New: AI Privacy Impact Assessments for teams shipping AI features. Learn about AI-PIAs
Professional services
Privacy & Security for Marketing Agencies
A marketing agency holds the keys to other companies' customers: admin seats in Meta Business Manager, Google Ads manager accounts, client ESPs, Shopify stores and the websites it builds. That access, not files on a server, is what attackers monetize and what regulators and enterprise procurement scrutinize. Privacy Horizon helps Canadian agencies lock down client account access, prove consent under CASL, meet Law 25 duties on the sites they build, and pass vendor reviews without slowing campaign delivery.
Reviewed by the Privacy Horizon team · Last reviewed
Who this is for
Digital, performance, CRM and email, creative, PR, social and web agencies across Canada, roughly five to 150 people, independent or network-owned. If your team runs paid media, mails subscription lists for clients, or hosts and maintains client websites, this practice area was built for you.
The people who typically call us: founders and COOs staring down a bank or pharma client's security questionnaire; heads of paid media who own the Business Manager and MCC hierarchy; account directors handed a data-processing addendum; dev leads responsible for client WordPress builds; and, for Quebec work, the newly named responsable de la protection des renseignements personnels.
Timing matters here. Q4 retail pushes raise the street value of ad accounts, client re-assessments follow the client's fiscal calendar, and Ontario shops with 25 or more employees owe a written electronic-monitoring policy by March 1 each year.
Services
Privacy & security services for marketing agencies
Each service below is scoped for how marketing agencies actually operate — their systems, their regulators and the reviews they face.
Virtual CISO
Virtual CISO for Marketing Agencies
vCISO for marketing agencies: fractional security leadership that owns your Business Manager and MCC access model and stands up to bank-client procurement.
Virtual Privacy Officer
Virtual Privacy Officer for Marketing Agencies
Virtual Privacy Officer for marketing agencies: consent provenance, CASL answers, Law 25 duties and client DPAs handled by a designated privacy lead.
Penetration Testing
Penetration Testing for Marketing Agencies
Penetration testing for marketing agencies: landing pages, client WordPress builds, lead-gen forms and the credential paths into ad accounts, tested properly.
Incident Response Planning
Incident Response Planning for Marketing Agencies
Incident response plan for marketing agencies: first-hour runbooks for ad-account hijacks, Page takeovers and list leaks, with OPC and CAI duties mapped out.
Privacy & Security Policy Development
Privacy & Security Policy Development for Marketing Agencies
Privacy and security policy development for marketing agencies: access and offboarding rules, AI-use limits, CASL procedures and Quebec-ready site notices.
Privacy & Security Training
Privacy & Security Training for Marketing Agencies
Privacy and security training for marketing agencies: media buyers who spot fake Meta and Google emails, account teams fluent in CASL consent, safer devices.
Vendor Security Review & Questionnaire Support
Vendor Security Review & Questionnaire Support for Marketing Agencies
Vendor security review support for marketing agencies: answer enterprise client questionnaires credibly and vet the ESPs, CDPs and freelancers behind your work.
SOC 2 Readiness
SOC 2 Readiness for Marketing Agencies
SOC 2 readiness for marketing agencies: decide whether client procurement truly requires the report, scope it to client-data systems, and prepare the evidence.
M&A Privacy & Security Due Diligence
M&A Privacy & Security Due Diligence for Marketing Agencies
M&A privacy due diligence for marketing agencies: consent records, CASL exposure, list provenance and ad-account ownership examined before the deal closes.
Minimum Viable Privacy Program
Minimum Viable Privacy Program for Marketing Agencies
Minimum Viable Privacy for marketing agencies: the $5,499 CAD/year baseline a small shop needs before its first enterprise client onboarding questionnaire.
What you hold
What your agency holds that attackers and regulators care about
The crown jewels of an agency are other people's customers and the standing access used to reach them.
Client lists and custom audiences
Emails, phone numbers and hashed identifiers exported from client CRMs for matching and suppression. They remain personal information under PIPEDA even when hashed, and the client stays accountable for what happens to them in your hands.
Ad accounts, Pages and platform seats
Partner access to Meta Business Portfolios, Google Ads manager accounts, LinkedIn Campaign Manager and TikTok Ads. One compromised seat can pour a client's budget into someone else's fraud.
Pixels, tags and lead-gen submissions
Tracking data and form fills often reveal health, financial or legal intent, which pushes them toward the sensitive end of the consent spectrum and raises the bar for how they may be used.
Browser sessions on staff devices
Media buyers stay signed in to a dozen client platforms at once. Session cookies sidestep passwords and two-factor prompts, which is exactly why infostealer malware harvests them first.
Your sending reputation and consent records
The lists you mail, the unsubscribe mechanics you operate and the proof of consent behind them: assets that one complaint can convert into liabilities.
Regulatory map
The laws that reach an agency through its campaigns
No licence or self-regulator governs agencies, but the consent-law overlay on this niche is the heaviest of any professional service we work with.
CASL treats you as a sender
Section 6 requires consent, identification of the sender and of any third party on whose behalf the message is sent, and a working unsubscribe honoured within ten business days. Section 13 places the burden of proving consent on the sender, and section 33 makes employers vicariously liable for staff.
PIPEDA and meaningful consent
Client customer data handled in commercial activity falls under PIPEDA. The OPC's consent guidelines demand emphasis on what is collected, who it is shared with, the purposes and the residual risk, with express consent for sensitive or unexpected uses.
OPC limits on behavioural advertising
Tracking data is personal information. Opt-out consent is tolerated only with clear notice, an immediate opt-out, non-sensitive data and prompt destruction; zombie cookies, fingerprinting and tracking of children are rejected outright.
Quebec Law 25 on the sites you build
Technology that identifies, locates or profiles a person must be off by default and activated by the user, privacy policies must be plain-language, and sending personal information outside Quebec, including to US ad platforms, requires a privacy impact assessment first.
Regulator findings on marketing practice
The OPC found that Home Depot sharing hashed emails and purchase details with Meta's Offline Conversions tool required express opt-in, and that Tim Hortons' granular app location tracking for marketing lacked valid consent and proportionality.
Provincial overlays
Alberta and BC PIPA govern provincially regulated clients, Alberta requires breach reporting without unreasonable delay where there is a real risk of significant harm, and Ontario's ESA obliges employers of 25 or more to publish an electronic-monitoring policy.
What goes wrong
How agencies actually get burned
The incident patterns in this niche monetize through ad spend and platform access rather than ransomware, and most start on a marketer's browser.
DuckTail and its imitators
Infostealer campaigns built for people who hold Business Manager access: they lift session cookies and two-factor codes, quietly add attacker emails to the Business account, then run fraudulent ads on the client's card.
Fake manager-account invites
Attackers send bogus Google Ads access requests, link their own MCC once accepted, and launch high-budget campaigns before anyone reconciles the billing.
A resale market for your seats
Stolen Meta and Google ad accounts trade at tiered prices in criminal markets, phishing arrives through trusted infrastructure, and recovering a hijacked account can drag on for months while campaigns sit dark.
Incidents at the platforms you depend on
Mailchimp's support-tooling compromise and the Salesloft Drift OAuth token theft both turned trusted vendor integrations into data-exfiltration paths for the customers downstream.
Consent failures that surface as complaints
A recipient who never opted in, a list quietly reused across clients, or profiling switched on by default for a Quebec build can each draw regulator attention. CASL penalties run to $10,000,000 per violation for organizations.
When organisations call us
The moments agencies pick up the phone
Almost every engagement in this niche starts with an external forcing event.
An enterprise logo is nearly signed
A bank, telco, pharma or retail client sends a security questionnaire and a data-processing addendum. Bank clients pass down OSFI B-10 third-party expectations, and the deal waits on your answers.
An ad account or Page was just hijacked
Budget burned overnight, attacker admins inside the Business account, platform support tickets crawling, and a client asking pointed questions.
A CASL complaint or consent audit lands
The CRTC makes an inquiry, or a client asks for proof of consent on the lists you have been mailing on their behalf, and the records turn out to be thinner than anyone assumed.
Quebec work arrives
A Quebec brand, or meaningful Quebec traffic, brings Law 25 duties: default-off profiling, plain-language policies, an appointed privacy officer and impact assessments before data leaves the province.
A client gates access behind controls
SSO, least privilege and audit logs become preconditions before your team is granted CRM, CDP or Shopify collaborator access, and someone has to make those real.
A buyer starts diligence
A network or private-equity acquirer treats subscription lists, consent records and ad-account ownership as diligence items, and gaps discovered late become price adjustments.
New martech or AI touches client data
A generative-AI tool or a new CDP is about to be fed client customer records, and someone finally asks whether the contracts and consents allow it.
Marketing Agencies: privacy & security questions, answered
PIPEDA governs the personal information you handle in commercial activity, CASL governs every commercial electronic message you send or cause to be sent, Quebec's Law 25 applies to work touching Quebec residents, and Alberta and BC PIPA cover provincially regulated clients. Add Ontario's ESA electronic-monitoring policy once you reach 25 employees. Which of these bites hardest depends on your client mix.
Yes. CASL reaches you directly: the agency can be the sender or the party on whose behalf a message is sent, section 9 covers aiding a violation, and directors and officers carry personal exposure under section 31. On the PIPEDA side your client remains accountable, but its contracts push safeguard and breach duties onto you, and Law 25 applies to Quebec work regardless of whose logo is on the campaign.
Efficiency. One agency compromise opens partner access to many Business Portfolios and manager accounts at once, and a stolen browser session converts to cash within hours through fraudulent ad spend. DuckTail-class malware was explicitly built to hunt digital-marketing professionals, which makes your media buyers the perimeter whether they like it or not.
The recurring asks are single sign-on, named accounts instead of shared logins, least-privilege roles on ad and CRM platforms, audit logging, proof of offboarding when staff or freelancers roll off, an incident response plan, and evidence of training. Larger procurement teams may also request a SOC 2 report or a completed questionnaire mapped to their framework.
Sometimes, but only inside the OPC's conditions for online behavioural advertising: obvious notice, an opt-out that works immediately, no sensitive categories and limited retention. The Home Depot finding shows where the line sits, since matching hashed emails to Meta for offline conversions was held to need express opt-in. Anything unexpected or sensitive should be treated as an express-consent use.
In this niche the two are the same fabric. Consent provenance, CASL identification and Law 25 duties are privacy questions; session theft, MCC hijacks and ESP compromises are security questions; and the client access model sits underneath both. That is why we scope engagements across the pair rather than one half.
Answers & guides
- What is PIPEDA, and does it apply to my business?
- What's the difference between data privacy and cybersecurity?
- How do we prepare for a customer security questionnaire?
- What should I do after a data breach?
- The Canadian Privacy Law Landscape in 2026: PIPEDA, PHIPA, and Quebec Law 25
- The First 24 Hours After a Privacy Breach: A Canadian Response Playbook
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.