Short answer: if your business collects personal information from Quebec residents through its website, Law 25 expects you to name a person in charge of privacy, publish a clear privacy policy, ask for valid consent, switch off tracking that can profile visitors by default, and be ready to handle a data incident. The checklist below turns those obligations into concrete website tasks.
This article is general information about website practices. It does not replace the advice of a lawyer or a privacy professional.
What is Law 25?
Law 25 is the common name of the Quebec law that modernized the province’s rules on the protection of personal information in the private sector. Its obligations came into force in stages between 2022 and 2024. It applies to businesses of all sizes, including freelancers and small shops, as soon as they collect, use, share or keep personal information. The provincial regulator is the Commission d’accès à l’information du Québec, whose official site is cai.gouv.qc.ca.
Your website is often the first place where you collect personal information: contact forms, quote requests, newsletter sign-ups, online orders, chat widgets and analytics cookies. That is why it is also the first place a customer, or the regulator, will look.
The website checklist
1. Name a person in charge of personal information
By default, the person with the highest authority in the business holds this role, but it can be delegated in writing. Publish the title and contact details of this person on your website, typically in the privacy policy and the footer. A dedicated email address such as privacy@yourdomain makes requests easier to track.
2. Publish a clear privacy policy
The policy must be written in simple, clear terms and be easy to find, usually from a link in the footer and next to every form. It should explain:
- which personal information you collect and how (forms, cookies, orders);
- why you collect it and how you use it;
- who you share it with, such as hosting providers, email platforms or payment processors;
- whether information may be stored or processed outside Quebec;
- how long you keep it and how you destroy it;
- how people can access, correct or withdraw consent, and who to contact.
3. Collect only what you need
Review every form on your site. A quote request rarely needs a date of birth or a full address. Remove optional fields you never use, mark the required ones clearly and limit the length of text fields. Collecting less reduces your risk if something goes wrong.
4. Ask for valid consent
Consent must be clear, free, informed and given for specific purposes. In practice, on a website this means a short sentence next to the submit button that explains what you will do with the information, with a link to the privacy policy. If you also want to add someone to a newsletter, ask with a separate, unchecked checkbox rather than bundling it with the quote request.
5. Cookies and tracking off by default
Law 25 requires technologies that can identify, locate or profile a person to be deactivated by default, with the person informed and able to turn them on. For most websites this concerns advertising pixels, remarketing tags and some analytics settings. A cookie banner that loads these tools only after the visitor accepts them, and that offers a real choice, is the usual solution. Test it: open your site in a private window and check which scripts load before any click.
6. Secure the forms and the site
- HTTPS on every page.
- Anti-spam protection such as a honeypot field, without collecting more data.
- Form submissions delivered to a business mailbox you control, not to a personal address shared by several people.
- Up-to-date CMS, theme and plugins, strong passwords and two-factor authentication for administrators.
- Regular backups stored securely.
- Old submissions deleted when you no longer need them.
7. Know your service providers
Hosting, email marketing, CRM, chat and booking tools all receive personal information. List them, check where they store data and keep their contracts or terms on file. If information is transferred outside Quebec, the law expects you to assess whether it will be adequately protected before doing so.
8. Prepare for a confidentiality incident
A hacked website, a misdirected email or a leaked form database can all be confidentiality incidents. Businesses must keep a register of incidents and, when an incident presents a risk of serious injury, notify the Commission and the people concerned. Write down now who decides, who contacts the web provider and where the register is kept.
Quick audit table
| Item | Where to check | Done? |
|---|---|---|
| Privacy officer named and contact published | Privacy policy, footer | ☐ |
| Clear privacy policy linked from every form | Footer, forms | ☐ |
| Only necessary form fields | Contact and quote forms | ☐ |
| Consent text and separate newsletter opt-in | Forms | ☐ |
| Tracking tags off until accepted | Cookie banner, private-window test | ☐ |
| HTTPS, updates, 2FA, backups | Hosting and admin panel | ☐ |
| Provider list and data locations | Internal document | ☐ |
| Incident register and response plan | Internal document | ☐ |
Why compliance is also good marketing
Visitors are more likely to fill in a form when they understand what happens to their information. A tidy privacy policy, a simple consent sentence and a respectful cookie banner signal a serious business. Fewer, shorter fields also tend to make forms easier to complete. If you want to measure what your site brings in, try our website ROI calculator. Keeping your site clean and trustworthy also helps with search engines; read what to check after Google’s latest spam update.
Loubane builds and maintains websites for businesses in Montreal and across Quebec, with secure forms, consent-ready cookie banners and clear privacy pages. Call or WhatsApp 438-933-7601 for a website review.
FAQ
Does Law 25 apply to a small business or a freelancer?
Yes. The law applies to any business that handles personal information in Quebec, regardless of its size.
Do I need a cookie banner?
If your site uses tools that can identify, locate or profile visitors, such as advertising pixels, they must be off by default and visitors must be able to turn them on. A consent banner is the most common way to do this.
Is a privacy policy template enough?
A template is a starting point. The policy must describe what your own website actually collects and which providers you use, so it needs to be adapted.
Where can I find official information?
The Commission d’accès à l’information du Québec publishes guidance for businesses on its official website, and a lawyer can confirm what applies to your situation.
Website, SEO or marketing: let’s talk about your project
Custom quote, starting at $999 + tax
Free, no-obligation quote. Bilingual agency based in Montreal.
Get my free quote
