Law 25, passed in 2021, amended Quebec's Act respecting the protection of personal information in the private sector. Its changes came into force in stages, from September 2022 to September 2024 (Commission d'accès à l'information, in French). For a small business, the website is a place where personal information is collected in its own right: forms, emails, analytics, advertising. Here is what the law requires of that website, section by section, taken from the official text and the guides of the Commission d'accès à l'information (CAI), Quebec's privacy regulator.
Key Takeaways
- A person in charge of the protection of personal information, with their title and contact information published on the website
- A privacy policy in clear and simple language
- Visitors are informed before any tracking technology, and those functions stay off until they turn them on
- Each form asks only for what is necessary and says what the information will be used for
- One consent per purpose, presented separately, as easy to refuse as to give
- Before entrusting information to a provider outside Quebec: an assessment and a written agreement
This article summarizes public rules to help you prepare your website; it is not legal advice. The sections cited are those of the Act respecting the protection of personal information in the private sector as up to date on October 15, 2026.
What the law calls personal information
"Personal information is any information which relates to a natural person and directly or indirectly allows that person to be identified" (Act respecting the protection of personal information in the private sector, s. 2). On a website, this is not only the name and email from a form. Among the information a business may collect, the CAI lists technical or digital information: IP address, connection date and time, pages visited and actions taken on a website (CAI privacy policy guide, in French). It also counts web analytics tools among the means of collection, and states that your obligations apply even if collection is entrusted to a provider (CAI, collecting personal information, in French).
A person in charge, named on the website
Within the business, the person exercising the highest authority acts as the person in charge of the protection of personal information, and may delegate all or part of that function in writing. "The title and contact information of the person in charge of the protection of personal information must be published on the enterprise's website" (s. 3.1). The CAI adds that it does not need to be notified (CAI, business responsibilities, in French).
The business must also set governance policies and practices: keeping and destroying the information, the roles of its staff and a process for dealing with complaints. Detailed information about them is published on its website in simple and clear language (s. 3.2).
The privacy policy
"Any person who collects personal information through technological means must publish on the enterprise's website, if applicable, a confidentiality policy drafted in clear and simple language and disseminate it by any appropriate means to reach the persons concerned." Any amendment to the policy requires a notice published the same way (s. 8.2). According to the CAI, this requirement has applied since September 22, 2023 to any business that collects information through technological means, such as an email address, a website or an app.
No regulation sets its content for businesses. The CAI's guide suggests these items (Writing a privacy policy, CAI, in French):
- the business name, the date the policy takes effect and the date of its last update;
- the means of collection: forms, emails received, some of the website's cookies;
- the people or organizations that collect information for you, such as a newsletter platform or an ordering platform;
- if applicable, the use of technology that can identify, locate or profile people, and how to activate those functions, which must be off by default;
- the information collected and the purposes of collection;
- the ways to refuse a collection and their consequences, for example refusing cookies and using the website without some features;
- the categories of people who have access to it within the business;
- the third parties who receive information, and whether information may be sent outside Quebec;
- if you wish, a short description of security measures;
- the rights of access, rectification and complaint, and who to contact.
The CAI points out that a website's terms of use are not a privacy policy: they may refer to it, but the two must not be merged. It also suggests writing with "you" and "we", with clear headings. And like the rest of the website, the policy must be offered in French: see our guide Bill 96 and your website.
Cookies, Google Analytics and Tag Manager
Section 8.1 covers any collection made "using technology that includes functions allowing the person concerned to be identified, located or profiled". The person must first be informed of it, and "of the means available to activate the functions" (s. 8.1). Profiling, under the same section, is the collection and use of personal information to assess certain characteristics of a person, in particular their personal preferences, interests or behaviour.
The CAI draws the rule that matters for your website: in other words, these technologies cannot be activated by default; it is up to the person concerned to activate them if they wish (CAI, main changes, in French). Its consent guidelines add that the person must take a positive action to activate them, and give the example of a magazine website that profiles its readers with cookies: it shows a window on the first visit, gives the information the law requires, then explains how to enable cookies (Guidelines 2023-1, CAI, in French).
One nuance: section 9.1 requires technological products and services to offer the highest level of confidentiality by default, but it states: "The first paragraph does not apply to privacy settings for browser cookies" (s. 9.1). For cookies, the question to ask is therefore the one in section 8.1: what are they used for? Sort every script and cookie on your website: those that make the site work (session, security, cart), those that measure the audience and those that serve advertising. The last two are the ones that raise the section 8.1 question.
In Google Tag Manager, Google's consent mode offers two setups (Google documentation):
- basic mode: "you prevent Google tags from loading until a user interacts with a consent banner". If the visitor refuses, no data is sent to Google, not even the consent status;
- advanced mode: the tags load as soon as the visitor arrives and, while consent is denied, "the Google tags send measurements without cookies".
Before choosing advanced mode, check with your adviser whether those measurements allow the visitor to be identified or profiled. The same questions apply to advertising pixels and session-recording tools.
Installing or repairing measurement in Google Analytics 4 and Google Tag Manager, along with the conversion tags of your ad platforms, with cookie consent respected: this is part of our automations and integrations service.
A banner that gives a real choice
Consent must be free. According to the CAI, it must be as easy to give consent as not to give it. Highlighting acceptance over refusal, through colour, text size, the number of clicks or deliberately ambiguous wording, can make the consent invalid. Asking again and again for a consent already refused can also undermine its free character. In one CAI example, the "I accept" and "I refuse" buttons are at exactly the same height, in the same colour and with the same text size (Guidelines 2023-1, CAI, in French).
The person must also be informed of their right to withdraw consent (s. 8). A permanent link to the cookie settings, for example in the footer, lets them change their mind.
Forms
"Any person collecting personal information on another person may collect only the information necessary for the purposes determined before collecting it" (s. 5). For the CAI, necessity goes beyond mere usefulness (CAI, collection, in French). Nor may you refuse a request for goods or services because the person refuses to give a piece of information, with exceptions such as information necessary for the conclusion or performance of a contract. "In case of doubt, personal information is deemed to be non-necessary" (s. 9). A field that does not serve the request therefore stays optional, or goes.
When information is collected, the person is informed of the purposes, the means, their rights of access and rectification and their right to withdraw consent; if applicable, of the third parties who will receive the information and of the possibility that it may be communicated outside Quebec (s. 8). By providing their information after receiving that notice, they consent to its use for the stated purposes (s. 8.3). Our loan application form guide details these items for lenders.
For any other purpose, such as a newsletter, consent "must be clear, free and informed and be given for specific purposes". It is requested for each purpose, in clear and simple language, and a written request "must be presented separately from any other information provided to the person concerned" (s. 14). In its guidelines, the CAI classes ticking a box as express consent, and a pre-checked box as implied consent (Guidelines 2023-1, in French). To use sensitive information, such as medical information, for another purpose, consent must be express (s. 12).
Emails and newsletters
Commercial prospection "may not be considered a consistent purpose", that is, one consistent with the purposes of collection (s. 12). An email address received through your contact form therefore cannot be used to send offers without consent for that purpose. When you write for prospection purposes, you must identify yourself and inform the person of their right to withdraw consent (s. 22).
Federally, Canada's Anti-Spam Legislation also requires, for a commercial electronic message, express or implied consent, information that identifies the sender, a way to contact them and an unsubscribe mechanism (CASL, s. 6).
Your providers and information leaving Quebec
Hosting, email, booking, analytics: each of these providers may receive information from your website. You may give them what is necessary for their mandate without the person's consent, but the mandate is entrusted in writing and specifies the measures they must take to protect the information, use it only for that mandate and not keep it afterwards (s. 18.3).
"Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment", and the communication must be the subject of a written agreement. The same applies when the business entrusts a person or body outside Quebec with collecting, using, communicating or keeping that information on its behalf (s. 17). The CAI gives a simple example: if you store the information with a cloud provider in Ontario, you must tell people so (CAI, collection, in French).
In practice: list every tool that receives data from your forms or visitors, with where it keeps that data. That list feeds your privacy policy, your agreements and your assessments.
Security, incidents and visitor requests
The business takes security measures that are reasonable given, in particular, the sensitivity and quantity of the information (s. 10). If a confidentiality incident presents a risk of serious injury, it must promptly notify the CAI and the people concerned (s. 3.5), and it keeps a register of confidentiality incidents (s. 3.8).
A person may ask in writing for access to their information or for its rectification (s. 30). The person in charge must reply in writing "promptly and not later than 30 days after the date the request is received"; failing a reply within that time, the request is deemed refused (s. 32). Since September 22, 2024, computerized information collected from the person must also be communicated to them, at their request, in a structured, commonly used technological format (s. 27, CAI, in French).
The penalties set by law
The CAI may impose a monetary administrative penalty, in particular on anyone who fails to inform people as section 8 requires (s. 90.1). "The maximum amount of the monetary administrative penalty is $50,000 in the case of a natural person and, in all other cases, $10,000,000 or, if greater, the amount corresponding to 2% of worldwide turnover for the preceding fiscal year" (s. 90.12). For the offences listed in section 91, fines range from $5,000 to $100,000 for a natural person and, in all other cases, from $15,000 to $25,000,000 or, if greater, 4% of worldwide turnover (s. 91). These are ceilings and ranges set by law. After a failure, a business may also enter into an undertaking with the CAI to remedy it; if the undertaking is accepted and complied with, no monetary administrative penalty may be imposed for those acts (s. 90.1).
A checklist for your website
- The title and contact information of the person in charge of the protection of personal information are published on the website.
- The privacy policy is published, dated, in clear and simple language, separate from the terms of use.
- It names the means of collection, the providers and the possibility of a transfer outside Quebec.
- Analytics and advertising tools do not load before the visitor's choice.
- The banner offers "Refuse" as easily and as visibly as "Accept".
- A permanent link lets visitors change their cookie choices.
- Each form asks only for the information that is necessary, and fields that are useful but not necessary are optional.
- A short text near the submit button says what the information will be used for and links to the policy.
- The newsletter has its own unchecked box, separate from submitting the form.
- Each commercial email identifies the business and offers a way to unsubscribe.
- Each provider that receives information has a written mandate; those outside Quebec have been assessed and are covered by an agreement.
- An access request gets a written reply within 30 days at most.
What to check first
These items change every time a tool or a campaign is added to the website. Check them first:
- an analytics tag, an advertising pixel or a session-recording tool that loads before the visitor's choice;
- a "Refuse" button that is missing, hidden on a second screen or less visible than "Accept";
- a newsletter box that is pre-checked, or merged with submitting the form;
- a privacy policy that names neither the person in charge nor the providers outside Quebec;
- required fields that do not serve the request;
- a tool added after launch (chat, booking, map, video) that does not appear in the policy.
Have your website checked
Book a discovery call: we look at your website and its pages with you before making any recommendation. For measurement and consent, our automations and integrations service installs or repairs Google Analytics 4, Google Tag Manager and your conversion tags with cookie consent respected. For forms, see our web design service: our forms are protected against bots, and each request is handled server-side before it reaches your inbox or your system. Your privacy policy and consent wording stay yours: we add them as you or your legal adviser supply them.
To see where your website stands in search, get our free SEO audit. It reports whether Google Analytics and Google Tag Manager are present in the page's code, without checking consent or Law 25.