Law 25 and your website: a practical checklist
Quebec's Law 25 modernized the province's private-sector privacy law. Its main obligations have applied since September 2023. A website is where most of them become visible, so it is where regulators and customers look first.
We went through this list on our own site. Here it is, in the order we would fix things.
1. Trackers off until consent
Analytics, advertising pixels and other tracking tools should not run before the visitor agrees. Technologies that can identify, locate or profile a person must be off by default. Give "Accept", "Refuse" and "Customize" the same weight, and let people change their choice later.
2. A named person in charge of privacy
By default it is the highest-ranking person in the company. Their title and contact details must be published on the website. A dedicated email address works well.
3. A privacy policy in plain language
It should say what you collect, why, which providers process it, whether it leaves Quebec, how long you keep it, and how to make a request. Write it in French, and in English if your site is bilingual.
4. A notice under every form
Contact forms, job applications, booking forms and chat assistants all collect personal information. A short line under the button should state the purpose and link to the policy.
5. Data that leaves Quebec
Hosting, email and AI providers are often outside Quebec. Law 25 asks for a privacy impact assessment before personal information is communicated outside the province.
6. A process for requests and incidents
Access and correction requests must be answered within 30 days. Keep a register of confidentiality incidents, and notify the Commission d'accès à l'information when there is a risk of serious injury.
Why it matters
Penalties under Law 25 can reach $25 million or 4% of worldwide turnover. More often, the cost is trust: visitors notice a cookie banner that does nothing.
This is general information, not legal advice. To see where your site stands, run our free Law 25 audit. It checks cookies before consent, the privacy policy, the privacy officer, and SEO basics in about 15 seconds.