Quebec Law 25: is your website compliant?

Law 25 requires businesses that collect personal information in Quebec to review their website: forms, cookies, privacy policy. All of its provisions have applied since 22 September 2024. Here is what it changes in practice for your site, and the list of points to check.

This article is a practical guide, not legal advice: for your specific situation, consult a legal adviser or the Commission d'accès à l'information (CAI).

Law 25 in brief

Law 25 modernises Quebec's rules on the protection of personal information. It concerns businesses that collect, use or share information about people in Quebec: a name, an email address, a phone number, but also browsing data.

A brochure website with a simple contact form is therefore covered, just like an online store.

What the law changes for your website

1. A designated, published privacy officer

The business must designate a person in charge of the protection of personal information. Their title and contact details must be published on the website (CFIB). By default, this responsibility falls to the person who runs the business.

2. A clear privacy policy

Your site must set out, in plain terms, which information you collect, why, who you share it with and how a person can access it or have it corrected. A page copied from another site does not describe your real practices: it is the first point to revisit.

3. Cookies and tracking tools

If your site uses technologies that can identify, locate or profile a visitor, such as advertising cookies, you must inform them and tell them how to activate these functions (Osler). In practice: these tools stay off until the visitor has accepted them.

In concrete terms, your cookie banner must:

• make accepting and refusing equally easy;
• load analytics and advertising tools only after consent;
• let people change their mind later.

4. Forms that explain

Each form must state what the requested information will be used for. Only ask for what you need: a contact form has no reason to require a postal address or a date of birth.

5. Privacy by default

Technological products or services offered to the public must be set by default to the highest level of privacy. For a client area or an application, that means for example a profile that is not public until the user chooses to share it.

What are the penalties?

The CAI can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover. Penal sanctions handed down by a court can reach $25 million or 4% of worldwide turnover for a business (Osler).

These ceilings target serious cases. For a small business, the most common risk is simpler: a complaint from a customer, or a loss of trust when the site asks for information without explaining why.

The checklist for your website

• The privacy officer's title and contact details appear on the site.
• The privacy policy describes your real practices, in plain language.
• The cookie banner makes refusing as easy as accepting.
• Advertising and profiling tools do not load before consent.
• Each form states how the information will be used.
• Forms only ask for what is necessary.
• You know where the data is hosted and which providers have access to it.
• You have a procedure to follow in the event of a confidentiality incident.

The first four points can be checked in ten minutes, by opening your site in a private browsing window.

Do you need to rebuild your site?

Rarely. In most cases, compliance comes down to a few interventions: a properly connected cookie banner, revised forms, a rewritten privacy policy. A redesign is only justified if the site technically cannot accommodate these settings.

In practice

We already apply these principles to the sites we design, since they echo those of the European GDPR: consent before any tracking, lean forms, data hosted in a controlled way. Based in Paris, our team works remotely, by video call.

Book a call for a review of your site, or ask for a free quote: you receive it within 48 hours. Discover our website maintenance service, and our guide to bilingual websites in Quebec.