AI Chatbot and PIPEDA: What Data Can a School Collect in Canada?

What an AI chatbot actually collects about your prospects

An AI chatbot deployed on a Canadian post-secondary recruitment website begins collecting personal data from the very first interaction — long before a prospect types their name. IP address, session timestamp, typed messages, program consulted: each of these elements constitutes personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for institutions operating in Québec, under Loi 25 (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels).

72% of questions submitted to school chatbots are automatable FAQ inquiries, 21% require institution-specific context, and 7% require a human. (Source: automated classification of 12,000 Skolbot conversations, 2025.) Each of those 12,000 conversations is a processing activity subject to PIPEDA. The chatbot holds a decisive operational advantage over other channels: average response time of 3 seconds, 24/7, versus 47 hours by email and 72 hours by web form (Source: Skolbot mystery-shopping audit, 2025, 80 Canadian institutions). Capturing that advantage requires a privacy-compliant data collection infrastructure.

Typical data categories collected by a post-secondary chatbot in Canada:

• Conversational data — message text, timestamps, session language, session duration
• Voluntarily provided identifiers — first name, last name, email address, phone number (when a prospect shares these to be followed up)
• Interest data — program(s) browsed, target credential level, study mode sought (full-time, co-op, online)
• Voluntarily provided demographics — citizenship status, province of residence, country of origin (when collected via an embedded form)
• Technical data — IP address, device type, browser, session identifier

The Office of the Privacy Commissioner of Canada (OPC) requires that each processing activity carried out via a chatbot rest on an identified legal basis, and that individuals be informed of that processing at the outset of the interaction. Québec's Commission d'accès à l'information (CAI) imposes parallel obligations under Loi 25, with stricter requirements around automated decision-making disclosure. For a complete map of the personal information your institution processes, see our complete PIPEDA and student data guide.

The legal bases applicable to each data category

PIPEDA is a consent-based statute, but it recognises that consent is not always required. The Act identifies circumstances in which collection, use, or disclosure is permitted without consent. Four scenarios cover nearly all chatbot processing at a Canadian institution:

Consent (PIPEDA Principle 3 / Loi 25 art. 12) — The individual has provided meaningful, informed, and freely given consent. This is the appropriate basis for subsequent marketing communications (re-engagement, newsletters, open house invitations) triggered by chatbot interactions. Consent must be obtained through an active mechanism (unchecked checkbox), timestamped, and retained as evidence. Under Loi 25, consent must be manifest, free, and enlightened — and may not be obtained as a condition of service.

Contractual necessity / reasonable purpose (PIPEDA Principle 4.3.4) — Collection is for a purpose that a reasonable person would consider appropriate in the circumstances. A prospect requesting program fee information or admission requirements: processing their email to send the requested documentation satisfies this standard.

Legitimate business purpose (PIPEDA Principle 4.3.5) — Processing is necessary for a legitimate purpose, provided individual interests are not overridden. Analysis of anonymised conversations to improve chatbot quality may fall under this basis. Note: the interest-balancing analysis should be documented, particularly if the institution is subject to Loi 25, which requires a Privacy Impact Assessment (PIA) before any new processing involving personal information.

Legal obligation — Rarely applicable to the chatbot itself, but relevant if data collected must be retained for regulatory traceability (e.g., evidence of pre-contractual disclosure to an international student under IRCC requirements).

For sensitive personal information — see the following section — Loi 25 and PIPEDA both require explicit consent or a specific statutory authority.

The minimisation principle: collect only what is necessary

Data minimisation — the principle that only adequate, relevant, and limited personal information should be collected — is the most frequently violated principle in post-secondary chatbot deployments. PIPEDA's Principle 4.4 (Limiting Collection) and Loi 25 Article 5 both impose this standard.

What this means concretely for your institution's chatbot:

• The chatbot must not require an email to answer a question about programs. An email address is necessary only if the prospect wants to be followed up or receive a document.
• Citizenship status should not be collected systematically. It becomes relevant only when a prospect asks about scholarships restricted to specific nationalities, study permits under IRCC, or provincial differential fees for out-of-province students.
• Precise date of birth is unnecessary if the chatbot merely needs to determine whether the prospect is a high school student or already holds a college-level credential. A study-level indicator is sufficient.
• Full conversation logs must not be retained indefinitely. The purpose of retention (service improvement, CRM transfer) must be defined before the chatbot goes live, not after.

The CAI has issued guidance specific to AI systems emphasising that a PIA must precede deployment and that privacy-by-design is mandatory under Loi 25 — minimisation must be built in, not retrofitted.

Sensitive personal information: citizenship, health, socioeconomic status

Some information collectible via a post-secondary chatbot falls into categories that require heightened protection under both PIPEDA and Loi 25.

Citizenship and immigration status: citizenship is not inherently sensitive personal information under PIPEDA or Loi 25. However, where its collection can reveal national or ethnic origin, both statutes apply stricter rules. A chatbot that collects citizenship to segment prospects (e.g., "domestic vs. international") must assess whether this constitutes indirect ethnic profiling.

Health and disability: prospects seeking information about accessibility services, exam accommodations, or disability support services may inadvertently share health-related information. The chatbot should be configured to not record such information in unprotected free-text fields. Where collection is necessary (routing to a disability services office), it must be based on explicit informed consent under Loi 25 Article 12, with a clear prior disclosure.

Financial situation: requests about bursaries, OSAP eligibility, provincial student loans, or fee waivers may reveal socioeconomic circumstances. While not categorically "sensitive" under all provincial frameworks, such information requires a robust legal basis and appropriate security measures.

Practical rule: configure your chatbot to detect sensitive topics and redirect to a human agent or a secure form, rather than collecting this information through the standard conversational interface.

Data categories, legal bases, and retention periods

Privacy Impact Assessment (PIA): when does your chatbot trigger one?

Under Loi 25 (Article 3.3), a Privacy Impact Assessment (PIA — évaluation des facteurs relatifs à la vie privée, EFVP) is mandatory before any new technology project involving personal information, including deploying or significantly modifying a chatbot. This is not a risk threshold — it is a blanket requirement for Québec-based institutions, regardless of scale.

Under PIPEDA, the OPC strongly recommends a PIA for high-risk processing activities, including:

• Large-scale processing: a chatbot handling thousands of conversations monthly at a post-secondary institution readily qualifies
• Profiling: if the chatbot qualifies the prospect (warm/cold, program recommendation, enrolment probability) from their interactions, this is profiling under PIPEDA
• Sensitive information: collection of information that could reveal immigration status, disability, or financial situation
• Transfers outside Canada: if your chatbot provider uses servers or language models hosted in the United States or elsewhere, this triggers a cross-border transfer obligation under PIPEDA Section 4.1.3 and Loi 25 Article 17

The PIA documents: the processing description, necessity and proportionality assessment, identified risks, and mitigation measures. If residual risks cannot be mitigated, Québec institutions must consult the CAI before proceeding (Loi 25 Art. 3.3.1).

For technical and organisational obligations, our PIPEDA audit checklist for Canadian schools covers the 20 key points, including the chatbot PIA.

Implementing compliant data collection: the chatbot interface

PIPEDA and Loi 25 compliance for a chatbot operates at three levels: prior disclosure, consent mechanism, and individual rights.

Prior disclosure (transparency)

Before the first exchange, the chatbot must display a welcome message including:

• The identity of the organisation collecting data (the institution)
• The purpose of the processing (answering questions, qualifying the prospect)
• A link to the full privacy policy
• The disclosure that the interlocutor is an artificial intelligence system (required under Loi 25 Art. 22.1 for automated processing involving personal information; reinforced by Canada's proposed AIDA framework)

Compliant example: "I'm [Chatbot Name], [Institution]'s AI assistant. Your conversation is processed according to our [privacy policy]. To exercise your rights, contact privacy@[institution].ca."

Integrated consent mechanism

Where the chatbot collects email or phone number, an active consent mechanism must precede that collection:

• Unchecked checkbox for marketing communications
• Separate disclosure for each purpose (re-engagement, newsletter, open house invitation)
• Timestamp and retention of proof of consent (mandatory under Loi 25)

Individual rights: access, correction, deletion

Prospects must be able to exercise their rights through a simple channel. Common practice: display the privacy contact address in the chatbot interface and the privacy policy. A response to a deletion request must occur within 30 days (Loi 25) and cover all systems: chatbot logs, CRM, email platform, analytics with identifying data, and backups.