Aria NguyenGoogle turns 28 today. Its September 27 birthday — chosen over the company's actual September 4, 1998 incorporation date after Google published its first anniversary Doodle on September 27, 2002 — has become a global trending search. But while most people are Googling "how old is Google," a more useful question runs in the other direction: after 28 years of product usage, how much does Google know about you, and what rights does Canadian law give you over that data?
What Does Google Actually Know About You After 28 Years?
Google collects data across four broad categories from its users. Identity data includes your name, email address, phone number, and payment information. Behavioural data covers every search query you have ever entered, every YouTube video watched, every app opened on an Android device, and every route navigated through Google Maps. Location data records GPS coordinates, Wi-Fi access points, and movement patterns — often stretching back years, sometimes a decade or more. Content data encompasses emails stored in Gmail, photos uploaded to Google Photos, documents held in Drive, calendar entries, and voice recordings captured by Google Assistant.
For a Canadian who opened a Gmail account in 2010 and has used an Android phone since 2012, that data archive now spans 14 to 16 years. Privacy researchers and digital forensics specialists note that a typical Android user with a Google account has amassed tens of thousands of individual data points, aggregated into an advertising and personalization profile that Google uses across its products and sells access to via its ad network.
The reach extends beyond Google's own services. Google Analytics is embedded on roughly 50% of all websites globally, which means Google tracks users' browsing behaviour across much of the internet even when they are not directly using Gmail, Search, or YouTube. Add advertising trackers, reCAPTCHA widgets, embedded Maps, and Google Fonts, and the data collection picture becomes broader still.
What Canadian Law Gives You the Right to Do
The Personal Information Protection and Electronic Documents Act — PIPEDA — is Canada's federal private-sector privacy law and the primary legal framework governing how companies like Google may collect, use, and disclose the personal information of Canadians.
Under PIPEDA, you have the right to access a full record of what personal information a company holds about you, the right to correct inaccurate data, and the right to withdraw consent for uses that are not essential to the service. Companies must respond to access requests within 30 days. If they refuse or fail to respond, you can file a complaint with the Office of the Privacy Commissioner of Canada.
In August 2025, the OPC issued a significant finding that confirmed a limited right to delist under PIPEDA: where a reasonable person would find it disproportionate for a search engine to continue surfacing links to personal information — outdated news articles, old court records, embarrassing but irrelevant content — an individual can request that Google remove those links from Canadian search results. This brought Canada meaningfully closer to the European Union's "right to be forgotten," established more than a decade ago.
For businesses and high-profile individuals who consult privacy lawyers familiar with tech platforms, the OPC's ruling has opened a new avenue for managing online reputation that previously had no clear legal basis in Canadian law.
If You've Had a Google Account Since 2008 or Earlier: What This Means in Practice
Take a specific, realistic scenario. A 41-year-old marketing director in Vancouver created a Gmail account in 2007, opened a Google Photos account in 2012, and has used an Android phone since 2014. Over 19 years, her account has accumulated: a complete history of her medical appointments (booked via Google Calendar and confirmed by email), salary negotiations conducted through Gmail, 12 years of location history showing every address she has lived at, worked from, and visited, and a voice history from Google Assistant queries including searches run during a period of mental health difficulty.
In 2025, she left a senior role at a public institution under contentious circumstances. A Google search of her name still returns a news article covering that departure. Under PIPEDA and the OPC's 2025 ruling, she has three concrete options:
Option 1 — Data access request. She can file a formal access request with Google, which is legally required to provide a full export of her personal data within 30 days. If Google misses that deadline, she can file an OPC complaint.
Option 2 — De-indexing request. She can request that Google remove the link to the 2025 news article from Canadian search results, citing the disproportionate ongoing harm relative to the public interest. If Google refuses, she can escalate to the OPC.
Option 3 — Deletion of historical data. She can request deletion of specific data categories — location history, voice recordings — that are no longer required for the purpose for which they were collected. Google offers self-service deletion tools, but a formal written request creates a legal record of the request and Google's response.
The key threshold to understand: PIPEDA's current enforcement ceiling is $100,000 in administrative penalties — a figure meaningfully below the cost of compliance failures for a company of Google's scale. However, Bill C-36, the Protecting Privacy and Consumer Data Act introduced in June 2026 and currently at first reading, would replace that cap with penalties of up to the higher of $10 million or 3% of global revenue, and criminal fines of up to $25 million or 5% of global revenue for the most serious violations. Google's global revenue exceeds $300 billion annually — meaning a 3% penalty under the proposed legislation would represent a figure approaching $10 billion. Bill C-36 has not yet passed, but its direction signals where Canadian enforcement is heading.
What Changes for You Under the New Framework
While PIPEDA remains the applicable law until Bill C-36 passes, the shift in enforcement philosophy is already visible. The OPC's 2025 delist ruling was not merely symbolic: it reflected a willingness to interpret existing law expansively to address harms that were not anticipated when PIPEDA was written in 2000. Privacy commissioners across Canada are increasingly treating data protection as a fundamental right rather than a consumer protection compliance matter.
For Canadians dealing with specific situations — unwanted personal information in search results, a company that has failed to respond to an access request, a data breach involving a Google service, or concerns about how data collected years ago is being used today — the practical pathway is a consultation with a privacy lawyer or IT specialist familiar with PIPEDA enforcement. The Canadian framework for data privacy law in 2026 is in active transition, and the gap between what existing law requires and what Bill C-36 would require is large enough that professional advice is often worthwhile before deciding whether to file a complaint or pursue stronger remedies.
What to Do Today
Google's 28th birthday is a practical prompt to take three steps. First, download your Google Takeout archive — go to takeout.google.com and request a full data export. Most people are surprised by its scope. Second, enable auto-delete settings for location history and web activity: Google allows automatic deletion after 3 or 18 months rather than indefinite retention. Third, run a search of your own name and assess whether any results warrant a de-indexing request under the OPC's 2025 ruling.
More complex situations — refused access requests, data breaches, or active harm from search results you cannot resolve through Google's self-service tools — are where a privacy lawyer adds concrete value. PIPEDA gives Canadians real rights. Google's 28th birthday is a reasonable moment to find out whether you have been using them.
This article provides general legal information, not legal advice. Consult a qualified Canadian privacy lawyer for guidance specific to your situation.
