Quebec Law 25 and Your Website: Cookies, Consent and Privacy Policies

Short answer: Quebec Law 25 requires any business that collects personal information in the course of carrying on business in Quebec to publish a plain-language privacy policy on its website, publish the title and contact information of the person in charge of protecting personal information, and keep tracking technologies that identify, locate or profile visitors switched off until the visitor chooses to turn them on. In practice, that last rule is why Quebec-facing sites now need a real cookie consent banner, not a notice that tracking has already started.

Law 25 also changes how you handle forms, consent, data stored outside Quebec and privacy incidents. Here is what each part means for a website, with a checklist at the end.

What is Law 25?

Law 25 is the common name for Quebec's Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25), introduced as Bill 64 and adopted in September 2021. It amended several statutes. For businesses, the one that matters is the Act respecting the protection of personal information in the private sector, which Quebec's privacy regulator, the Commission d'accès à l'information (CAI), enforces.

The changes came into force in three stages:

• September 22, 2022: the person in charge of protecting personal information, and mandatory reporting of confidentiality incidents.
• September 22, 2023: most obligations, including privacy policies, the rules on identifying, locating and profiling technologies, the new consent rules, privacy impact assessments and the rules on communicating information outside Quebec.
• September 22, 2024: the right to data portability.

Who Law 25 applies to

The Act applies to personal information that a person collects, holds, uses or communicates in the course of carrying on an enterprise, which includes most businesses and many non-profits that carry on an organized economic activity. The CAI states plainly that an organization located outside Quebec that collects, holds, uses or communicates personal information in the course of its business activities in Quebec is subject to the Act.

So an Ontario or Alberta company that sells to Quebec customers, books Quebec clients or markets to Quebec residents should assume Law 25 applies to that information. Where it gets less clear is a business with no real activity in Quebec whose site happens to get Quebec visitors. The law and the CAI's guidance do not draw a bright line there. If Quebec is a market you serve, treat yourself as covered. If it is not, a lawyer can tell you where you stand, and the website changes below are good practice either way.

What Law 25 means for your website

1. A privacy policy in clear and simple language

If you collect personal information through technological means, which includes contact forms, online checkouts, account sign-ups and web analytics, section 8.2 requires you to publish a confidentiality policy on your website, drafted in clear and simple language. You must also publish notice of any changes to it. The CAI's guidance says the policy should explain what information is collected through these means and why, which third parties may receive it, the protection measures in place, your use of cookies, and people's rights and recourses.

A ten-page policy copied from a US template does not meet the “clear and simple” test. Write for the visitor. Separately, section 3.2 requires you to publish detailed information about your governance policies and practices, such as retention and destruction and how you handle complaints, also in clear language.

2. Publish your privacy officer’s title and contact information

Under section 3.1, the person with the highest authority in the business is the person in charge of the protection of personal information by default, though the role can be delegated in writing. Their title and contact information must be published on your website. A dedicated email address such as privacy@yourdomain.ca, listed in the privacy policy and footer, works well.

3. Tracking technologies must be off by default

This is the rule with the biggest technical impact. Section 8.1 says that if you collect personal information using technology with functions that can identify, locate or profile a person, you must first inform them that you use it and of the means available to activate those functions. Profiling is defined broadly, covering the analysis of a person's preferences, interests or behaviour.

The CAI reads this as meaning these functions cannot be activated by default; it is up to the person to turn them on if they wish. For a typical business site, that captures:

• Advertising pixels such as Meta, Google Ads, LinkedIn and TikTok.
• Analytics configured to track individual visitors across sessions.
• Session-recording and heat-map tools.
• Retargeting and audience-building scripts.
• IP-based geolocation used to profile visitors.

In practice: these scripts must not load until the visitor opts in. A banner that says “By using this site you accept cookies” while the pixels have already fired does not meet that standard. Your consent tool should block non-essential tags before consent, offer accept and refuse options with equal prominence, and let visitors change their minds later through a link in the footer.

A cookie banner is only as compliant as the tag configuration behind it. Test what actually loads before anyone clicks.

One nuance: a separate rule in section 9.1 requires products and services offered to the public to have the most privacy-protective settings by default, but that section expressly does not apply to browser cookie settings. The off-by-default obligation for tracking comes from section 8.1 and the CAI's interpretation of it, not from section 9.1.

4. Forms and consent

Consent under Law 25 must be clear, free and informed, given for specific purposes, and requested for each purpose in clear and simple language. A written request for consent must be presented separately from any other information. When you collect information, section 8 also requires you to tell the person the purposes, how it is collected, their rights of access and rectification, their right to withdraw consent, and, where applicable, the third parties involved and the possibility that the information could be communicated outside Quebec.

For a website form, that means:

• Collect only what you need for the stated purpose. A quote request does not need a date of birth.
• Explain the purpose at the point of collection, with a link to the privacy policy.
• Use separate, unticked checkboxes for anything beyond the core purpose, such as a newsletter.
• Do not bundle marketing consent into your terms of service.

5. Data stored outside Quebec

Before communicating personal information outside Quebec, section 17 requires you to conduct a privacy impact assessment that considers the sensitivity of the information, the purpose, the protection measures and the legal framework where it is going. The communication must be covered by a written agreement. This also applies when you entrust a service provider outside Quebec to collect or keep information on your behalf.

For websites, that catches more than people expect: hosting in Ontario or the US, a US-based form or CRM tool, an email marketing platform, an analytics provider. The CAI's own guidance gives the example of a cloud provider in Ontario. You do not have to move everything to Quebec, but you do need to know where your data goes, document the assessment, and have agreements in place. Your privacy policy should also say that information may be communicated outside Quebec.

6. Confidentiality incidents

If a breach presents a risk of serious injury, you must promptly notify the CAI and the affected people, and you must keep a register of incidents. For a website, the practical risks are an unpatched CMS or plugin, a form that emails submissions in plain text, or an exposed database. Ongoing website maintenance with timely updates and backups is part of meeting your security obligations.

Penalties under Law 25

The CAI can impose administrative monetary penalties of up to $50,000 for an individual and, for businesses, up to $10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is greater. Penal fines for offences range from $5,000 to $100,000 for individuals and from $15,000 to $25 million or 4% of worldwide turnover, whichever is greater, for businesses. Courts can also award punitive damages of at least $1,000 where an unlawful infringement is intentional or results from gross fault.

Those maximums are aimed at large organizations, but the obligations apply at any size.

Law 25 website checklist

• A privacy policy in clear, simple language is published and linked from every page.
• The title and contact details of the person in charge of personal information are published on the site.
• Information about your governance policies (retention, destruction, complaints) is published.
• Advertising pixels, cross-session analytics and session recording do not load before opt-in consent.
• The cookie banner offers accept and refuse with equal prominence, and consent can be withdrawn later.
• Forms collect only necessary fields and explain the purpose at the point of collection.
• Optional consents (newsletter, marketing) use separate, unticked checkboxes.
• You have an inventory of where website data is hosted and processed, including service providers outside Quebec.
• Privacy impact assessments and written agreements are in place for information communicated outside Quebec.
• Your CMS, plugins and server are patched, and you have an incident response plan and register.
• If you serve Quebec customers, the privacy policy and banner are available in French.

That last point overlaps with the French-language rules; see our guide to Bill 96 and your website. To see what your site loads before consent, run our free website check. It flags tracking scripts that fire before a visitor has agreed.

This isn't legal advice

This guide summarizes Quebec's private-sector privacy law and the CAI's published guidance as of October 2026. It is not legal advice, and whether Law 25 applies to your business can depend on facts a website developer cannot assess. For legal questions, talk to a privacy lawyer. For the website side, consent tools, tag configuration, forms and privacy pages, request a quote and I can help.