There are several distinct pieces of federal and provincial Canadian retail legislation that pertain to the collection of consumers' personal information. As the Office of the Privacy Commissioner of Canada's (OPCC) website explains, these Canadian retail compliance laws are in place to safeguard the privacy of customer data and maintain transparency throughout the process of collecting these personal details.

"Essentially, these laws require retailers to clearly tell customers why they are collecting the information and then ask for the least amount to meet their purposes," the OPCC explains. "They also demand retailers to protect personal information in their care."

So what does this mean for one of the most common forms of identification in Canada—the driver's license? As the OPCC notes, many retailers regard driver's licenses as universal identity cards, when their actual purpose is simply "to demonstrate that a person is authorized to operate a motor vehicle." Retailers tend to gravitate toward the driver's license as proof of identity because it is government-issued (and therefore official), and also contains a lot of useful personal information, such as a photograph and date of birth. In some provinces, a significant number of details about a person can be gleaned directly from the license number, including year of birth and gender.

There are several ways that retailers can collect driver's license information:

- Examining a license and immediately handing it back to the customer without copying it or writing down any personal data
- Recording information from a license (such as the ID number)
- Photocopying a license

Because driver's licenses are such a valuable source of consumer data, the collection of driver's license information is highly regulated by federal and provincial private sector privacy legislation, including the federal Personal Information Protection and Electronic Documents Act, Quebec's Act Respecting the Protection of Personal Information in the Private Sector and the Personal Information Protection Acts in Alberta and British Columbia.

The legislation limits the collection, use and disclosure of consumers' personal information to "appropriate or reasonable purposes," for instance:

- Identity verification
- Fraud deterrence
- Fraud detection
- Asset recovery