Quebec Law 25 and your website: the complete small-business guide

If your business operates in Quebec, Law 25 applies to your website, and every part of it has been in force since September 2024. On the site itself, it means five things: publish the title and contact details of the person in charge of protecting personal information, post a privacy policy written in plain language, collect valid consent on your forms for each purpose, keep tracking tools that can identify, locate or profile visitors switched off until people agree, and assess any vendor that receives your data outside Quebec. This guide walks through each one in plain English, then gives you an order to fix things in.

This is a practical summary for business owners, not legal advice. For your specific situation, talk to a lawyer.

The law in brief

Law 25 (originally Bill 64) modernized Quebec's Act respecting the protection of personal information in the private sector. Quebec's privacy regulator, the Commission d'accès à l'information (CAI), describes a three-step rollout:

• September 2022: appoint a person in charge of personal information, manage confidentiality incidents and keep an incident register.
• September 2023: most obligations, including the privacy policy, consent rules, rules on tracking and profiling technologies, privacy by default and assessments before data leaves Quebec.
• September 22, 2024: data portability, meaning you must provide people, on request, the computerized information you collected from them in a structured, commonly used format.

Size doesn't matter. A one-person consultancy with a contact form is covered just like a large company, though what's reasonable for each is different.

If you're outside Quebec

Many English-speaking owners reading this run a business in Ontario or elsewhere and simply have Quebec customers. Outside Quebec, the federal privacy law (PIPEDA) covers most private businesses, while Alberta and British Columbia have their own; PIPEDA also applies when personal information crosses provincial or national borders. Whether Law 25 reaches a business with no establishment in Quebec is a legal question with no simple answer, so get advice if a meaningful share of your clients are in Quebec. In practice, the steps below are good hygiene under any Canadian privacy law, and they cost little.

If you do operate in Quebec, remember the language side too. Quebec's Charter of the French language requires commercial publications, including those on a website, to be in French, and the Office québécois de la langue française (OQLF) has taken businesses to court over their websites. Your privacy policy, cookie banner and forms should exist in French as well as English.

The person in charge of personal information

By default, this is the person with the highest authority in the business: usually the owner or president. They can delegate the role, in whole or in part, in writing.

Your website must show this person's title and contact details. In practice:

• Put it in your privacy policy and ideally in the site footer.
• Use a title ("Privacy Officer" and its French equivalent) rather than just a name, so it survives staff changes.
• Give a real email address that someone reads, like privacy@yourcompany.ca.

The privacy policy

The law requires a policy in clear, simple terms, published on your website, and you must tell people when it changes. A policy copied from another site or generated without editing is a liability: it describes practices that aren't yours.

A useful small-business policy answers:

• What information do you collect (forms, emails, calls, cookies, chat tools)?
• Why, purpose by purpose?
• By what means (form, analytics tool, ad pixel)?
• Who can access it, internally and at your vendors?
• Where is it stored, and does it leave Quebec?
• How long do you keep it, and how do you destroy it?
• How can someone access, correct or withdraw their information, or request portability?
• Who do they contact, and how do they complain?

Separately, the law requires internal governance policies covering retention and destruction, staff roles and complaint handling, with the key points published. Most small businesses put them on the same page as the privacy policy.

Forms

Forms are where your site collects the most personal information. The CAI says consent must be clear, free, informed, given for specific purposes and requested for each purpose, in simple terms. On a website, that means:

1. Ask only for what you use. To call someone back, you need a name, an email or phone number, and a message. Every extra field is one more thing to protect.
2. Say what the form is for, right above the button. One sentence is enough: "We use this information to answer your request," with a link to the policy.
3. Keep purposes separate. Answering a quote request and adding someone to your newsletter are two purposes. The newsletter needs its own checkbox, not pre-ticked.
4. Know where the data goes. A form that copies everything to a shared inbox, a CRM and an automation tool creates three copies, and each one counts.

For newsletters, Canada's Anti-Spam Legislation (CASL) adds its own rules on top. Express consent lasts until it's withdrawn, while implied consent from a simple inquiry only lasts six months, and every unsubscribe request must be honoured within 10 business days. Both laws apply at the same time.

Cookies and tracking

This is the change most visible on Quebec websites. The CAI sums up the rule this way: a technology that can identify, locate or profile a person must be disclosed beforehand, and the functions that allow it cannot be turned on by default.

One nuance trips people up. A separate rule requiring the highest privacy settings by default for technology products does not cover cookie settings. That doesn't exempt you from the profiling rule above, and ad pixels and remarketing tags (Meta, Google Ads, LinkedIn) exist precisely to profile. The safest reading in practice matches what European sites do: nothing non-essential fires until the visitor chooses.

How to get there:

1. Take inventory. List everything that loads on your site: Google Analytics, Google Tag Manager, Meta Pixel, Google Ads tags, heatmaps, chat widgets, embedded videos. Most sites have more than the owner thinks.
2. Sort them into essential (shopping cart, security, remembering the language choice), audience measurement, and advertising.
3. Use a banner that actually blocks. Non-essential tools stay off until the person accepts. Refusing should be as easy as accepting.
4. Connect Google's consent mode. It passes the visitor's choice to Google tags so they don't write cookies when consent is refused. Google points out that consent mode doesn't provide a banner; you still need one.
5. Test it. Open your site in a private window, click refuse, and check your browser's developer tools for ad cookies.

The most common failure is a banner that appears but lets everything load in the background anyway. It looks compliant and isn't.

Vendors and data leaving Quebec

Your site almost certainly relies on services hosted elsewhere: web host, form tool, CRM, email platform, booking calendar. Before personal information is communicated outside Quebec, the law requires a privacy impact assessment, and the transfer is only allowed if the information will be adequately protected.

For a small business this can stay simple:

• List the vendors that receive data from your site and where they host it.
• Read their data processing terms or security documentation.
• Write down your reasoning: what data, why this vendor, what protections, what risks.
• Cover it in your contract with them.

The same assessment is required before you acquire, build or overhaul an information system that handles personal information. A site rebuild that adds a new CRM is a typical example.

Confidentiality incidents

A misconfigured form exposing client requests, a hacked email account, a stolen laptop: these are confidentiality incidents. You must take steps to reduce the risk, keep a register of every incident (even minor ones) and hand it to the CAI on request. When an incident presents a risk of serious injury, you must notify the CAI and the people affected.

A spreadsheet works as a register: date, description, information involved, number of people, risk assessment, actions taken.

Penalties

The CAI can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover for the previous fiscal year, whichever is higher. It can also bring penal proceedings, with fines from $15,000 up to $25 million or 4% of worldwide turnover, doubled for repeat offences. People harmed by an intentional or grossly negligent breach can also claim punitive damages of at least $1,000.

Those ceilings are aimed at large companies. For a small business, the realistic risk is a client complaint, a question from the CAI you can't answer, or a badly handled incident that damages trust.

What to fix first

Starting from scratch, a realistic order from most visible to most internal:

1. Name your privacy officer and publish the title and an email address on the site.
2. Rewrite the privacy policy so it matches what you actually do, in plain language, in French and English.
3. Block ad and analytics cookies until consent, with a banner that offers a real choice.
4. Trim and clarify your forms, with a separate, unticked box for the newsletter.
5. List your vendors and do the assessment for those hosting data outside Quebec.
6. Start the incident register, even if it's empty, and decide who keeps it.
7. Set retention rules for quote requests, job applications and emails, then follow them.

The first three can usually be done in a few days. The rest takes some thought but rarely a big budget.

How we handle it

At PNE Solutions we treat these points as a normal part of building a site: a consent banner that truly blocks tracking until the visitor chooses, Google consent mode connected, forms cut down to what's needed, and a list of every tool that receives data, all in both languages. If your current site isn't there yet, our website design work starts with that inventory. Selling to Europe as well? Our GDPR guide for small-business websites covers the differences.

Sources

• Principaux changements apportés par la Loi 25 — Commission d'accès à l'information du Québec
• Loi 25 : ce que les PME doivent savoir — CFIB
• Loi 25 : nouveau régime d'application de la loi québécoise sur la protection des renseignements personnels — Osler
• Infraction à la Charte de la langue française : le site web de Loft Hotel inc. — Government of Quebec
• Summary of privacy laws in Canada — Office of the Privacy Commissioner of Canada
• Getting consent to send emails — Innovation, Science and Economic Development Canada
• About consent mode — Google Analytics Help