breaches
The disclosure, loss or theft of personal data following a cyberattack, a mistake (misconfigured database) or an insider's action. If your data is affected: change the passwords concerned, turn on multi-factor authentication and watch your statements and credit file.
See also: Guide: data breaches · Tool: password checker
A company that collects, combines and resells personal information from many sources (public records, purchases, social networks, apps) for marketing, background checks or risk scoring. You can generally ask for access to your data and its removal, but the process is often slow.
See also: Article: targeted advertising · Article: digital identity theft
The principle that only the information necessary for the stated purpose should be collected, and destroyed or anonymized once that purpose is met. It is built into the GDPR and Law 25. It runs against the reflex of collecting everything “just in case”.
See also: Article: Quebec's Law 25
The right to receive the information you provided to an organization in a structured, commonly used format, and to have it sent to another. Provided for by the GDPR (Article 20) and, in Quebec, by Law 25 since September 2024.
See also: Article: Quebec's Law 25
An image, voice or video fabricated or altered by artificial intelligence to convincingly imitate a real person. It is used for scams (a cloned relative's voice), disinformation and reputational harm. No detector is foolproof: check the source and call the person back by a known means.
See also: Tool: AI content detector · Article: deepfakes
All the traces left by your online activity: browsing history, posts, purchases, location. The active footprint comes from what you publish; the passive footprint is collected without your knowledge (IP address, cookies, metadata). Reducing it is one of the basics of digital hygiene.
See also: Article: your digital footprint
An assessment required by the GDPR before processing that is likely to pose a high risk to people's rights: it describes the processing, tests its necessity, identifies the risks and plans measures to reduce them. Its Quebec counterpart is the PIA.
See also: Article: Quebec's Law 25
The person appointed to make sure data protection rules are followed. The DPO (data protection officer) is provided for by the GDPR; in Quebec, Law 25 has required a person in charge of personal information protection (RPRP) since September 2022, whose title and contact details must be published on the organization's website.
See also: Article: Quebec's Law 25
Turning readable data into unreadable data using a key: only the holder of the right key can read it. It is used everywhere: in transit (TLS), on disk (AES-256) and in messaging apps. Strong encryption is useless with a weak password or a poorly kept key.
See also: Article: public Wi-Fi networks
Encryption where only the sender and the recipient hold the keys: even the service provider cannot read the messages. It does not protect metadata (who talks to whom, when) or the contents of an unlocked phone.
See also: Article: online anonymity
The European Union regulation in force since May 2018. It applies to organizations that process the data of people in the Union, wherever they are. It grants rights of access, rectification, erasure, portability and objection, among others; fines can reach €20M or 4% of worldwide turnover. It inspired Law 25.
See also: Article: Quebec's Law 25
Determining the position of a device by GPS, cell towers, Wi-Fi networks or IP address. Movements reveal a lot: home, work, place of worship, health care. Deny location access to apps that do not need it, or limit it to “while using the app”.
The secure version of the web's protocol: it encrypts exchanges between the browser and the site (TLS) and verifies the site's identity. The padlock means the connection is encrypted, not that the site is honest: many fake sites use HTTPS.
See also: Tool: scam checker
Quebec's reform of personal information protection, assented to in 2021 and phased in: 2022 (privacy officer, incidents), 2023 (most obligations: consent, PIAs, transparency) and 2024 (portability). Administrative penalties can reach $10M or 2% of worldwide turnover, and penal fines $25M or 4%.
See also: Article: Quebec's Law 25 · Frequently asked questions
The systematic collection of data about large populations by governments or companies, with no prior individual target. Edward Snowden's 2013 revelations exposed the US NSA's metadata collection programs. In Canada, CSIS and the CSE exercise their powers within the framework set by their laws and subject to independent review.
See also: Article: online anonymity
Data that describes other data: for an email, the sender, recipient, time and IP address; for a photo, the date and sometimes the GPS position. Even without the content, they reveal habits (with whom, when, how often).
See also: Article: your digital footprint
Verifying identity with at least two different kinds of proof: something you know (password), something you have (phone, security key) or something you are (fingerprint, face). It protects the account even if the password is stolen. Authenticator apps and security keys resist phishing better than text-message codes.
See also: Guide: password security · Tool: password checker
The federal agency that oversees PIPEDA (private sector) and the Privacy Act (federal institutions). It investigates complaints, but cannot issue orders or impose fines.
The collection and analysis of public information: social networks, registries, web archives, images. Security professionals and journalists use it; so do scammers, to prepare a personalized message. Reducing your public footprint reduces what can be found about you.
See also: Article: your digital footprint
A passwordless credential built on a pair of cryptographic keys: the private key stays on the device, unlocked by face, fingerprint or PIN. It is tied to the legitimate site, so it is useless on a fake one: it resists phishing.
See also: Guide: password security
A secret used to prove identity. A good password is long (a passphrase of at least 14 to 16 characters), unpredictable and unique to each service. Check that it has not already appeared in a breach, and turn on multi-factor authentication.
See also: Tool: password checker · Guide: password security
An app that creates, stores and fills in long, random, different passwords for each service behind a single master password. It is the most realistic way to avoid password reuse, the first cause of account takeovers.
See also: Guide: password security · Tool: password checker
A GDPR term for a security breach leading to the destruction, loss, alteration, unauthorized disclosure of or access to personal data. The GDPR requires notifying the authority within 72 hours; the Quebec equivalent is the confidentiality incident, whose deadline is “promptly”.
See also: Guide: data breaches
Any information about an identifiable individual, directly or indirectly: name, address, email, phone number, online identifier, location, health or financial data. Business data and truly anonymized data are not covered.
See also: Article: Quebec's Law 25
A fraudulent message or site posing as a trusted organization (bank, Canada Revenue Agency, delivery company) to steal credentials or money. Spear phishing targets a specific person with a personalized message; by text it is “smishing” and by phone “vishing”.
See also: Tool: scam checker · Article: email security
An assessment that Law 25 has required since September 2023 before acquiring, developing or overhauling an information system or electronic service delivery that involves personal information, and before disclosing information outside Quebec. It weighs the privacy risks and the planned measures.
See also: Article: Quebec's Law 25
The 2000 federal law governing the collection, use and disclosure of personal information in the private sector, in provinces without a law considered substantially similar. Quebec, Alberta and British Columbia have their own law for activity within the province. A reform bill (C-27) died on the order paper in January 2025.
An approach formulated by Ann Cavoukian, former Information and Privacy Commissioner of Ontario: build privacy into the very design of products rather than adding it afterwards. It rests on seven principles, including protection by default and transparency. Law 25 notably requires privacy settings to default to the highest level.
See also: Article: Quebec's Law 25
A browser mode that does not keep history, cookies or forms on the device when you close it. It hides neither your IP address nor your activity from your employer, your internet provider or the sites you visit.
See also: Guide: VPNs
Collecting and using information about a person to assess certain aspects of their life: tastes, behaviour, financial situation, location. In Quebec, a technology that allows profiling must be turned off by default, and the person must be informed before it is turned on.
See also: Article: targeted advertising · Article: Quebec's Law 25
Replacing the elements that directly identify a person with a code, with the information that allows the link kept separately. Unlike anonymization, it is reversible: the data remains personal information, but the risk in a breach is reduced.
Malicious software that encrypts a victim's data and demands a ransom to restore it, often after copying part of it to threaten publication. The best defences are offline backups, updates and caution with attachments.
See also: Guide: data breaches
The right to ask for your personal information to be deleted, recognized by the GDPR (Article 17). In Quebec, Law 25 provides a related right: to have the dissemination of information stopped or de-indexed when it causes serious harm to reputation or privacy, under the conditions set by the law.
See also: Article: the right to be forgotten
Information that, by its nature or context, carries a high reasonable expectation of privacy: health, finances, biometric or genetic data, sexual orientation, religious or political beliefs. It requires express consent and stronger protection.
See also: Article: biometric data
A Canadian number used for taxes, employment and some benefits. Its theft makes identity theft easier. Give it only to those the law allows to ask for it (employer, financial institution for tax purposes) and never by unencrypted email or to someone who calls you.
See also: Article: digital identity theft
Psychological manipulation to get someone to hand over information or take an action that compromises their security, playing on trust, urgency, authority or fear. Phishing is the most common form. The defence: slow down, check through another channel, do nothing under pressure.
See also: Tool: scam checker
An app secretly installed on someone's device to monitor their messages, location and activity, often by a partner or ex. In Canada, installing it without consent can fall under Criminal Code offences (criminal harassment, unauthorized use of a computer). If you fear you are being monitored, think of your safety first.
The protocol that encrypts communications over the Internet. SSL is its retired ancestor; TLS 1.3 is the current version. A certificate issued by a certificate authority lets you verify the server's identity. It is what makes HTTPS possible.
An anonymity network that routes traffic through a series of volunteer-run relays, with layered encryption, to hide who visits what. Slower than a VPN, it protects anonymity better. Used by journalists and activists, but also by anyone who wants to avoid tracking.
See also: Article: online anonymity
Following your behaviour across several sites and apps to build a profile used for advertising or analytics. It combines third-party cookies, tracking pixels, browser fingerprinting and advertising IDs.
See also: Article: targeted advertising · Tool: browser fingerprint check
An invisible image, often one pixel, embedded in a page or an email: when it loads, it tells a third party that you opened the message or visited the page, along with your IP address and device. Blocking remote images in email stops it from working.
See also: Article: email security
A code assigned to a device, account or person to recognize it from one session to the next: the phone's advertising ID, serial number, MAC address. It lets activities that seem separate be linked; mobile systems let you reset or disable it.
See also: Article: targeted advertising
A service that encrypts your traffic and routes it through an intermediary server: sites see that server's address rather than yours. A VPN shifts trust to its provider, which can see your traffic: it is not an anonymity tool. It is most useful on public Wi-Fi.
See also: Guide: VPNs · Article: public Wi-Fi networks