Quebec Law 25 for Websites: Cookies, Consent Banners and Privacy Policies
Quebec’s Law 25 changes three things on most business websites. Tracking that can identify, locate or profile a visitor must be off until the visitor turns it on, so analytics and advertising cookies for Quebec visitors need an opt-in banner. The site must publish a privacy policy written in clear and simple terms. And the business must name the person in charge of protecting personal information, with that person’s title and contact details posted on the website. Most of these obligations have applied since September 22, 2023.
This guide covers what that means for your banner, your tags, your forms and your privacy policy. It is general information, not legal advice: privacy law depends on your facts, so confirm your own obligations with a Quebec privacy lawyer.
What Law 25 is
Law 25 is the common name for Quebec’s Act to modernize legislative provisions as regards the protection of personal information, adopted in September 2021 and phased in from 2022 to 2024. The Quebec government announced that most of its provisions came into force on September 22, 2023, and the right to data portability followed on September 22, 2024. For private businesses, the changes sit inside the Act respecting the protection of personal information in the private sector. The regulator is the Commission d’accès à l’information du Québec (CAI), which publishes a plain summary of the main changes.
Who must comply with Law 25
The private sector act applies to enterprises that collect, hold, use or share personal information in the course of business in Quebec. That covers sole proprietors and partnerships as well as companies. A business based in Ontario or British Columbia that sells to people in Quebec, takes enquiries from them or tracks their visits may also be caught, depending on how it operates there. If Quebec customers matter to your revenue, treat the law as applying and get advice on your specific case.
Website obligations at a glance
| Obligation | What it means on your website |
|---|---|
| Tracking off by default | Technology that can identify, locate or profile a visitor must be turned off until the visitor activates it. In practice: an opt-in cookie banner for analytics and advertising. |
| Privacy policy | A business that collects personal information by technological means must publish a privacy policy in clear and simple terms and tell people when it changes. |
| Person in charge | The title and contact details of the person in charge of protecting personal information must be published on the website. By default it is the person with the highest authority in the business. |
| Notice at collection | When a form collects personal information, people must be told why, how it will be used and their rights of access and correction. |
| Consent per purpose | Consent must be clear, free and informed, and given for specific purposes. Sensitive information needs express consent. |
| Incidents | A confidentiality incident that presents a risk of serious injury must be reported to the CAI and to the people affected, and every incident goes in a register. |
| Transfers outside Quebec | A privacy impact assessment is required before personal information is shared outside Quebec, which can include cloud tools and form services hosted elsewhere. |
We plan and deliver website maintenance and security for businesses in Toronto and across Canada, scoped in writing after a free review.
Do you need a cookie banner for Quebec visitors?
If your site uses cookies or scripts that can identify, locate or profile visitors, yes. The CAI’s summary says these technologies cannot be activated by default and that it is up to the person to turn them on if they choose. Advertising pixels, remarketing tags, session recording and most analytics setups fall into that group. Strictly necessary cookies, such as a shopping cart or a security token, do not identify, locate or profile anyone, so they are generally not what this rule targets.
A banner that works for Quebec has these parts:
- Opt-in, not opt-out. Analytics and advertising stay off until the visitor clicks Accept or turns a category on.
- Accept and Decline with equal weight. Same size, same prominence, one click each. A tiny “reject” link next to a large button undermines free consent.
- Categories. Let visitors choose analytics and advertising separately.
- French text. Show Quebec visitors the banner in French. The Charter of the French Language has its own rules for commercial content, so include it in your legal review.
- A way back. A “Cookie settings” link in the footer lets anyone change their choice later.
- A link to the privacy policy from the banner itself.
Canada Create runs this kind of banner on its own site: Quebec visitors get an opt-in banner in French with Accept and Decline side by side, and a Cookie Settings link in the footer reopens it at any time.
How the banner should control your tags
A banner that only displays a message does not meet the rule. The tags themselves have to wait for the visitor’s choice. If you use Google tags, Google’s consent mode sets four consent signals (ad_storage, analytics_storage, ad_user_data and ad_personalization) and offers two setups:
- Basic: Google tags do not load until the visitor interacts with the banner, and nothing is sent if they decline.
- Advanced: tags load with consent denied by default and send limited signals until the visitor chooses.
Discuss with your lawyer which setup fits your reading of Law 25. Whichever you use, check the result: open the site in a private window as a Quebec visitor, decline, and confirm in your browser’s developer tools that no analytics or advertising cookies are set. Repeat for Meta, LinkedIn, TikTok and any other pixel, since each one needs to respect the same choice.
Moving tracking to your server does not change the consent question. If events about a visitor who declined still reach an analytics or ad platform from your server, ask your lawyer whether that is collection without consent before you rely on it.
What your privacy policy must say
The act asks for a policy in clear and simple terms, published on your website. A useful policy for a small business covers:
- What personal information you collect (form fields, call recordings, chat transcripts, cookies and similar technologies)
- Why you collect it and how you use it, purpose by purpose
- Who you share it with, including service providers, and whether information leaves Quebec
- How long you keep it and how you destroy it
- How people can access, correct or ask about their information, and how to withdraw consent
- The title and contact details of the person in charge of protecting personal information
- How you will tell people when the policy changes
Write it for a customer, not a regulator. Short sections, plain words and a French version for Quebec readers.
Forms, chat and phone enquiries
Every form that asks for a name, email or phone number collects personal information. Under Law 25, tell people at that moment why you are asking and what you will do with it. A short line under the form (“We use these details to reply to your enquiry. See our privacy policy.”) plus a link usually covers it.
- Collect only what you need. If you do not use the field, remove it.
- Separate consents. Replying to an enquiry and adding someone to a newsletter are two purposes. The newsletter needs its own unticked checkbox, which also lines up with Canada’s anti-spam law.
- Chat and call recordings. Say that conversations may be recorded or stored, and for how long.
- Health or financial details. Treat these as sensitive and ask for express consent before collecting them online.
Penalties under Law 25
The CAI can impose administrative monetary penalties on enterprises of up to $10 million or 2 per cent of worldwide turnover, whichever is greater. The act also sets out penal offences. Most small businesses will never face the maximum, but a public complaint, a breach or a competitor’s report can start an inquiry.
A Law 25 website checklist
- List every cookie, pixel and script on the site and what each one does.
- Install an opt-in banner for Quebec visitors with equal Accept and Decline buttons, in French.
- Make every analytics and advertising tag wait for consent, then test with consent declined.
- Publish a clear privacy policy in English and French and link it from every form and the banner.
- Post the title and contact details of your person in charge of protecting personal information.
- Add a notice under each form and remove fields you do not use.
- Keep a confidentiality incident register and know how to report to the CAI.
- Check where your form, email and analytics providers store data, and assess transfers outside Quebec.
- Review the setup whenever you add a new tool or tracking pixel.
Banners, tag settings and privacy pages tend to drift as plugins update and new pixels are added. That upkeep is part of website maintenance and security, where the consent setup is checked along with updates, backups and security. To count form enquiries correctly once visitors have given consent, see our guide to GA4 lead tracking.
This article is general information about Quebec privacy law for website owners. It is not legal advice.
Frequently asked questions
Who must comply with Law 25?
Quebec's private sector privacy act, as amended by Law 25, applies to enterprises that collect, hold, use or share personal information in the course of business in Quebec, including sole proprietors and partnerships. A business based elsewhere in Canada that serves or tracks people in Quebec should get advice on whether it is covered. This is general information, not legal advice.
What is Bill 25 in Quebec?
People often say Bill 25 or Law 25 for Quebec's Act to modernize legislative provisions as regards the protection of personal information, which was Bill 64 before it was adopted in September 2021. It rewrote much of Quebec's private sector privacy law and was phased in from 2022 to 2024.
When did Quebec pass Law 25?
It was adopted in September 2021. Its obligations came into force in stages, with most provisions in force since September 22, 2023, and the right to data portability since September 22, 2024.
Does Law 25 apply to a business outside Quebec?
It can. The act is about personal information collected in the course of business in Quebec, so an Ontario or British Columbia business that sells to, takes enquiries from or tracks visitors in Quebec may be covered depending on how it operates. If Quebec customers matter to you, plan as if it applies and confirm with a Quebec privacy lawyer.
Do I need a cookie banner for Quebec visitors?
Yes, if your site uses technology that can identify, locate or profile visitors, such as analytics, ad pixels or session recording. The CAI says those functions cannot be activated by default; the visitor has to turn them on. An opt-in banner in French, with equal Accept and Decline buttons, is the usual way to do that.
What must a privacy policy say under Law 25?
It must be written in clear and simple terms and published on your website. A practical policy covers what you collect, why, who you share it with, where it is stored, how long you keep it, how people can access or correct their information and withdraw consent, and the title and contact details of the person in charge of protecting personal information.
Who is the person in charge of protecting personal information?
By default it is the person with the highest authority in the business, such as the owner or chief executive. Their title and contact details must be published on the business website.
What are the penalties under Law 25?
The CAI can impose administrative monetary penalties of up to $10 million or 2 per cent of worldwide turnover, whichever is greater. The act also sets out penal offences for more serious breaches.
Is there a privacy act in Canada?
Yes. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) covers private sector privacy in much of Canada, while Quebec, Alberta and British Columbia have their own private sector privacy laws.
Does Google Analytics comply with Law 25?
The tool itself is neither compliant nor non-compliant; your setup is. For Quebec visitors, analytics should wait for consent through a banner, for example with Google's consent mode, and your privacy policy should explain what is collected. Test with consent declined to confirm no analytics cookies are set.