Every contact form, newsletter sign-up, analytics tag and checkout on your website collects personal information. In Quebec, that puts your website squarely within Law 25, which overhauled the province’s private-sector privacy rules. Its obligations were phased in between September 2022 and September 2024, and they are all in force today. Yet many small business websites still have a generic privacy policy copied from another site, a cookie banner that does nothing, or no banner at all.
This guide breaks Law 25 website compliance down into concrete tasks: what the law requires, what it means for your forms, analytics, cookie banner and privacy policy page, and a checklist you can work through with your team or your web agency.
Important: This article is general information, not legal advice. Privacy obligations depend on your activities and the data you handle, so consult a lawyer for your situation.
What is Law 25?
Law 25 (formerly Bill 64), the Act to modernize legislative provisions as regards the protection of personal information, amended Quebec’s Act respecting the protection of personal information in the private sector. It applies to enterprises that collect, hold, use or communicate personal information about people in Quebec, regardless of size. There is no small-business exemption. The regulator is the Commission d’accès à l’information du Québec (CAI).
The obligations came into force in three phases:
| Date | Main obligations |
|---|---|
| September 22, 2022 | Designate a person in charge of the protection of personal information; manage, report and record confidentiality incidents. |
| September 22, 2023 | Governance policies; privacy policy published on your website; stricter consent rules; transparency about tracking technologies; highest privacy settings by default; privacy impact assessments for new systems and transfers outside Quebec; retention and destruction rules; new penalty regime. |
| September 22, 2024 | Data portability: providing personal information in a structured, commonly used technological format on request. |
The six pillars of Law 25 website compliance
1. A person in charge of personal information
By default, the person with the highest authority in your enterprise, often the owner or CEO, is the person in charge of the protection of personal information. That role can be delegated, in writing, to someone else inside or outside the company. Their title and contact information must be published on your website.
On your website: add the person in charge’s title and a way to reach them, such as a dedicated email address, to your privacy policy page and ideally your contact page. A role-based address (for example, a “privacy@” address) is easier to maintain than a personal one.
2. A clear privacy policy page
Since September 22, 2023, an enterprise that collects personal information through technological means must publish a privacy policy on its website, written in clear and simple terms, and give notice of any changes. When you collect information, you must also tell people why you collect it, how, who may access it, their rights of access and correction, their right to withdraw consent, and whether the information may be communicated outside Quebec.
A good website privacy policy typically covers:
- What information you collect (forms, orders, accounts, cookies, analytics, chat).
- Why you collect it and how you use it.
- Third-party service providers involved (hosting, email marketing, payment, analytics) and whether data may be stored outside Quebec.
- How long you keep it and how it is destroyed or anonymized.
- The tracking technologies you use and how to turn them on or off.
- How people can access, correct or request a copy of their information, and withdraw consent.
- The title and contact details of your person in charge, and how to file a complaint.
Link it in your footer, near forms and in your cookie banner, and publish it in French too; see our guide to Quebec’s French language rules for business websites.
3. Cookies, tracking and default privacy settings
This is where most websites fall short. Two Law 25 rules matter here:
- Tracking technologies: if you use technology that can identify, locate or profile a person, you must inform them beforehand that it is used and how to activate those functions. Profiling means using personal information to analyse things like preferences, interests or behaviour. Advertising pixels and cookies used for retargeting or audience building are typical examples.
- Privacy by default: a technological product or service offered to the public that has privacy settings must offer the highest level of confidentiality by default, without any action by the user. The law specifically excludes cookie settings of the browser from this rule, but Quebec government guidance indicates that identification, location and profiling functions should not operate until the person takes a positive action, such as clicking “Accept”.
In practice for a website:
- Use a consent management tool (a real cookie banner) that blocks non-essential cookies and tags, such as advertising pixels and remarketing tags, until the visitor accepts them.
- Give a choice that is as easy to refuse as it is to accept, with categories (necessary, analytics, marketing).
- Keep strictly necessary cookies (security, cart, language) active, and explain them.
- Configure Google Analytics and similar tools with consent mode and privacy-friendly settings, and consider whether you really need every tag you have.
- Default any account or app privacy settings you offer (public profiles, sharing options) to the most private option.
If your setup involves advertising, cross-site tracking or profiling, get legal advice on your banner configuration.
4. Forms and consent
Consent must be clear, free and informed, and requested for each specific purpose, in simple terms, separately from other information. For a website, that translates into:
- Collecting only the fields you actually need on each form.
- Explaining near the form what the information is used for, with a link to your privacy policy.
- Using an unchecked, separate checkbox for newsletters or marketing, distinct from accepting the terms or sending a quote request.
- Not collecting information from children under 14 without consent from a parent or tutor.
- Making sure form submissions are stored securely, and deleting old submissions you no longer need.
5. Confidentiality incidents
A confidentiality incident is any unauthorized access, use or communication of personal information, or its loss. Since September 22, 2022, if you have reason to believe one occurred, you must take reasonable steps to reduce the risk of harm. If the incident presents a risk of serious injury, you must promptly notify the CAI and the people affected. You must also keep a register of all incidents, even minor ones, and provide it to the CAI on request.
For your website, common incidents come from hacked sites, outdated plugins, exposed form data and weak passwords. Updates, strong authentication, monitoring and tested backups are your best prevention. That is the core of a proper website maintenance and security plan.
6. Privacy impact assessments and data portability
Before acquiring, developing or overhauling an information system or electronic service that involves personal information, you must carry out a privacy impact assessment (PIA) proportionate to the sensitivity, volume and purpose of the data. A PIA is also required before communicating personal information outside Quebec. A new website with customer accounts, a new CRM, booking system or online store are typical triggers.
The PIA must also make sure the system can return computerized personal information in a structured, commonly used technological format. That links to the portability right in force since September 22, 2024: on request, you must provide personal information collected from a person in such a format, unless it raises serious practical difficulties. For a website, choose platforms and plugins that let you export customer data (for example, to CSV or JSON) cleanly.
Penalties
Since September 22, 2023, the CAI can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, whichever is greater, for enterprises. Penal fines can reach $25 million or 4% of worldwide turnover, and they are doubled for repeat offences. Individuals can also sue for damages, including punitive damages of at least $1,000 where an infringement is intentional or results from gross fault.
Your Law 25 website compliance checklist
- Name your person in charge and publish their title and contact details on your website.
- Publish a clear, bilingual privacy policy page and link it in the footer, forms and cookie banner.
- Inventory every cookie, pixel, tag, plugin and third-party tool on your site.
- Install a consent management tool that blocks non-essential tracking until consent.
- Set Google Analytics, ad tags and embeds to respect consent choices.
- Trim forms to essential fields and add purpose statements and separate marketing opt-ins.
- Set default privacy settings on accounts or member areas to the most private option.
- Define retention periods and clean out old form entries, orders and inactive accounts.
- List service providers that store data outside Quebec and document your assessment.
- Create a confidentiality incident register and a simple response procedure.
- Run a PIA before launching a new website, CRM, online store or booking system.
- Confirm you can export a person’s data in a common format if they ask.
- Keep WordPress, themes and plugins updated, with backups and security monitoring.
Building a new site? It is much easier to build privacy in from the start than to retrofit it. We plan consent, forms and data storage as part of every website design project, including online stores. For a broader review of your digital presence, see our online presence checklist for Quebec businesses.
Frequently asked questions
Does Law 25 apply to my small business?
Yes, Law 25 applies to enterprises of all sizes that handle personal information in Quebec. The obligations are meant to be proportionate to your activities, but there is no general exemption for small businesses.
Do I need a cookie banner in Quebec?
If your website uses cookies or tags that can identify, locate or profile visitors, such as advertising and remarketing pixels, you must inform visitors and let them activate those functions. A consent banner that blocks those tools until acceptance is the most common way to do this.
Who should be my person in charge of personal information?
By default, it is the person with the highest authority in the enterprise. That person can delegate the role in writing, for example to an office manager or an external consultant. Their title and contact information must appear on your website.
What should I do if my website is hacked?
Contain the problem, secure the site, assess whether personal information was accessed and whether there is a risk of serious injury, record the incident in your register, and notify the CAI and affected people if required. Then fix the root cause.
Want your forms, cookie banner, analytics and privacy page set up properly on WordPress or Shopify? Loubane helps businesses in Montreal and across Quebec put the technical pieces in place, working alongside your legal advisor. Contact us or call or WhatsApp us at 438-933-7601.
1 Comment