Is your website Law 25 compliant?

Free audit for Quebec businesses: enter a URL to check cookie consent, trackers, privacy policy, SEO, security headers and speed, with a score out of 100 and a fix list.

What Law 25 asks of your website

Quebec’s Law 25 modernized the private-sector privacy act. Since September 2023, every business that collects personal information online must meet these rules.

• Tracking off by default (s. 8.1): Cookies and tools that identify, locate or profile visitors must be off until the person turns them on.
• Clear consent (s. 8.1): Consent must be manifest, free and informed, given for specific purposes. Refusing must be as easy as accepting.
• Privacy policy online (s. 8.2): Publish a policy in clear and simple terms that explains what you collect, why, and with which tools.
• Privacy officer (s. 3.1): Publish the title and contact details of the person in charge of the protection of personal information.
• Transfers outside Quebec (s. 17): Before sending personal data outside Quebec (analytics, CRM, hosting), assess the privacy risks.
• French first (Bill 96): Your site, banner and policy must be available in French, at least as fully as in other languages.

Frequently asked questions

Is this Law 25 audit really free?

Yes. There is no sign-up and no limit beyond a few audits per minute to keep the tool fast for everyone.

Does Law 25 require a cookie banner?

If your site uses cookies or tools that identify, locate or profile visitors, such as Google Analytics or the Meta Pixel, Law 25 requires them to be off by default and turned on only with consent. A consent banner is the usual way to do that.

What fines apply under Law 25?

The Commission d’accès à l’information can impose administrative penalties of up to $10 million or 2% of worldwide turnover. Penal fines can reach $25 million or 4% of worldwide turnover.

Is Google Analytics allowed under Law 25?

Yes, with consent. Load it only after the visitor accepts, or use Google Consent Mode set to “denied” by default, and mention it in your privacy policy.

Does a good score mean my site is compliant?

No automated tool can confirm full compliance. The audit checks what is visible on your page. Compliance also covers internal policies, retention, incident handling and privacy impact assessments.

Which page should I audit?

Start with your homepage, then audit pages with forms (contact, quote, checkout), since they collect personal information.

By2Friends