Quebec's Law 25: what it changes for your website, forms and emails

We are not a law firm and this page is not legal advice. For the text of the law and its interpretation, Quebec's Commission d'accès à l'information is the authority, and a lawyer will answer a compliance question better than we will.

What we know is the other end of the problem: what the law changes in a website, in a form, in a newsletter and in the tools that receive the data. We do that every week for businesses here, and that is what this page is about.

If you want a summary of the law, go to the source. If you want to know what to change Monday morning on your site, keep reading.

The most common problem we see is not a missing banner. It is a banner that appears while the tracking tools have already started. The visitor has chosen nothing and their behaviour has already gone out to three vendors.

In practice that means analytics scripts, the advertising pixel and heatmap tools must not load until the person has accepted. Most installations we take over load everything in the page header and show the banner on top, for appearances.

Second trap: a banner with a single button. If accepting is possible and refusing is not, consent is not freely given. Refusing has to be as easy as accepting, in the same place, in one click.

Third trap: the choice is not remembered. If the banner returns on every page, either the refusal is not stored, or it is stored and ignored. Both are problems.

A contact form that quietly adds the person to the newsletter is the most widespread case, and the easiest to fix. Asking for one thing and doing another is not valid consent, whatever the fine print says.

The practical rule: one checkbox per use, unchecked by default, with a label that says what will happen. Getting an answer to your question and getting a monthly newsletter are two different things and deserve two boxes.

The box must not be glued to the terms of use either. Mixing acceptance of terms and marketing consent into a single box makes both disappear.

And you have to be able to prove consent later. That means keeping the date, the time, the exact label shown at submission and the origin. A CRM that stores only an email and a tag proves nothing.

This is the confusion we correct most often. Law 25 is provincial and covers personal information. Canada's Anti-Spam Legislation, CASL, is federal and covers commercial messages. They stack, they do not replace each other.

In practice a Quebec email list has to satisfy both: valid consent for the data, and valid consent for the sending. A business can be compliant on one side and not the other.

The concrete consequences are simple. No automatic addition after a purchase without a separate box. An unsubscribe link that works in one click and takes effect quickly. Clear identification of the sender in every message. And a record of where each address on the list came from.

The painful case: a purchased list, or one imported from an old system, where nobody knows where the addresses came from. It is unusable, and cleaning it costs more than doing it properly in the first place.

An average Quebec website sends data to a dozen places without anyone explicitly deciding to: analytics, advertising pixel, chat tool, booking system, email platform, form host, heatmap.

The first thing to do is not to choose tools, it is to make the list. Open the browser's developer tools, look at the outgoing requests on one page, and write down what you see. Almost every time there is at least one tool nobody in the company knew was still running.

Then, for each one: what data leaves, who receives it, where it is hosted, and how long it is kept. That list is what lets you write an honest privacy policy instead of a template copied from somewhere else.

Tools left connected after a supplier moved on are a category of their own. We find them nearly everywhere.

A policy copied from another site is worse than none: it describes practices that are not yours, and anyone can check that in two minutes.

What matters: that it lives at a stable address reachable from every page, that it is in French, that it says what information is collected and why, that it names the categories of third parties receiving it, that it explains how to exercise your rights, and that it gives a way to reach the person responsible at your company.

A downloadable PDF does not do the job. A web page does, and it can be corrected when the tools change.

And it has to match the reality measured in the previous step. A policy that does not mention the chat tool installed last year is wrong, even if a lawyer wrote it.

Make the list of tools receiving data on your site. One hour, the browser's developer tools, one page at a time. It is the one step you cannot skip, because everything else depends on it.

Open your forms and look at the boxes. Unchecked by default, one per use, a label that tells the truth. It is the cheapest correction and the one with the most effect.

Check the order in which your banner and your tracking scripts load. If tracking starts before the choice, the rest of the banner is decorative.

Ask your email platform where each address came from. If it cannot answer, you have found the next project.

Only then, talk to a lawyer with a list of facts rather than a general worry. You will pay less and get better answers.