Guides

Quebec Law 25 and cookies: what your website needs to do

Tarek RimanUpdated 3 min read

Short answer

Since September 22, 2023, Quebec's Law 25 requires websites that use technology able to identify, locate or profile visitors to tell them about it and keep those functions off by default. In practice, that means asking before loading analytics and advertising trackers for Quebec visitors and letting them refuse as easily as they accept.

Key takeaways

  • Tracking that can identify, locate or profile people must be off by default for Quebec visitors.
  • Visitors must be told what is used and how to turn it on.
  • Essential cookies needed to run the site do not need a choice.
  • Penalties can be significant, so keep proof of each choice.

Quebec’s Act to modernize legislative provisions as regards the protection of personal information, known as Law 25, changed the private sector privacy law in stages between 2022 and 2024. The part that matters most for cookies took effect on September 22, 2023.

What Law 25 says about tracking technology

Section 8.1 of the private sector act covers technology that can identify, locate or profile a person. If you collect personal information using such technology, you must inform the person that it is used and explain how they can activate those functions. Section 9.1 adds that the privacy settings of a technological product or service must offer the highest level of confidentiality by default, without any action from the person.

For a website, analytics, advertising pixels, session replay and similar tools usually fall into this category because they track behaviour across pages or visits. The practical result is simple: for visitors in Quebec, those tools should stay off until the visitor turns them on.

What this means for your banner

  • Opt-in, not opt-out. Load analytics and ad tags only after the visitor agrees.
  • Clear information. Say what each category does in plain French and English.
  • A real choice. Refusing should be as easy as accepting. A hidden or greyed out refuse button does not meet the spirit of the law.
  • A way to change your mind. Keep a cookie settings link or button available on every page.

Cookies strictly needed for the site to work, such as a shopping cart, a login session or load balancing, do not identify or profile people for another purpose and can run without a choice. Analytics, advertising, social media pixels and session recording tools generally need consent. If you are unsure about a tool, treat it as non-essential until you confirm otherwise. Our cookie audit guide helps you build the list.

Step by step

  1. List your cookies and trackers. Scan the site and sort each cookie into essential, functional, analytics or marketing.
  2. Set Quebec to opt-in. Configure your banner so non-essential categories stay off for Quebec visitors until they agree.
  3. Write the banner in French and English. French must be available. Use plain words for each category.
  4. Give equal Accept and Reject buttons. Make both choices the same size, colour and weight on the first screen.
  5. Publish a cookie policy and keep records. Link to a policy that lists your cookies, and keep a log of every choice with a date.

Penalties and enforcement

The Commission d’accès à l’information du Québec (CAI) oversees the law. Law 25 introduced administrative monetary penalties of up to 10 million dollars or 2% of worldwide turnover, and penal fines of up to 25 million dollars or 4% of worldwide turnover, whichever is greater. Individuals can also bring claims for damages in some cases. Keeping a record of each consent choice is the easiest way to show you did what the law asks.

Law 25 compared to the rest of Canada

Outside Quebec, the federal PIPEDA applies to most private businesses and allows opt-out consent for some online advertising when certain conditions are met. Many businesses with visitors across Canada apply the stricter Quebec rule to Quebec visitors and a notice-based approach elsewhere. See our comparison of Law 25, PIPEDA, US laws and GDPR.

This guide is general information, not legal advice. Review your setup with a lawyer who knows Quebec privacy law.

Frequently asked questions

Does Law 25 apply to businesses outside Quebec?

It applies to businesses that collect personal information from people in Quebec in the course of doing business there. If you have Quebec visitors or customers, plan as if it applies and confirm with counsel.

Is a cookie wall allowed under Law 25?

Law 25 does not mention cookie walls directly. Blocking the whole site unless people accept tracking is hard to square with privacy by default, so most businesses avoid it.

Do I need my banner in French?

Quebec's Charter of the French language generally requires French for commercial content aimed at Quebec. A bilingual banner covers both needs.

How long should I keep consent records?

Law 25 does not set a fixed period for consent logs. Many businesses keep them for as long as the consent is relied on plus a margin, often one to two years.

About the author

Tarek Riman

Founder of North Consent and Riman Agency in Montreal. He builds and optimizes websites for brands in Canada and the US.

Keep reading