Rules
Celebrity photo privacy Canada quiz: PIPEDA and Law 25
Celebrity photo privacy Canada quiz rules: PIPEDA and Quebec's Law 25 shape consent, access and retention duties, with the OPC and the CAI as the regulators.
What to take away
- A recognizable photo is personal information under PIPEDA, so a quiz showing a celebrity face is handling regulated data.
- PIPEDA's Schedule 1 sets out ten fair information principlesaccountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance.
- Quebec's Law 25 adds clear-language policies, specific consent, access and deletion rights, and a named person responsible.
- Commercial quizzes need a licence or consent, and the journalism and artistic exceptions are narrow.
- Keep a source log and a consent record with fields, retention dates and a live takedown address.
PIPEDA and the personal information test
PIPEDA is the Personal Information Protection and Electronic Documents Act, Canada's federal private-sector privacy statute. It governs how private organizations collect, use and disclose personal information.
A photograph of an identifiable person is personal information under that Act, whether it is a thumbnail, a cropped headshot or a press-kit still. Recognition is the test, not the file format.
A quiz showing a celebrity face is processing personal information. Quiz sites, apps and classroom publishers sit inside PIPEDA.
Fame lowers the expectation of privacy in some settings, such as a red-carpet arrival. It does not remove the need for a lawful basis to use the image in a product.
Quebec runs its own private-sector statute. Quebec celebrity trivia in French and English shows what changes for a bilingual question set.
Quebec's Law 25 duties for quiz publishers
Quebec's Law 25 modernized the province's private-sector privacy law. The amended law is Quebec's private-sector privacy statute, An Act respecting the protection of personal information in the private sector, and it applies to enterprises doing business in Quebec, including quiz operators that target Quebec residents.
Quebec's privacy regulator, the Commission d'accès à l'information du Québec (CAI), oversees the amended statute. Law 25 names obligations where PIPEDA relies on principles. You must publish a privacy policy written in clear and simple language. It has to name the categories of personal information you collect, images included, and the purpose behind each.
A footer privacy link does not satisfy this. The policy must identify a person responsible for the protection of personal information, with contact details a player can use.
Access, correction and some deletion rights also apply. An organization must also report a confidentiality incident that presents a risk of serious injury to the CAI and notify the people affected. If a celebrity or an estate asks you to pull an image, you need a process and a response deadline.
Market to Quebec residents and Law 25 applies alongside PIPEDA. The Office of the Privacy Commissioner of Canada (OPC) sets out how the two regimes fit together in its summary of privacy laws in Canada.
Consent, licences and the limits of public-interest exceptions
Consent under PIPEDA must be meaningful and must cover collection, use and disclosure. Express consent is stronger than implied consent for a commercial quiz. Collecting photos for childhood photo games shows how quickly a private subject's face becomes the whole basis for permission.
Blanket terms-of-service wording is weak. A short note that names the photo, the quiz and the platform is stronger. State the retention period and give the person a way to withdraw.
Public-interest exceptions exist, but they are limited. Journalism, artistic expression and research attract exceptions in some frameworks. An ad-supported trivia app built for subscribers rarely fits those categories.
There is no celebrity exemption. Public figures keep privacy rights. A photo taken in a private setting, or one that reveals health or family details, carries more risk than a licensed awards-night still.
Image rights sit on top: personality rights are largely provincial and can cover commercial use of a name or likeness. British Columbia's Privacy Act makes unauthorized use of a name or portrait for advertising actionable, and Quebec's Civil Code of Québec protects image and privacy for everyone in the province.
The OPC's privacy guidance for businesses requires organizations to identify purposes before collecting personal information. Decide why you need the face, how long you keep the file and who can open it.
Compliance steps and the record they leave
Work in this order. Licensing and consent take longer than question writing.
Compliance steps
- Build a source log before you design a question. Record the photographer, the licence, the URL and the download date for each file.
- Write a short consent request for any image you cannot licence. Name the quiz, the platform and the retention period.
- Store the consent beside the image. A spreadsheet row or a folder note is enough for a small publisher.
- Publish a privacy policy that names images as a category and states your lawful basis.
- Set a retention rule with a deletion date, then log the day you act on it.
- Publish a takedown address, set a response target, and log every request.
If you cannot name the photographer or the licence, treat the image as unusable. A missing source is a compliance problem, not a research gap.
| Field | What goes in it |
|---|---|
| Subject | Person shown, plus photographer or agency |
| File | Filename, capture date, download date |
| Basis | Licence type or signed consent, with reference number |
| Use | Quiz name, platform, paid or free |
| Term | Canada plus other markets, and the expiry date |
| Retention | Deletion date and who deleted the file |
Keeping one image per answer keeps this log short. A career quizzes picture round needs a single still per career stage rather than a collage.
Example: a ten-portrait Canadian Screen Awards round
You build a round with ten portraits from Canadian Screen Awards history. Eight come from a press agency such as The Canadian Press or Getty Images under an editorial licence. One is a public domain portrait from Library and Archives Canada.
The tenth has no source, so it becomes a text clue about the award year. Record the two licence numbers and the public domain note, then set the deletion date for the files once the round retires. Editorial licences often bar advertising use, so check whether the round sits beside a sponsor banner.
