Law 25 consent forms: concrete examples

Most consent forms on Quebec SMB websites share a common flaw: they were copied from a European template, or written to reassure the business rather than inform the customer. The result fails the test set by section 14 of the Act respecting the protection of personal information in the private sector, the law everyone calls Law 25. If you are starting from zero, begin with our summary of Law 25 obligations for SMBs; here, we focus on one specific piece: the consent request itself.

The heart of the law fits in one sentence: consent must be "manifest, free, informed and given for specific purposes". Four conditions, followed by a quiet penalty at the end of the same section: consent that does not meet them is "without effect". Not fixable, not negotiable: void. A business relying on it is using personal information with no valid basis.

This article breaks down what those four words demand, the two flaws that void most forms, the situation where asking for consent is itself a mistake, and reusable wording for four common cases.

The short answer, for the busy

Valid consent under Law 25 must be manifest, free, informed and given for specific purposes: that is section 14 of Quebec's Act respecting the protection of personal information in the private sector. It must be requested for each purpose, in clear and simple language, and, when requested in writing, presented separately from any other information. Quebec's privacy regulator, the Commission d'accès à l'information, derives eight criteria from this in its 2023-1 guidelines: manifest, free, informed, specific, granular, understandable, temporary and distinct. In practice, a pre-checked box is not express consent, a bundled all-or-nothing acceptance is not granular, and making marketing consent a condition of service means it is not free. Sensitive information, medical, biometric or otherwise intimate in nature, requires express consent. Consent that fails these conditions is "without effect", and administrative penalties can reach $10 million or 2% of worldwide turnover.

What section 14 demands, word by word

Section 14 sets four substantive conditions. Manifest: consent must be obvious, given in a way that leaves no doubt about the person's intent. Free: given with a real choice and no pressure, which rules out making it a condition of service when the purpose is not necessary. Informed: the person knows which information is involved, what it will be used for, and who will receive it. Specific: no blanket agreement "to the use of my information", but an answer to one named purpose.

The same section adds requirements of form. Consent is requested for each purpose, in clear and simple language. When the request is in writing, it must be presented separately from any other information given to the person: a sentence buried in the terms of use does not count. This is also why your privacy policy is not a substitute for a consent request: it informs, it asks for nothing. Finally, consent is only valid for the time needed to achieve the purposes it was requested for.

Quebec's privacy regulator, the Commission d'accès à l'information (CAI), translated all of this into eight criteria in its Guidelines 2023-1 on the validity of consent, published in October 2023: manifest, free, informed, specific, granular, understandable, temporary and distinct. That document is the reference the CAI uses when it evaluates a form, and the stakes are not theoretical: administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines go higher still.

The two flaws that void most forms

The first flaw is bundling. A single checkbox reading "I accept the privacy policy and agree to receive communications" mixes three different things: acknowledging a document, delivering the service, and marketing. The CAI is explicit: consent must be granular, requested for each purpose, and if the person can only accept or refuse as a block, it is not free either. The practical rule: one box per purpose, and no marketing purpose attached to a purchase or a quote request.

The second is the pre-checked box. In the CAI's guidelines, a box that comes checked and can be unchecked qualifies as implied consent, never express consent. Express consent is mandatory for sensitive information and recommended everywhere else, because it is easier to document and leaves no doubt about the person's actual intent. The CAI adds a fairness rule that condemns most interface patterns imported from the English-speaking web: refusing must be as easy as accepting. A prominent "Accept" button next to a pale grey "Refuse" link in small print is contestable consent, whatever the text says.

When asking for consent is a mistake

Here is the point that even well-intentioned businesses miss: consent is not the basis for everything. Information necessary to deliver the product or service the person asked for needs no checkbox. If a customer gives you their address for a delivery, you do not need their permission to use that address to deliver. The CAI puts it plainly: by providing their information for a stated primary purpose, the person consents to the use necessary for that purpose. Your obligation there is transparency at the moment of collection, not a form.

Asking for consent where none is needed is not caution, it is a design error. First, because consent can be withdrawn: what do you tell the customer who "withdraws consent" to a use you cannot deliver the contract without? You have just implied a choice that does not exist. Second, because every pointless checkbox dilutes the ones that matter: the CAI calls this consent fatigue, and recommends against soliciting people for nothing.

Watch out for the opposite temptation, though. Section 12 of the Act lists the cases where information may be used without fresh consent, notably for purposes "consistent with" the original collection. And it states in black and white that commercial or philanthropic prospecting can never be a consistent purpose. Marketing always requires its own consent. A customer who bought from you once did not give you the right to email them every week.

Four concrete cases, with wording that passes the test

The newsletter

An unchecked box, next to the form but separate from the submit button, with text like: "I want to receive [company]'s monthly newsletter: tips and updates. Unsubscribe in one click, anytime." One purpose, plain language, a stated frequency, a visible way out. A non-negotiable bonus: Canada's federal anti-spam law (CASL) requires opt-in consent for commercial electronic messages anyway, along with sender identification and an unsubscribe mechanism. A form designed for Law 25 keeps you onside there too.

Marketing cookies

Cookies necessary for the site to function need no consent. Everything else, identifiable audience measurement, advertising, retargeting, must be off by default and offered per purpose, with "Refuse all" as accessible as "Accept all". Wording that holds up: "We use cookies necessary for the site to work. With your agreement, we also use them to measure our audience and for advertising. You can accept or refuse each use, and change your mind at any time."

Client photos and testimonials

A photograph is personal information; the CAI cites it as an example in its guidelines. Publishing a client's photo or testimonial for promotional purposes is a distinct purpose from the service you delivered: it needs its own consent, with the channels and the duration spelled out. For instance: "I authorize [company] to publish my photo and testimonial on its website and social media, for promotional purposes, for two years. I can withdraw my authorization at any time by writing to [email]." The time limit comes from the law itself: consent is only valid for the time the purpose requires.

Sensitive information

The Act defines information as sensitive when, by its medical, biometric or otherwise intimate nature, or because of the context of its use, it carries a high reasonable expectation of privacy. To use or share it, consent must be express: an active, unambiguous gesture, such as a dedicated checkbox or a signature, never an inference. A clinic collecting health history, a broker handling financial documents, a business deploying a conversational agent that may receive confidences: all of them should isolate that request in its own paragraph and name who will access the information and why. If an automated system is involved, our article on AI agents and Law 25 covers the additional obligations.

A good form is a symptom

A compliant consent form is the visible sign of sound design: the business knows which purposes it pursues, collects only what it needs, and therefore has only one or two boxes to offer. If your form needs six checkboxes, the problem is not the wording, it is the collection. That is the kind of question we settle upstream when designing a site as part of our web services, rather than by taping a banner over it at the end.

If you want a second look at your current forms, write to us. We will tell you what passes the test and what does not.

→ Tell us about your site

This article explains legal obligations to help an SMB ask the right questions; it is not legal advice. The official texts, Quebec's Act respecting the protection of personal information in the private sector (LégisQuébec) and the Commission d'accès à l'information's Guidelines 2023-1, prevail. For your specific situation, consult a lawyer.