Customers Outside Canada

The distinction that decides it

Almost every question here resolves to one thing: are you targeting that market, or merely visible from it.

A website is reachable from everywhere. That alone does not generally subject a small Canadian business to the law of every country with an internet connection.

What indicates targeting: pricing in the local currency, shipping options to that country, language aimed at that market, advertising directed there, a local phone number or address, and references to customers there.

What does not: an order arriving unbidden from somebody who found you.

The more of the first list you have, the more seriously the second question needs taking.

Europe and the United Kingdom

The regime businesses worry about most, frequently out of proportion.

European data protection law can apply to an organisation outside the region where it offers goods or services to people there, or monitors their behaviour. Offering is assessed on evidence of intention rather than mere accessibility.

So a Vancouver trades business with a website in English, prices in Canadian dollars and no shipping abroad is not offering services in Europe because somebody there can load the page.

A business that translates its site, prices in euros and ships there is in a different position, and if it applies there may be requirements including a representative in the region, a lawful basis for processing, and specific rights for individuals.

The proportionate response for most small Canadian businesses: do not build for a regime you are not in, but do the things that are good practice anyway. Collect less, say what you collect, honour deletion requests, and keep a record of consent.

Those overlap heavily with Canadian obligations, so the work is not duplicated.

The United States

Different in shape, because there is no single federal privacy law covering this.

Instead there is a growing set of state statutes, each with its own thresholds based on revenue, the number of residents whose data is processed, or whether personal information is sold.

Most are calibrated so that small out-of-state businesses fall below them, and thresholds and states change regularly, which is why a specific list dates quickly.

What is more likely to affect a Canadian seller shipping to the United States is the practical layer rather than the privacy layer: sales tax obligations in states where economic nexus thresholds are met, customs and duties, and consumer protection rules around advertising and returns.

The duties point deserves emphasis, since it produces the most customer complaints. A parcel arriving with an unexpected charge at the door is a bad experience the buyer blames on you, so stating who pays duties before checkout is both fair and commercially sensible.

Terms, and what they can do

Worth being realistic about.

A governing law clause and a jurisdiction clause are worth having and they do not always hold against consumers, since many jurisdictions treat consumer protection rights as not excludable by contract.

What terms genuinely do: set out delivery expectations, define the refund position, limit what you promise, and state what you will not ship where.

The most effective control is not a clause. It is deciding where you ship, and enforcing it at checkout.

The simplest risk control

Limiting your shipping destinations.

A business that ships only within Canada, and configures the cart accordingly, has removed nearly all of this. That is a legitimate commercial decision and it should be stated plainly rather than discovered at checkout.

Where you do want foreign sales, opening one country at a time and understanding it is more sensible than enabling everywhere and finding out later.

Where care is genuinely needed

Regardless of size.

Selling anything regulated across a border, including supplements, cosmetics, alcohol, and anything with import restrictions.

Handling health information about people abroad.

Processing personal data as a service, rather than incidentally, since that is a different role with heavier obligations.

Marketing to children anywhere, which attracts specific rules in most jurisdictions.

The proportionate position

1. Decide where you sell, and enforce it at checkout.
2. State it on the site, before somebody fills a cart.
3. Be clear about duties and taxes for anything crossing a border.
4. Keep your privacy practices tight, which serves every regime.
5. Get advice before targeting a market, not after the orders start.

This is general information rather than legal advice, and these regimes change frequently. The Canadian baseline that most of it builds on is set out in what a privacy policy on a small Canadian site needs to say.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.