Canada (English)
Canada (English)Quebec Law 25 and your website: consent, cookies and privacy policy
Quebec's Law 25 modernized the private-sector privacy law in three stages, from 2022 to 2024. What it concretely requires from a brochure website or an online shop, and how to set it up technically.
From €1,000 per project
Law 25 in a few lines
Law 25 is the Act to modernize legislative provisions as regards the protection of personal information, adopted in 2021. For businesses, it amended the Act respecting the protection of personal information in the private sector (chapter P-39.1), and it came into force in three stages:
September 22, 2022: first provisions, including the designation of a person in charge of the protection of personal information and the reporting of confidentiality incidents.
September 22, 2023: most of the new rules, including governance policies, the privacy policy for information collected by technological means, tracking functions off by default, stricter consent and the assessment required before communicating information outside Quebec.
September 22, 2024: the right to receive computerized personal information in a structured, commonly used technological format.
The regulator is the Commission d'accès à l'information du Québec (CAI). The law applies to any person carrying on an enterprise in Quebec, whatever its size: a self-employed worker who collects personal information through a form is covered just like a large company.
What the law requires that shows on a website
A person in charge, visible on the site
Within the business, the person with the highest authority is the person in charge of the protection of personal information, and may delegate that role in writing. Their title and contact information must be published on the business's website (section 3.1).
Governance policies and a privacy policy
The business must adopt governance policies and practices for personal information and publish detailed information about them on its website, in clear and simple language (section 3.2). When it collects personal information by technological means, which covers forms, accounts, analytics and cookies, it must also publish a confidentiality policy in clear and simple language, and publish a notice when it changes (section 8.2).
Tracking functions off until the visitor activates them
When personal information is collected using technology with functions that can identify, locate or profile the person, the business must first inform them of the use of that technology and of the means available to activate those functions (section 8.1). The CAI summarizes it this way: these functions must not be activated by default. Profiling, in the law, means assessing characteristics such as preferences, interests or behaviour.
Consent that means something
Consent must be clear, free and informed, given for specific purposes, and requested for each purpose in clear and simple language. When it is asked in writing, it must be presented separately from any other information (section 14). The CAI published its guidelines on the validity of consent on October 31, 2023; they do not have the force of law, but they set out what the Commission expects.
Information that leaves Quebec
Before communicating personal information outside Quebec, a business must carry out a privacy impact assessment (section 17). A website hosted abroad, an analytics tool or a CRM based outside the province all raise this question.
What about cookies?
The law does not contain a cookie rule as such. One provision even excludes browser cookie settings from the rule on privacy settings by default (section 9.1). But the functions that cookies and similar tools enable are covered: advertising pixels, session recordings, detailed audience tracking or cross-site identifiers can identify or profile a visitor, and then fall under section 8.1 and the consent rules.
The prudent approach, and the one we apply, is the same as in Europe: strictly necessary cookies only by default, everything else off until the visitor says yes, a refusal as easy as an acceptance, and a choice that can be changed at any time.
Penalties
The CAI can impose monetary administrative penalties of up to $10,000,000 or, if greater, 2% of worldwide turnover for the preceding fiscal year (section 90.12). Penal fines range from $15,000 to $25,000,000 or, if greater, 4% of worldwide turnover for the preceding fiscal year (section 91).
How we set it up technically
Here is what we do:
An inventory of what the site really loads: cookies, pixels, analytics tools, fonts, embedded videos, forms and third-party services, with the country where each service processes the information. This list of providers and locations can be reused for your privacy impact assessment.
A consent banner that actually blocks tracking functions until the visitor activates them, with a refusal as easy as an acceptance and a link to change the choice at any time.
A privacy policy page structured around that inventory, in clear and simple language, with the title and contact details of your person in charge of the protection of personal information; its wording remains yours or your adviser's to approve.
Where possible, lean choices: cookieless audience statistics, fewer third-party services, hosting with no server to administer.
The banner and the policy in French too, like the rest of the site (see our page on Bill 96).
For an existing site, a website audit covers these points. For a new site, they are added to a website creation as options: cookieless audience statistics, or advertising trackers with a consent banner and privacy policy. Our own privacy policy shows the approach in practice. To talk it over: contact.
What we do not do
We do not give legal advice, we do not act as your person in charge of the protection of personal information, and we do not write your governance policies. We deliver a website whose technical behaviour matches what your policy says, and we document it so that you or your adviser can show it. We do not guarantee that a site complies with the law.
Frequently asked questions
Does Law 25 apply to a small business?
Yes. The obligations described here apply to any person carrying on an enterprise, with no size threshold, although the governance policies must be proportionate to the nature and scope of the business's activities. A simple contact form is enough to collect personal information.
Can I keep Google Analytics?
Yes, provided it loads only after the visitor's consent, your privacy policy describes it, and the communication of the information outside Quebec has been assessed. Cookieless audience statistics are a leaner solution when you only need to count visits.
Is a banner with only an Accept button enough?
The law does not say so in so many words, but a banner without a refusal as easy as the acceptance is hard to reconcile with free and informed consent requested for each purpose, and with tracking functions off by default. We deliver banners with a refusal as visible as the acceptance and a choice that can be changed at any time.
Sources
Texts consulted on September 27, 2026. This page describes a general framework; it is not legal advice.