Law 25 and cookies: what your website's consent banner must actually do

Law 25 in three dates

Law 25, formerly Bill 64, modernized Quebec's private-sector privacy law in phases. Since September 22, 2022, every business must have a person in charge of the protection of personal information and must report confidentiality incidents that present a risk of serious injury. Since September 22, 2023, most other obligations apply: a privacy policy in clear terms, stricter consent rules, privacy impact assessments in certain cases, and the tracking technology rules that matter for your website. Since September 22, 2024, people can also request their personal information in a structured, commonly used technological format.

Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines up to $25 million or 4%. Those are maximums for serious cases, but "we didn't know" is not a plan.

What counts as tracking technology

The law targets technology that can identify, locate or profile a person. On a typical small business website, that means:

• Analytics tools such as Google Analytics.
• Advertising pixels: Meta, Google Ads, LinkedIn, TikTok.
• Session recording and heatmap tools.
• Embeds that set their own cookies: YouTube videos, Google Maps, social feeds.
• Chat widgets and some spam protection services that send visitor data to a third party.

What usually does not count: cookies the site needs to work, such as the shopping cart, a login session, or the cookie that remembers the visitor's consent choice.

Off by default means off by default

The core rule: tell people you use these technologies and how to activate them, and keep the identifying, locating or profiling functions off until they choose to turn them on. How this applies to browser cookies specifically is debated among lawyers. The cautious reading, and the one we build to, is opt-in for everything non-essential.

A banner that does its job:

1. Loads nothing non-essential before the visitor chooses. Not "loads it and stops later".
2. Offers Accept and Refuse with equal weight: same size, same prominence, same number of clicks.
3. Explains each category in plain words. "Measure visits to improve the site (Google Analytics)" beats "Performance cookies".
4. Lets people change their mind later, from a link in the footer.
5. Shows in French to Quebec visitors, which is also a Bill 96 matter.
6. Links to your privacy policy.

What fails: "By continuing to browse, you accept cookies." Pre-ticked boxes. A Refuse button hidden on a second screen. A banner that appears after Google Analytics has already fired.

Practical tip: test it the boring way. Private window, developer tools open, Network tab filtered on "google" or "facebook". Load the page. If anything shows up before you click Accept, your banner is decoration.

Analytics and pixels without losing your mind

Opt-in means you will measure fewer visits, because some people will refuse. That is the point of the rule. Some ways to live with it:

• Question every tool. A pixel installed for one ad campaign three years ago is a liability, not an asset.
• With Google's Consent Mode, pick the setup where tags do not load before consent. The "advanced" mode sends cookieless pings beforehand, which is a hard sell under a cautious reading of Law 25.
• Consider a privacy-focused analytics tool that does not use cookies. Less needs consent, but you still disclose it in your privacy policy.
• Most analytics and ad platforms process data outside Quebec, and the law requires a privacy impact assessment before personal information is communicated outside Quebec. For a small business, that can be a short documented exercise, but it should exist.

The privacy policy and the person in charge

If you collect personal information by technological means, which any site with a form or analytics does, you must publish a privacy policy in clear and simple terms. At minimum, it should cover:

• what you collect, and through which forms and tools;
• why you collect it and what you do with it;
• which third parties receive it, and whether it leaves Quebec;
• how long you keep it;
• how people can access or correct their information, or withdraw consent;
• the title and contact information of the person in charge of the protection of personal information.

By default, the person in charge is whoever has the highest authority in the business, often the owner. The role can be delegated in writing. A dedicated email address on the site is fine, as long as someone actually reads it.

A policy copied from a template written for California or France will cite laws you are not subject to and miss the one you are. And yes, it needs to be in French.

Forms and data retention

Contact forms are where most small businesses collect personal information.

• Ask only for what you need. If you never call people back, do not make the phone number mandatory.
• Say why, right next to the form: "We use this information to answer your request. See our privacy policy."
• Keep marketing consent separate. The newsletter checkbox starts unticked, and federal anti-spam law (CASL) applies on top.
• Check where submissions go. Many WordPress form plugins store every entry in the database indefinitely, on top of emailing it. Set a retention period and purge old entries automatically.
• Some CAPTCHA services send visitor data to third parties. A honeypot field often does the job.

Law 25 requires personal information to be destroyed or anonymized once the purpose for collecting it is achieved, subject to retention periods set by other laws. "We keep everything just in case" is no longer a policy.

A lean WordPress setup

What we set up on client sites:

1. An inventory of every script and embed. Whatever nobody uses goes.
2. One consent tool that actually blocks scripts until consent, in French and English, with equal Accept and Refuse buttons and no noticeable effect on load time.
3. Third-party scripts loaded through that tool, not hard-coded in the theme or injected by five separate plugins.
4. YouTube embeds in privacy-enhanced mode or behind a click-to-load placeholder. Same for maps.
5. Form entries deleted automatically after a set period.
6. A privacy policy page, and a footer link to reopen cookie settings.
7. A private-window test after every change to tracking.

Then write it down. A one-page summary of what you collect and where it goes is worth more than any badge on your banner.

This article is general information, not legal advice. The Commission d'accès à l'information (CAI) publishes guidance for businesses; for your specific situation, check with them or a lawyer.

If you want this checked, our Bill 96 and Law 25 audit is quoted at a fixed price. Our maintenance and hosting plan, a fixed monthly fee, keeps it all working after plugin updates. Tell us what your site runs today and get a fixed-price quote.