Discretion Online: Protecting Your Privacy When Hooking Up in Canada
Most people who want discretion are not hiding anything terrible. They simply do not want their boss, their landlord, their ex or their aunt in Moose Jaw knowing the details of their sex life, which is a perfectly reasonable thing to want. Privacy, in this sense, is not secrecy. It is the ordinary adult expectation that some parts of your life belong to you and to the people you choose to share them with.
The difficulty is that the modern internet is built to connect things, and the connections are often invisible until they surface at the worst possible moment. The encouraging news is that most privacy failures in casual dating come from a small number of predictable mistakes. Almost all of them can be fixed with a few habits, set up once and then mostly forgotten.
The breach that taught Canada a lesson
In July 2015, a group calling itself the Impact Team announced that it had breached Ashley Madison, the dating site marketed to people seeking affairs. The site was run by Avid Life Media, a company based in Toronto. The hackers demanded that the company shut the site down, and when it did not, they followed through on their threat. In August 2015 they dumped the stolen data online: account information for millions of users, along with internal company records and emails.
The fallout was ugly and very public. People combed the leaked data for co-workers, neighbours, spouses and public figures, and journalists around the world wrote about the names they found. Extortion emails followed, demanding payment in exchange for silence. Some of the people in the data had never had an affair at all. They had signed up out of curiosity years earlier and forgotten about it, or someone else had used their email address, which was possible because the site did not verify email addresses at sign-up. A record in a database, it turned out, was treated by the public as a confession.
The Office of the Privacy Commissioner of Canada investigated jointly with the Australian Information Commissioner, and the two published their report in August 2016. It found that the company had breached Canadian and Australian privacy law, including PIPEDA, in several ways. Its security safeguards were not adequate for the sensitivity of the information it held. And it had offered users a paid "full delete" option, promising to remove their data for a fee, yet had kept some personal information belonging to people who paid for it. Users had, in effect, paid to have their data erased, and some of it remained. The company later rebranded as Ruby.
The lesson is not that nobody should ever use a hookup site. It is that every site can be breached, regardless of how reputable it appears or how firmly it promises discretion, and that it is wise to assume anything you hand over might one day become public. That single assumption, applied consistently, shapes nearly every habit described below. For more on how personals evolved through this period, our short history of online personals in Canada places the breach in context.
What Canadian law does, and what it cannot do
In Canada, the Personal Information Protection and Electronic Documents Act, known as PIPEDA, governs how private-sector organisations collect, use and disclose personal information in the course of commercial activity. It requires companies to protect personal data with safeguards appropriate to its sensitivity, to collect only what they need for their stated purposes and to keep it no longer than necessary. Quebec has its own private-sector privacy law, which was significantly strengthened by the legislation commonly called Law 25, with new obligations phased in from 2022 onward, including stronger consent rules, breach reporting and the possibility of substantial penalties. Alberta and British Columbia also have their own private-sector privacy statutes.
These laws matter. They give you the right to complain to a privacy commissioner, they give regulators the power to investigate, and, as the Ashley Madison report showed, they can produce findings that change how companies behave. But no law can undo a breach. Once your photos or messages are out, no regulator can recall them. Legal protection is a remedy after the fact, and your own habits remain the first line of defence and the only one you fully control.
A separate identity, kept in its own box
The most valuable privacy habit is also the simplest: keep your dating life in its own compartment, separate from your real-name accounts. Begin with a dedicated email address, created only for this purpose. It should not be your work email under any circumstances, and it should not be the personal account linked to your bank, your family and your professional networking profile. If a site you use is ever breached, the only thing exposed is an address that leads nowhere.
Usernames deserve the same care. People tend to reuse a favourite handle across many platforms, and if your hookup username matches your Reddit name or your gaming tag, anyone curious can search it and find the rest of your online life within a minute. Choose a username you have never used before and will never use again.
Your phone number is a more serious link than many people realise. Many messaging apps, payment apps and social networks let users find each other by phone number, so giving a new acquaintance your real cell number can hand them your full name, your photo and sometimes your contacts. Several apps provide a secondary number for calls and texts, and using one until you have met someone and decided to trust them is a sensible default. Finally, if a site invites you to sign in with a social media account, decline. Linking accounts creates exactly the connection you are trying to avoid.
Photos, where most people slip
Photos are the largest privacy risk in casual dating, for several reasons that compound one another. The first is reverse image search, which works in both directions. Free tools can search the web for matching images, which is useful when you want to check whether someone's photos have been stolen from another person, one of the classic signs of a scam. The same tools work against you. If a picture on your hookup profile also appears on your social media, your professional profile or your employer's staff page, a stranger can find your real name in seconds. The safest practice is to use photos that appear nowhere else.
The second is what appears around you. The view from your balcony, the art on your wall, a distinctive bookshelf, a workplace lanyard, a team jersey or your car in the driveway can identify you to people who know you, and occasionally to strangers who are determined enough. If you show your face, use a neutral background. If you do not show your face, be even more careful about everything else in the frame, because a tattoo or a kitchen may be all it takes. In smaller communities, where everyone knows everyone's vehicle and house, this matters even more; our guide to hooking up in small-town Canada discusses the rural version of the problem.
The third risk is invisible. Photos taken on a phone often carry embedded metadata, known as EXIF data, which can include the GPS coordinates of the place the picture was taken. Many websites strip this information automatically when you upload, but not all do, and photos sent directly by email or through some messaging apps may keep it intact. You can turn off location tagging in your camera settings, and most phones let you remove location information from a photo before sharing it. Imagine a man in Mississauga who sends a picture taken in his bedroom to someone he has never met; if the location data survived, he has, without knowing it, sent his home address.
Images, trust and sextortion
Intimate photos sent to someone you have not met are the raw material of sextortion, a crime in which a person persuades you to share explicit images or appear on video and then threatens to distribute the material unless you pay. Canadian police and Cybertip.ca warn about these schemes constantly, and they frequently begin on dating and hookup platforms. A common pattern is an attractive stranger who pushes quickly for explicit pictures or a video call, often within the first few messages. That urgency is itself a warning sign.
If it has already happened and someone is threatening you, the advice from police and support organisations is consistent: do not pay, stop engaging, and keep the evidence. Paying rarely ends the threats and often invites more. Our guide on what to do about sextortion walks through the first hour step by step. It is also worth knowing that sharing an intimate image of someone without their consent is a crime in Canada under section 162.1 of the Criminal Code. That law protects you, and it applies equally to you, a point our explainer on consent law and hookups develops further.
Your phone is the likeliest informant
A great many privacy failures involve no hacker at all. They involve someone glancing at a phone left face-up on the kitchen counter. Notification previews are the usual culprit. By default, many phones display the first line of an incoming message on the lock screen, which means a private conversation can be read by anyone nearby. Turning off previews for messaging and dating apps, so that a notification shows only that a message has arrived, is one of the most effective changes you can make, and it takes a minute.
Shared devices deserve similar caution. A family tablet, a shared laptop or a work computer is not a private space, and browser history, saved logins and autofill can reveal far more than you intend. Work devices in particular may be monitored by an employer, so they should never be used for anything personal of this kind.
Cloud photo syncing is a subtler problem. Many phones automatically upload every photo to a cloud account, and some families share albums or accounts that sync across several devices. A picture taken privately can therefore appear on a partner's tablet or in a family slideshow without anyone deliberately sharing it. Check your settings before taking anything you would not want to see on the living room television. A strong lock screen, using a real passcode rather than a birthday or a simple pattern, completes the basic protection.
Passwords and the danger of reuse
Use a password manager and a unique password for every site. This sounds like generic security advice, and it is, but it matters acutely here. When a site is breached, attackers routinely try the stolen email and password combinations on other services, a technique known as credential stuffing. If you reused the password from a hookup site on your main email account, a breach of the first can hand an attacker the second, and with it the ability to reset nearly everything else.
Turn on two-factor authentication wherever it is offered, especially on the email account tied to your dating profile. An authenticator app is generally stronger than a text message code, though either is far better than nothing. The Canadian Centre for Cyber Security publishes clear guidance on passwords and multi-factor authentication for anyone who wants more detail.
Money and the paper trail
Your credit card statement is a document other people may see, whether a spouse who manages the household budget, a parent who co-signed a card or an accountant. If you pay for anything related to your private life, such as a subscription, a hotel room or a premium feature on an app, consider how the charge will appear. Some merchants use discreet billing descriptors and some do not, and the name that appears on a statement is not always the name you would expect. One of the quieter advantages of a free site such as Leolist 2 is that there is nothing to appear on a statement at all.
Money is also where privacy and fraud meet. If someone you are chatting with asks you to pay a "verification fee," a deposit, a gift card or any other sum to prove you are real or to secure a meeting, it is a scam. These schemes often lean on your desire for discretion, betting that you will pay rather than risk embarrassment by reporting them. Our guide to scam red flags covers the common scripts, and the Canadian Anti-Fraud Centre accepts reports.
Meeting in person without broadcasting it
Discretion and safety can feel as though they pull in opposite directions. You want to keep things private, yet you also want someone to know where you are. The resolution is to tell one trusted friend the basics, meaning where you are going, when you expect to be back and the person's first name, without announcing anything more widely. Meeting in a public place first, rather than sharing your home address before you have met, protects both your privacy and your safety. Our guide to meeting strangers safely covers the rest of the preparation.
It is also worth remembering that discretion runs both ways. The person you meet is trusting you with the same information you are trusting them with. Not discussing them with mutual acquaintances, not keeping screenshots of their photos and deleting conversations when an arrangement ends are small courtesies that make the whole system work.
Small worlds and sensitive jobs
Privacy is harder in places where everyone knows everyone, and in professional circles where reputation carries real weight. Teachers, health workers, public servants, clergy and people in small industries often have more to lose from exposure than others, and they tend to adopt stricter habits as a result: no face photos until after a first conversation, vague job descriptions, meetings outside their own neighbourhood. Our Ottawa and Gatineau guide looks at what discretion means in a government town, where a security clearance can make privacy a professional concern as well as a personal one.
Imagine a public servant in Gatineau and a nurse in Saint John, strangers to each other, who share one quality: a single careless photo could cost each of them far more than embarrassment. Neither needs to avoid casual dating. Each simply needs to set up a separate email and number, choose photos that appear nowhere else, strip location data, silence notification previews and check a cloud sync setting. Done once, those steps quietly protect them for as long as they use any site.
A habit of assuming
None of this requires technical expertise or constant vigilance. It requires a single change in how you think: assume that anything you share might, someday, be seen by someone you did not intend. That assumption is not pessimism; it is simply an accurate reading of how the internet behaves, confirmed by every breach from Ashley Madison onward. Once you adopt it, the individual habits follow naturally, and most of them take only a few minutes to set up.
The point of all this care is not to make casual dating fearful. It is the opposite. People who have set up sensible boundaries tend to relax, because they are not quietly worrying about what might leak. For a wider view of how casual dating works in this country, our guide to casual dating in Canada is a good companion, and our guide to writing a personal ad that works shows how to be specific and engaging without giving away anything that identifies you. When you are ready, the free casual encounters community on Leolist 2 is organised by province, from Ontario and Quebec to British Columbia, and, like any open site, it works best when you bring these habits with you.
Sources and further reading
The account of the Ashley Madison breach draws on the joint investigation by the Office of the Privacy Commissioner of Canada and the Office of the Australian Information Commissioner into Avid Life Media, whose report of findings was published in 2016. The discussion of Canadian law refers to the Personal Information Protection and Electronic Documents Act and to Quebec's Act to modernize legislative provisions as regards the protection of personal information, commonly known as Law 25, as well as section 162.1 of the Criminal Code of Canada on the publication of an intimate image without consent. Password and authentication advice follows the Canadian Centre for Cyber Security's published guidance, and the material on sextortion and fraud reflects guidance from the Canadian Anti-Fraud Centre and Cybertip.ca.