Collected by Design

Ann Cavoukian served as Ontario's Information and Privacy Commissioner from 1997 to 2014. The seven foundational principles of Privacy by Design were formalised under her tenure in 2009, adopted as an international standard by the global data-protection commissioners' conference in Jerusalem in October 2010, and written into European law as Article 25 of the GDPR in 2016. The framework was Canadian. The implementation was European. In Canada it became a slogan reproduced on Treasury Board slide decks and corporate privacy pages, and almost nowhere else. The gap between what we named and what we deployed is the entire story of how surveillance settled into everyday life.
I first met Cavoukian at a privacy conference in the early 2000s; she was already impatient. The principles were not abstract; they were a direct challenge to the default assumptions she knew were being baked into product roadmaps in real time. I have since spent what my colleagues at the Privacy and Access Council of Canada charitably describe as an eternity serving as a director there; the frustration the framework was designed to solve has simply accumulated more documentation. Ontario's current IPC, Patricia Kosseim, is now into her second term; her office has spent five years calling out deceptive design patterns, children's data commercialisation, and AI governance gaps with the same directness Cavoukian brought to the foundational work. That continuity is not accidental. The frustration, at this point, is institutional.
Erosion Happens at Checkout
Privacy does not erode through scandal. It erodes through onboarding screens, receipt prompts, and "would you like an e-receipt?" The Tim Hortons app collected granular location data every few minutes, including when the app was closed, between May 2019 and August 2020; the joint OPC investigation made that public on 1 June 2022. The collection had no operational purpose; it was used to infer where users lived, worked, and travelled. Cadillac Fairview installed facial-analytics technology inside mall wayfinding kiosks, captured biometric data from an estimated five million Canadians, and described the practice as "anonymous video analytics"; the OPC settled that question on 28 October 2020 in PIPEDA Findings #2020-004. Neither involved a breach. Both were design decisions described in plain English by people who built them and approved by people who reviewed them.
The "consent fatigue" Defence
On 26 January 2023 the OPC released its first PIPEDA finding of the year, against Home Depot of Canada. Between 2018 and October 2022, every customer who chose an e-receipt at a Home Depot till had their hashed email address and in-store purchase details forwarded to Meta through the "Offline Conversions" program; Meta matched the hash to a Facebook account and used the resulting profile both for Home Depot ad-effectiveness reporting and for its own ad-targeting business. Home Depot's defence to the OPC is worth quoting because it is the entire article in one sentence: the company told the regulator it had not notified customers of the data-sharing arrangement at the point of sale because doing so would have created "consent fatigue." That is not a misstep; that is the design philosophy declared on the record. The OPC concluded that express opt-in consent had been required and that no such consent existed.
Defaults are the Design
Default collection is the design decision; the privacy notice is the alibi. A product that needs your data to monetise ships with collection on, the disable toggle three menus deep, the consent banner engineered so "accept" is bright and "reject" reads as a punishment. This is not careless UX. It is the commercial purpose of the build, written into the wireframes before legal sees a draft. The European Data Protection Board ruled in April 2024 that "consent or pay" walls breach GDPR Article 7; an entire generation of users had by then been trained that the rational response to any permissions ...