What PIPEDA Means for Your Google Maps Timeline Data

If you used Google Maps in Canada at any point in the last decade, there is a good chance Google kept a detailed record of where you went: the coffee shop on the way to work, the cottage in August, the clinic you visited once. That record, Google Maps Timeline, used to live on Google's servers. It no longer does.

Google announced in December 2023 that Timeline would be "saved right on your device," that Location History would be off by default, and that new users would get a three-month auto-delete rather than 18 months. Backups would be encrypted so that no one, "including Google," could read them. The migration ran through 2024 and into mid-2025, with deadlines that varied by account, and the web version of Timeline is gone.

For Canadians, the change raises a practical question that the law has been slow to answer. Who is responsible for your location history now, and what does PIPEDA actually do for you?

Canadian regulators already call location data sensitive

The clearest statement from Canada's privacy watchdogs came out of the Tim Hortons app investigation. In PIPEDA Findings #2022-001, the Office of the Privacy Commissioner of Canada, working jointly with the regulators in Quebec, Alberta and British Columbia, found that a May 2019 app update had begun tracking users "as often as every few minutes," including when the app was closed. A U.S. service provider used the data to infer where people lived and worked and to flag visits to competitors. The app had been downloaded more than 8.6 million times in Canada.

The commissioners concluded that the purpose was inappropriate and that consent was not valid, and they wrote that "large volumes of granular location data… can be highly sensitive personal information." The resulting Quebec class action settled in September 2022 for a free hot drink and a baked good per eligible user, plus deletion of the data.

The other Canadian test case involved government rather than a company. The Public Health Agency of Canada used de-identified mobility data during the pandemic, including cell-tower data from Telus, covering what PHAC described as "just under 14 million Canadians." A House of Commons committee issued 22 recommendations in 2022, and the OPC's 2023 finding under the Privacy Act judged the complaints not well-founded because the risk of re-identification fell below the legal threshold.

Taken together, the two cases mark out where Canadian law stands. A company that collects precise location without meaningful consent is in breach. A government that buys aggregated location data may not be.

The law has not changed, but the demand for data has

PIPEDA dates from 2000. Its intended replacement, Bill C-27, reached committee in April 2023 and then died when Parliament was prorogued in January 2025. A successor, Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on June 15, 2026 and has not yet passed second reading. Quebec is ahead of the federal government: its private-sector law now requires businesses to tell people about any technology that can locate them and to set privacy settings to "the highest level of confidentiality by default."

While the law stood still, Canadian authorities' appetite for data held by Google grew steadily. Google's Transparency Report publishes the number of requests it receives from each country for user information.

Year	Requests from Canadian authorities	Accounts specified
2015	101	133
2016	128	211
2017	150	227
2018	409	572
2019	707	1,382
2020	1,295	2,701
2021	1,790	3,026
2022	1,873	3,180
2023	2,379	3,799
2024	3,111	5,165
2025	3,517	5,649

Chart and table: Tech Forum analysis of the Canada rows in Google's global user data requests file. Figures combine emergency disclosure and other legal requests; preservation requests are excluded. Annual totals are the sum of two half-year periods.

Canadian authorities sent Google 3,517 requests for user data in 2025, about 35 times the 101 they sent in 2015, and the number of accounts named in those requests rose from 133 to 5,649 over the same decade. The curve did not flatten in 2024 or 2025, after Google began moving Timeline off its servers.

One caveat matters here. Google does not say how many of these requests sought location data, so the table cannot tell you how often Timeline itself was handed over. What it does show is the direction of travel: the volume of requests reaching Google from Canada keeps rising, which is exactly why where your location history is stored makes a difference.

What moving Timeline to your phone changes for Canadians

The on-device design removes the most sensitive record from the place requests are sent. If Timeline lives only on your phone, with an encrypted backup Google says it cannot read, then a request to Google is no longer a request for your movement history. In the United States, Google has told the Supreme Court that it can no longer respond to geofence warrants based on Location History data. The same logic applies to a request from any country.

It does not make you invisible. Google's own Account Help notes that turning Timeline off does not stop location being saved through Web & App Activity or Search history. Carriers still keep cell-site records, and other apps still collect location under their own consent screens, as the Tim Hortons case showed.

It also shifts a responsibility onto you. Under PIPEDA, an organization must protect the personal information it holds. When the organization no longer holds it, the duty of care for that file is effectively yours.

How to keep your Timeline without handing it to someone else

If you want to keep years of travel, a record of a move, or evidence of where you were on a particular day, three steps cover most situations:

1. Check auto-delete. Google's Maps help page lists 3, 18 or 36 months as options. If you are on the three-month default and want a long record, change it before old visits disappear.
2. Export from the phone. On Android, the path is Settings, Location, Location services, Timeline, Export Timeline data. The result is a file on your device, not a cloud archive.
3. View it locally. The export is a precise log of where you sleep and work. Uploading it to a random website to look at it undoes the privacy benefit of the move. An open-source timeline visualizer that processes the file inside your browser, with no server receiving it, lets you map years of history without the data leaving your computer.

Canada's next privacy law is still in the House of Commons, and nothing in the government's announcement of Bill C-36 singles out location data. Until Parliament decides otherwise, the strongest protection most Canadians have for their location history is the one Google built into the product: keeping it on the phone, and keeping it there.

Cover image: Parliament Hill, Ottawa, via Wikimedia Commons, CC0.