Facebook could be hauled into court amid concerns there are "serious gaps" in their policies protecting members' privacy.
The country's privacy commissioner has investigated the site and warned it could be breaking the law.
It has published a report which suggests users do not understand how to delete private information and their details could fall into the wrong hands.
If the social networking site does not address the privacy concerns within 30 days, it could
face legal action,
the report said.
The team found "serious privacy gaps" when they looked into the popular site's practices.
The commissioner was most concerned by the difficulty users have in deleting their accounts, rather than just deactivating them.
"Apps", such as games and quizzes, may also leave accounts open to abuse.
Not enough is done to stop the site's 950,000 third-party developers accessing personal information, the report said.
"We urge Facebook to implement all of our recommendations to further enhance their site, ensure they are in compliance with privacy law, and ultimately show themselves as models of privacy," Assistant Commissioner Elizabeth Denham said.
The findings are an "important contribution" to the "relatively new" debate over how social networking sites should protect personal data.
In June, Facebook unveiled new privacy controls to enable members to be more specific about which friends or strangers can access their information.
But the Canadian body still believes some areas remain confusing or incomplete.
More than 250 million people - including 12 million Canadians - have Facebook profiles worldwide.
Members have also used the site itself to voice their privacy issues.
More than 70,000 people signed up to a group called "Facebook: Stop Invading My Privacy", while nearly ae million joined a group complaining third-party apps sought friends' details.