Guide · Quebec law

Quebec's Law 25: stricter privacy for people with ads

Law 25 modernized data protection in Quebec and brought its own rules for technologies that identify, locate or profile people, such as ad cookies. This guide shows what changed in each phase, what the law asks of a site and what a mistake costs.

Audit my site now Read the guide

✓Based on Québec law and documents from the Commission d'accès à l'information
✓Practical examples for cookies and ads
✓Reads the site without changing anything

3phases of entry into force, from 2022 to 2024

10MCanadian dollars, cap on the administrative penalty for companies

2%of worldwide revenue, when that amount is greater than 10 million

2023year most of the obligations took effect

What it is

The law that reformed privacy in Quebec

Law 25 is the popular name of the Quebec law that modernized the rules on protecting personal information. It was adopted in September 2021 and amended several laws, including the Act respecting the protection of personal information in the private sector, which applies to businesses.

Quebec is one of the Canadian provinces with its own law for the private sector. That is why, for Quebec visitors and customers, Law 25 is usually the main rule, rather than the federal PIPEDA.

Enforcement is by the Commission d'accès à l'information (CAI). With Law 25, the CAI gained more powers, including the power to impose monetary administrative penalties.

The law is closer to the European GDPR than PIPEDA is. It asks for clear consent, transparency, risk assessment and a person responsible for data protection inside the company.

Checklist

What you need to meet

What Quebec's private sector law requires of a site with ads that receives visitors from the province.

1
Warn about tracking and let the person activate it
Before collecting data with technology that identifies, locates or profiles, say that you use this technology and what means exist to activate these functions. With Google tags, Consent Mode can start as denied for Quebec only.
Example
We use cookies that build a profile of your interests for ads. They only work if you activate them.
```
gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'wait_for_update': 500,
  'region': ['CA-QC']
});
```
Quality consent
Consent must be manifest, free, informed and given for specific purposes. Ask in simple and clear terms, separate from other information.
Example
Personalized ads: Activate or Do not activate. Audience measurement: Activate or Do not activate.
Express yes for sensitive data
When the information is sensitive, such as health or finances, consent must be given expressly.
Confidentiality policy on the site
Anyone who collects data by technological means must publish a confidentiality policy in simple and clear terms. Google also requires it to say that third parties, such as Google, use cookies to show ads.
Published title and contact of the person in charge
The title and contact of the person responsible for protecting personal information must be published, for example on the site.
Example
Person responsible for protecting personal information: General Director. Contact: privacy@yoursite.com
Children under 14
Information about a child under 14 cannot be collected from them without the consent of the person with parental authority, except when the collection is clearly for their benefit.
Respond within 30 days
Access or correction requests must be answered in writing within 30 days. Without a response in that time, the request is considered denied.
Incidents with serious risk
If a confidentiality incident poses a risk of serious harm, the company must notify the CAI promptly.

In practice

Right and wrong

WrongEverything is activated and the person has to look for where to turn it off.
RightPersonalized ads start off and the person chooses to activate them.
WrongThe tags build profiles before the person sees any notice.
RightFor Quebec, personalized ad tags wait for the visitor's choice.
WrongThe policy is long, vague and does not say who is responsible for the data.
RightThe confidentiality policy is simple, clear and includes the contact of the person in charge.

Official tools

Certified CMPs and official links

Google does not require a certified CMP or have its own message for Quebec, so the setup is up to the publisher and these are the official reference links.

Who it applies to

When Law 25 reaches your site

The law looks at businesses that collect, keep, use or communicate personal information of people in Quebec.

Businesses in Quebec

Any business that operates in Quebec follows the law, of any size.

Outside businesses with an audience in Quebec

Sites from other provinces or other countries that do business with Quebec residents may be covered. This analysis is a legal one.

Personal information

Any information about an individual that makes it possible to identify them, directly or indirectly, such as identifiers used for ads.

Tracking technologies

Tools that identify, locate or profile people have their own rules, which directly affect advertising cookies and tags.

Timeline

The three phases of Law 25

Entry into force was staggered over three years, starting on September 22, 2022.

September 2021
Law adopted
Quebec's National Assembly passes the law that modernizes personal information protection.
September 22, 2022
First phase
The role of the person in charge of protecting personal information and the rules on confidentiality incidents begin to apply.
September 22, 2023
Second phase, the biggest
Most of the obligations take effect: consent, the confidentiality policy, tracking technologies, impact assessments and the CAI's new powers, including administrative penalties.
September 22, 2024
Third phase
The right to portability begins to apply, letting people receive their data in a structured, commonly used technological format.

Cookies and tracking

Technologies that identify, locate or profile

Section 8.1 of the private sector act says that, before collecting information with a technology capable of identifying, locating or profiling a person, the business must inform them that it uses this technology and what means are available to activate these functions.

Profiling, for the law, is using personal information to assess characteristics of the person, such as economic situation, health, preferences or interests. That is exactly what personalized advertising cookies do.

The law speaks of means to activate these functions. The most common reading is that they start off and only begin to work when the person chooses to turn them on. That is why, for Quebec visitors, the safest model is similar to the European one: personalized ads only after a yes.

There is also section 9.1, which requires the highest level of confidentiality by default in technology products and services with privacy settings. The section itself excludes cookie settings from this point, and they remain covered by the transparency and consent rules.

Consent

What consent should look like under Law 25

The law requires quality consent, requested for each purpose and in simple terms.

Manifest

The person's will must be clear. Silence or inaction is not enough.

Free and informed

The person chooses without pressure and understands what they are accepting.

For specific purposes

The request is made for each purpose, separate from other information, in simple and clear language.

Express for sensitive data

Sensitive information, such as health or financial data, calls for express consent.

Site obligations

What the business needs to have in place

Besides the banner, Law 25 asks for structure and documents.

Person in charge of data protection

By default, this is the person with the highest authority in the business. The role can be delegated in writing, and the title and contact must be published on the site.

Confidentiality policy

Anyone who collects data by technological means must publish on the site a confidentiality policy in simple and clear terms.

Impact assessment

System projects that involve personal information, and data transfers outside Quebec, require an assessment of privacy-related factors.

Confidentiality incidents

Incidents that present a risk of serious harm must be reported to the CAI and to the people affected, and all of them must be recorded.

Governance rules

The business adopts internal rules on keeping and destroying data, roles and responsibilities, and handling complaints.

Retention and destruction

When the purpose ends, the data is destroyed or anonymized as the law requires.

Rights

What a person can ask for

Law 25 expanded the rights of people whose data is processed by businesses.

Access and rectification

See the stored data and ask for anything wrong to be corrected.

Withdraw consent

Change their mind at any time about uses that depend on consent.

De-indexing

Ask for information to stop being disseminated, or for a link with the person's name to stop leading to it, under certain conditions.

Portability

Since September 22, 2024, receive their data in a structured, commonly used format.

Enforcement and penalties

The CAI can impose high fines

Since the second phase, the CAI can impose administrative monetary penalties. For businesses, the maximum is 10 million Canadian dollars or 2% of worldwide revenue for the previous fiscal year, whichever is greater. For individuals, the cap is 50,000 Canadian dollars.

In May 2023, the CAI published a general framework with the criteria it uses to decide when to impose a penalty and how much, and when to prefer the criminal route. More serious cases can follow that path, with their own fines.

The law also gives people more strength to seek redress in court. For a site with ads, the practical risk comes from three sides: visitor complaints, a CAI investigation and the effect on reputation.

AdSense and Ad Manager

What changes for Google ads

Google does not require a certified CMP or the TCF message for Canada. The EU user consent policy applies only to the EEA, the United Kingdom and Switzerland. In other words, the setup for Quebec is the publisher's responsibility.

In practice, many publishers use the CMP to show Quebec a message with a clear choice before personalized ads. For people who refuse, the site can request non-personalized ads in Google's tags, keeping part of the revenue.

Google's publisher policies still apply: the privacy policy must explain that third parties store and read cookies to serve ads, and content directed at children cannot receive interest-based ads.

In practice

What is and is not allowed for Quebec visitors

Examples of setups that appear on sites with ads.

Allowed

Show a consent message only to Quebec visitors
Keep profiling functions off until the person turns them on
Serve non-personalized ads to people who did not accept
Publish the title and contact of the person in charge of data protection
Have a confidentiality policy in clear, simple French
A permanent link to change choices at any time

Not allowed

Turn on profiling cookies before any choice
A notice that only says the site uses cookies, with no option to turn them on or not
Bundling all purposes into a single yes
Confidentiality policy hidden or available only in another language
Use health data for ads without express consent
Treat Quebec with the same setup as the rest of Canada without assessing the law

In ConsentMode

What the audit checks for Quebec visitors

Opens the site as a Quebec visitor and shows in a screenshot whether there is a consent message and which options it offers.
Checks whether cookies and personalized ad tags load before the choice.
Identifies the CMP and compares the Quebec message with the one for the rest of Canada and for Europe.
Reads the confidentiality policy and points out whether the person in charge, the tracking technologies and the partners are missing.
Delivers a fix plan in priority order, without replacing legal analysis.

Run an audit See everything that is checked

Frequently asked questions about Law 25

Do I need a cookie banner for Quebec?

The law asks that the person be informed and have a way to turn on the identification, location and profiling functions. In practice, the simplest way to meet this is a consent message with profiling functions off by default.

Do analytics cookies count too?

It depends on what they do. If they identify or profile the person, they fall under section 8.1. Aggregated measurement without profiling carries lower risk. It is worth assessing each tool with your legal team.

What is the maximum fine?

The CAI's administrative penalty for businesses reaches 10 million Canadian dollars or 2% of worldwide revenue for the previous year, whichever is greater. The criminal route has its own fines.

Can I use the same setup as for the GDPR?

It usually covers a good part of Law 25, because it also asks for a yes before tracking. But the European TCF message is not required in Quebec, and the confidentiality policy must cite the law and the local person in charge.

Does ConsentMode replace the impact assessment?

No. The audit shows what the site does for a Quebec visitor, with screenshots and a fix plan. The impact assessment and the legal analysis remain with your team.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See your site the way a Quebec visitor sees it

The audit checks the message, cookies, CMP and confidentiality policy, and shows what to fix.

Start the audit