For many businesses, Quebec’s Law 25 came down to a cookie banner added in a hurry. It’s a start. But the law asks more of a website, and the most common gaps don’t show in the banner: a privacy policy nobody can find, a form that asks for too much, tools that send data before the visitor has chosen. Here is what Law 25 requires of a website, with the corresponding sections of the law, and how to check yours.
We are developers, not lawyers. This article explains what the law asks of a website; for a specific situation, the Commission d’accès à l’information (CAI) publishes clear guides, and a lawyer can settle the question.
What Law 25 changes for a website
Law 25 modernized Quebec’s Act respecting the protection of personal information in the private sector. Its provisions came into force in stages, from 2022 to 2024. It applies to any business that collects personal information in the course of its activities, whatever its size.
A website collects some more often than people think. A contact form receives a name, an email address, a phone number. An analytics tool or an ad pixel follows a visitor’s browsing from page to page. As soon as your site does either, the law applies to it.
The privacy policy, published on the site
Section 8.2 is the easiest to comply with, and yet it is often missed. A business that collects information through technological means must publish on its website a confidentiality policy “drafted in clear and simple language”, and announce any change the same way. Section 3.2 adds the publication of detailed information about your governance rules: retention, destruction, everyone’s roles, complaint handling.
The CAI’s guide to privacy policies lists what the policy should cover: the means of collection (forms, emails, some cookies), the purposes, the people who have access to the information, the providers who process it for you, such as a newsletter tool, and how to refuse cookies. A policy copied from another site, or generated in two minutes, rarely describes your own tools. It must name what your site actually uses, and be easy to find, from the footer of every page for example.
Cookies and consent
This is where Law 25 is most misunderstood. Section 8.1 covers technologies that make it possible to identify a person, locate them or build a profile of them. You must inform the person beforehand, and the CAI specifies that these functions must be turned off by default: it is up to the visitor to turn them on. Its guide lists “some cookies” on your site among these means of collection, and cites a window for configuring cookies as one form of consent request.
That doesn’t mean the law covers every cookie. The ones that make the site work (the session, the cart, the chosen language) don’t need consent. Section 9.1, which requires the most protective settings by default, explicitly “does not apply to privacy settings for browser cookies”. It is the tools that track and profile the visitor that must wait for their choice: targeted advertising, social media pixels and, in the most cautious reading, analytics tools.
Consent itself “must be clear, free and informed and be given for specific purposes” (section 14). In practice, a real choice is visible: a Refuse button as prominent as the Accept button, and categories explained in one sentence. Consent that doesn’t meet these criteria is “without effect”, the law says.
Be wary, too, of the banner that looks good while the tools load anyway. Some Google settings load scripts before consent without warning, as we explain in our article on Google Tag Manager.
Forms: ask only for what is necessary
Before collecting information, a business must determine the purposes, and collect only what is necessary for those purposes (sections 4 and 5). The law adds a rule that settles many internal debates: “In case of doubt, personal information is deemed to be non-necessary” (section 9).
Reread your forms with that sentence in mind. A mandatory phone number for a simple question, a date of birth for a newsletter, a mailing address for an online quote request: every field must be justified. At the time of collection, the person must also know what their information will be used for and what their rights are (section 8). A short sentence under the form, with a link to the policy, is often enough.
Finally, think about what happens to the requests you receive. Once the purpose is achieved, the information must be destroyed or anonymized (section 23). Yet a WordPress site often keeps every form submission, indefinitely, on top of the emails sent. Serious form plugins let you set a retention period: Gravity Forms, for example, can automatically delete entries after the number of days you choose.
The person in charge of protecting personal information
Every business has one, whether it knows it or not. By default, it is the person with the highest authority in the business, who can delegate the function in writing (section 3.1). Their title and contact information must be published on the website.
It is the easiest gap to fix. A title and a dedicated email address, in the privacy policy or the footer, will do.
Data that leaves Quebec
Before communicating personal information outside Quebec, a business must conduct a privacy impact assessment: sensitivity of the information, purposes, protection measures, legal framework of the destination (section 17). The rule also applies when you entrust a provider outside Quebec with collecting or keeping information for you, and the communication must be covered by a written agreement.
For a website, that concerns hosting, analytics tools, the newsletter, the CRM that receives requests. It isn’t a ban: the law asks you to assess first, and to put it in writing. Mind the geography: outside Quebec starts in Ontario. A server in Toronto is outside Quebec within the meaning of the law. We discuss this in our article on choosing web hosting.
A hacked site is a confidentiality incident
Unauthorized access to personal information, its loss or its communication by mistake are confidentiality incidents (section 3.6). A hacked WordPress site whose database holds form submissions is one. The business must then limit the damage, notify the CAI and the people concerned if the incident presents a risk of serious injury, and record every incident in a register (sections 3.5 and 3.8).
The best way to handle an incident is still to avoid it: monitored updates, backups stored outside the site, and as little personal information kept as possible.
Penalties, without the drama
The CAI can impose monetary administrative penalties of up to $10 million or 2% of worldwide turnover (section 90.12), and penal fines go up to $25 million or 4% (section 91). A court can also award punitive damages of at least $1,000 for an intentional infringement or gross fault (section 93.1).
Those ceilings target serious cases. For a small business website, the most concrete risk lies elsewhere: a client’s complaint, a request from the CAI you can’t answer, or an incident discovered too late.
Check your site’s Law 25 compliance in ten minutes
No paid tool needed for a first check:
- Open your site in a private browsing window, without touching the banner. In the Network tab of the browser’s developer tools, nothing should be going out to Google Analytics, Meta or an ad network.
- Click Refuse, then browse: those same tools must stay silent.
- Find the privacy policy from the footer, and check that it describes the tools you actually use.
- Locate the title and contact information of the person in charge of protecting personal information.
- Reread every form: is every mandatory field necessary, and is the purpose of the collection stated?
- Check how long the requests you receive stay on the site and in the inboxes.
- List the tools that receive data (analytics, newsletter, CRM) and where they keep it.
If something doesn’t pass, it can usually be fixed in a few hours. On the sites we maintain, cookie consent is part of the site review at the start of the engagement, and the licence for Complianz Premium, the plugin that runs the banner, is included from the Advanced plan of our maintenance plans.
