Consumers expect online privacy, but can SMEs deliver it?

Published on 2022-09-13 by Tessa Anaya

Legislators are moving to tighten data protection laws in Canada. This is partially a response to how consumers feel, but how can small to medium enterprises keep up with the changes? 

Canadian online privacy expectations

As we conduct more and more of our lives online, consumers, tech companies, and governments have become more aware of how this affects our privacy. Wherever we go on the internet, we leave a trail of personal information that ranges from the mundane (what shoes we looked at) to the valuable (our credit card details) to the highly personal (our medical information).

We implicitly trust companies to keep this data safe, but what they do beyond this is still a moral grey area. Can they use it to sell us more things? Can they analyse the data to understand their customers better? Can they sell it to the highest bidder? Do they need to encrypt every piece of data they touch?

To see what consumers think, we surveyed 1,000 online shoppers in Canada about their attitudes to privacy (covered in this article) and how this manifests in their behaviours when browsing (covered in the next article). We were especially interested to see whether privacy-focused SMEs are likely to perform better with consumers than ones that are not. You can scroll to the bottom of this article for a full methodology.

How is online privacy changing?

Legislators are taking action, with wide-ranging regulations like the European General Data Protection Regulation (GDPR) coming into force in 2018 to protect European citizens’ personal information online.

More recently, in the United States, the Banning Surveillance Advertising Act (BSAA) has been proposed, which seeks to restrict “online advertising that targets an individual, internet-connected device, or group of individuals or devices based on personal information.” Things may be changing in Canada, too— which we cover later.

These laws (if passed) could represent a fundamental shift in how small to medium enterprises (SMEs) conduct their online marketing and handle consumer data.

Advertisers need to understand these privacy trends, and especially how consumers’ attitudes are changing.

Who is responsible for data protection in Canada?

The BSAA and other privacy-focused legislation is a sign of the times. Big tech has seen the writing on the wall and is moving accordingly. Apple, for example, has made new privacy features a major part of the marketing for its new products. Google —which makes 80% of its revenue from advertising— is working to develop new standards that it says keep users’ data safe while allowing advertisers and publishers to keep their business models viable.

Whether these changes reflect consumer sentiment, or whether consumer sentiment has shifted as a result of these changes remains to be seen. However, a recent study by GetApp found that almost half of Canadian online shoppers are concerned about shopping and paying for goods online; and concerns among online shoppers are growing. One third of respondents to our survey say that they are more concerned about the data privacy practices of online companies compared with a year ago, while around two-thirds say they feel about the same. Only 2% say they are less concerned, despite new legislation and new measures put in place by tech companies.

Consumers in Canada feel that responsibility for online privacy lies most with the federal government (35%) and companies (41%). Indeed, these organizations have more power than state governments and individuals to make a difference here. 

consumer online privacy concerns in canada

Individual consumers’ power begins and ends with their choice about whether to use the internet (in its modern state) or not. Once a consumer signs up for a social media account, uses a smartphone, or makes an online purchase, they have already begun to place their personal data in the hands of the companies who run and profit from the internet.

Most people we surveyed (62%) said they were not sure whether Canada actually has a comprehensive data privacy law or not. When asked which of the following were meant to protect the online privacy rights of consumers in Canada, responses were mixed.

types of online privacy regulations canada

Did you know? The Personal Information Protection and Electronic Documents Act (PIPEDA) is a federal law that regulates how organizations in the private sector collect and use personal information. It came into force in 2000.

The proposed Consumer Privacy Protection Act (CPPA) aims to modernise the content of PIPEDA. It is intended to provide consumers with more control over their personal data and require organizations to be more transparent about what they are doing with it.

To help ensure your SME is aligned with current legislation, you may want to consider compliance software. It can help streamline documentation, audit trails, and reporting, making it easier to demonstrate compliance when required.

Does privacy matter to consumers when making a purchase?

Our survey suggests that consumers do take privacy into account at several stages of their online shopping process. 

We found that 72% of consumers research a company’s data privacy reputation before making an online purchase —although only 19% do this ‘always’. This has a real business impact for brands. 79% said that they factor a company’s data privacy practices into their decision about whether to do business with it.

Indeed, consumers appear to think of their data as an extension of themselves as a customer. They showed overwhelming agreement with the idea that ‘the way a company treats my data reflects how they treat me as a customer’, with 41% agreeing somewhat and 46% agreeing strongly. 

Many SMEs pride themselves on offering an excellent customer experience. This data suggests that customer experience goes beyond smooth transactions, good communication, and quick delivery —it extends to data privacy as well. One useful (and, in some cases, necessary) step is to encrypt consumer data with encryption software so that unauthorised users —or anyone who gets their hands on the data— cannot make use of it.

When (and why) are consumers happy to share information?

Of course, it is often necessary and beneficial to share personal information online. Most consumers in Canada recognise that brands can use their data to provide a better service. Two-thirds (67%) agree they are happy to share their personal information if it means better, more efficient products or services. And 65% are happy to share when it results in more personalized products.

However, the type of data shared also makes a difference, and the circumstances often dictate what data is appropriate to collect. 

consumer comfort levels for types of data privacy canada

Note that this question was asked in the context of dealing with a company for the first time. It may well be the case that consumers who are familiar with a company and have grown to trust it would be more comfortable to share certain types of information.

The major takeaway from this data is that consumers are broadly willing to share all types of data —at least to a degree. For all categories except three, ‘somewhat willing to share’ was the most selected answer. However, 60% of consumers in Canada said they were ‘very willing to share’ their gender identification, and 49% said the same about their sentiments, such as providing reviews of products. A plurality (45%) were not willing to share financial data.

There are a couple of things here that SMEs may want to note. The first is that consumers are not shy about telling others when they like or dislike a product or service. This can work to a company’s advantage if the sentiment is positive, as it effectively serves as free marketing, but when the sentiment is negative, trying to stop a consumer from sharing their views is likely to backfire, as the desire to share is widespread.

Secondly, the propensity to share gender information may reflect consumers’ desire to see the most appropriate advertising and marketing. Many product areas, such as clothing and personal products are highly gendered, and consumers may be happy to tell brands what gender they identify as to only see the products they are likely to buy.

When the consumer is the product

As far back as 2012, commentators realised that free social media platforms were turning the consumer into the product by allowing advertisers to target them with marketing based on their activity on that platform.

Among the people we surveyed, there was some agreement that paying for a privacy-focused service is preferable to using a free one where they have to share personal data.

Over half (56%) said they would prefer to pay for a service rather than share their personal data, and two-thirds (66%) said they would rather see more ads than share their personal data. In the latter case, the implication is that they would be prepared to see more (and less tailored) advertising than ads based on what they had previously looked at online.

When asked how much they would be willing to pay for a more private version of a product or service —one where the company does not collect or monetise their personal information or online activity— 43% said ‘a little more’, and only 8% said ‘a lot more’. This suggests that the idea of delivering more privacy focused ‘premium’ service with the intention of purely generating new revenue may not be viable. Consumers simply expect privacy as part of their standard experience.

How can companies gain new consumers’ trust?

It is worth noting from the outset that consumers are broadly trusting of how online companies handle their personal data. Just over half (56%) agree with the statement ‘I am confident that my personal information is secure when I provide it to an online company.’ But the proportion that agree strongly is small at 7%, and many more disagree somewhat (33%) or strongly (10%).

confidence levels in online data protection in canada

We asked consumers in our survey to rate what factors are important to them when judging the trustworthiness of a company that’s new to them. Crucially, compliance with regulations and clear communication came out on top, although respondents valued every suggested action a company could take to demonstrate its commitment to privacy. Communicating with customers about data privacy can be easier with the appropriate tools. Policy management software, for example, helps businesses create, manage, and share policies to internal and external stakeholders. 

consumer preferences around online privacy and trustworthy aspects of a company

The responses in the above graphic can serve as a basic guide for SMEs to ensure they are implementing the privacy measures that consumers expect.

In summary

  • Consumers feel that the federal government and companies bear the most responsibility for online privacy.
  • Privacy matters to online shoppers, and it can affect their buying decisions.
  • However, consumers are happy to share their information if it results in better or more tailored experiences.
  • Transparency from brands is key in building customer trust when it comes to data privacy.

Next time, we explore whether consumers’ reported behaviour when online shopping aligns with their feelings about data privacy.

Looking for encryption software? Check out our catalog.

Survey methodology:

GetApp’s Consumer Privacy Survey was launched online in June and July of 2022. The survey was completed by 1,012 consumers who fit our criteria. The sample of participants is representative of the population of Canada regarding aspects of age and gender, and the criteria for selecting participants are as follows:

  • Canadian resident 
  • At least 18 years old
  • Shops online at least once per month

Note: The applications and technologies selected in this article are examples to show features in context and are not intended as endorsements or recommendations. They have been obtained from sources believed to be reliable at the time of publication


This article may refer to products, programs or services that are not available in your country, or that may be restricted under the laws or regulations of your country. We suggest that you consult the software provider directly for information regarding product availability and compliance with local laws.


Share This Article

About the author

Content Analyst at GetApp, dedicated to helping SMBs access the insights that elevate their organizations. B.A. in English, University of Michigan. Based in Barcelona.

Content Analyst at GetApp, dedicated to helping SMBs access the insights that elevate their organizations. B.A. in English, University of Michigan. Based in Barcelona.