Most consent forms on Quebec SMB websites share a common flaw: they were copied from a European template, or written to reassure the business rather than inform the customer. The result fails the test set by section 14 of the Act respecting the protection of personal information in the private sector, the law everyone calls Law 25. If you are starting from zero, begin with our summary of Law 25 obligations for SMBs; here, we focus on one specific piece: the consent request itself.
The heart of the law fits in one sentence: consent must be "manifest, free, informed and given for specific purposes". Four conditions, followed by a quiet penalty at the end of the same section: consent that does not meet them is "without effect". Not fixable, not negotiable: void. A business relying on it is using personal information with no valid basis.
This article breaks down what those four words demand, the two flaws that void most forms, the situation where asking for consent is itself a mistake, and then delivers what most guides promise without providing: a complete form template, line by line, to copy and adapt, followed by ready-to-use wording for five common cases.
The short answer, for the busy
Valid consent under Law 25 must be manifest, free, informed and given for specific purposes: that is section 14 of Quebec's Act respecting the protection of personal information in the private sector. It must be requested for each purpose, in clear and simple language, and, when requested in writing, presented separately from any other information. Quebec's privacy regulator, the Commission d'accès à l'information, derives eight criteria from this in its 2023-1 guidelines: manifest, free, informed, specific, granular, understandable, temporary and distinct. In practice, a pre-checked box is not express consent, a bundled all-or-nothing acceptance is not granular, and making marketing consent a condition of service means it is not free. Sensitive information, medical, biometric or otherwise intimate in nature, requires express consent. Consent that fails these conditions is "without effect", and administrative penalties can reach $10 million or 2% of worldwide turnover. No official form exists: the template below stands in for one.
What section 14 demands, word by word
Section 14 sets four substantive conditions. Manifest: consent must be obvious, given in a way that leaves no doubt about the person's intent. Free: given with a real choice and no pressure, which rules out making it a condition of service when the purpose is not necessary. Informed: the person knows which information is involved, what it will be used for, and who will receive it. Specific: no blanket agreement "to the use of my information", but an answer to one named purpose.
The same section adds requirements of form. Consent is requested for each purpose, in clear and simple language. When the request is in writing, it must be presented separately from any other information given to the person: a sentence buried in the terms of use does not count. This is also why your privacy policy is not a substitute for a consent request: it informs, it asks for nothing. Finally, consent is only valid for the time needed to achieve the purposes it was requested for.
Quebec's privacy regulator, the Commission d'accès à l'information (CAI), translated all of this into eight criteria in its Guidelines 2023-1 on the validity of consent, published in October 2023: manifest, free, informed, specific, granular, understandable, temporary and distinct. That document is the reference the CAI uses when it evaluates a form, and the stakes are not theoretical: administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines go higher still.
The two flaws that void most forms
The first flaw is bundling. A single checkbox reading "I accept the privacy policy and agree to receive communications" mixes three different things: acknowledging a document, delivering the service, and marketing. The CAI is explicit: consent must be granular, requested for each purpose, and if the person can only accept or refuse as a block, it is not free either. The practical rule: one box per purpose, and no marketing purpose attached to a purchase or a quote request.
The second is the pre-checked box. In the CAI's guidelines, a box that comes checked and can be unchecked qualifies as implied consent, never express consent. Express consent is mandatory for sensitive information and recommended everywhere else, because it is easier to document and leaves no doubt about the person's actual intent. The CAI adds a fairness rule that condemns most interface patterns imported from the English-speaking web: refusing must be as easy as accepting. A prominent "Accept" button next to a pale grey "Refuse" link in small print is contestable consent, whatever the text says.
When asking for consent is a mistake
Here is the point that even well-intentioned businesses miss: consent is not the basis for everything. Information necessary to deliver the product or service the person asked for needs no checkbox. If a customer gives you their address for a delivery, you do not need their permission to use that address to deliver. The CAI puts it plainly: by providing their information for a stated primary purpose, the person consents to the use necessary for that purpose. Your obligation there is transparency at the moment of collection, not a form.
Asking for consent where none is needed is not caution, it is a design error. First, because consent can be withdrawn: what do you tell the customer who "withdraws consent" to a use you cannot deliver the contract without? You have just implied a choice that does not exist. Second, because every pointless checkbox dilutes the ones that matter: the CAI calls this consent fatigue, and recommends against soliciting people for nothing.
Watch out for the opposite temptation, though. Section 12 of the Act lists the cases where information may be used without fresh consent, notably for purposes "consistent with" the original collection. And it states in black and white that commercial or philanthropic prospecting can never be a consistent purpose. Marketing always requires its own consent. A customer who bought from you once did not give you the right to email them every week.
Why there is no official form
Many people search for "the" Law 25 consent form, as if there were a government document to download. There is none. The CAI's page of forms and template letters offers a single consent model, the one for biometric information (September 2022), because biometrics fall under a special regime. Some professional orders supply a model to their members, the OACIQ for real estate brokers for instance. For an ordinary business there is nothing official, and that makes sense: the law requires consent to be specific to your purposes, so a universal form would be non-compliant by construction.
That vacuum has been filled by templates that circulate from one site to the next: forms from foundations, condo syndicates, public health bodies. Most date from the fall of 2023 and look alike: an introductory paragraph, a clause where the person "authorizes the organization to collect, use and retain their personal information in accordance with the terms described", a signature. The problem is structural. A single signature covering file management, fundraising, the newsletter and disclosure to third parties at once is neither specific nor granular, and a person who wanted to refuse just one of those uses has no way to do so. Those templates were written to prove that something was asked, not to give a choice. That is exactly what section 14 penalizes.
A complete consent form template, to copy and adapt
The template below is built for an SMB that delivers a service to clients (a clinic, a studio, a professional practice, a shop) and pursues two common secondary purposes: a newsletter and published testimonials. It brings together what the law requires at collection (section 8), what section 14 imposes on the request itself, and the list of information the CAI recommends providing so that consent is informed. Replace the brackets, delete the purposes you do not pursue, and add none "just in case".
Consent to the use of your personal information
[Company name], [address]. Person in charge of the protection of personal information: [name], [email], [phone].
What we do not need your permission for
To [describe the service: treat you, deliver your project, ship your order], we collect your name, your contact details and [the information strictly necessary for the service]. This information is used only to provide that service, bill you and keep your file. It is accessible to [categories of staff: the clinical team, administration] and kept [duration or event: for the length of the contract, then five years]. It is hosted with [provider], [in Quebec / outside Quebec].
What we are asking your permission for
Each choice is independent. Refusing has no effect on the service you are asking us for.
1. Receive our newsletter. I agree that [company] may use my email address to send me its [monthly] newsletter: tips, news and offers. I can unsubscribe in one click in every email. ☐ Yes ☐ No
2. Publish my testimonial. I authorize [company] to publish my first name, [my photo] and the attached testimonial on its website and social media, for promotional purposes, for [two years] from today. ☐ Yes ☐ No
Your rights
You can withdraw a consent at any time, see the information we hold about you and have it corrected, by writing to [officer's email]. Withdrawal applies going forward and does not affect what was done before. The details of our practices are in our privacy policy: [page address].
Name: ____________________ Signature: ____________________ Date: ____________
Every block is there for a reason. The header names the organization and the privacy officer, the first two things the CAI recommends providing ("Who?" and "Who to contact if needed?"). The first block is not a consent request, and it says so: it is the information at collection required by section 8, purposes, means, rights, third parties, hosting outside Quebec, plus what the law only requires on request (who has access, for how long), because giving it upfront costs one line and saves a question. Keeping it visually separate from the consents prevents the mix the CAI condemns, where the same gesture serves both to confirm a reading and to consent. The second block holds the only real requests. Each purpose gets its own line, a Yes box and a No box of equal size, a verb of authorization ("I agree", "I authorize") rather than a verb of awareness ("I am aware that"), and its duration or end event: the CAI recommends exactly those three choices in its examples. The sentence "Refusing has no effect on the service" makes the free character explicit. The rights block covers withdrawal, access and correction, with the concrete way to exercise them. The privacy policy, finally, is only a pointer: the CAI suggests layering the information in two levels, the essentials in the request, the rest in the policy.
The web version of the same form
On a website, the same content is laid out differently. The information-at-collection block becomes one sentence under the contact or order form, with a link to the policy: "We use this information only to respond to your request. Details in our privacy policy." No box here, since no consent is required. The secondary purposes become unchecked boxes, placed before the submit button and visually separated from it:
☐ I want to receive [company]'s [monthly] newsletter: tips and news. Unsubscribe in one click, anytime.
☐ I authorize [company] to use my first name and my testimonial on its website and social media for two years. I can withdraw this authorization by writing to [email].
The submit button reads "Send my request", never "I accept": clicking to obtain the service must not be readable as consent to anything else. And keep a record: the date, the time, the exact text displayed and the state of each box at the moment of submission. The CAI recommends documenting what establishes the validity of the consent obtained, wording included, and a web form that only logs "newsletter: yes" without the text that went with it does not allow that.
Five concrete cases, with wording that passes the test
The newsletter
An unchecked box, next to the form but separate from the submit button, with text like: "I want to receive [company]'s monthly newsletter: tips and updates. Unsubscribe in one click, anytime." One purpose, plain language, a stated frequency, a visible way out. A non-negotiable bonus: Canada's federal anti-spam law (CASL) requires opt-in consent for commercial electronic messages anyway, along with sender identification and an unsubscribe mechanism. A form designed for Law 25 keeps you onside there too.
Marketing cookies
Cookies necessary for the site to function need no consent. Everything else, identifiable audience measurement, advertising, retargeting, must be off by default and offered per purpose, with "Refuse all" as accessible as "Accept all". Wording that holds up: "We use cookies necessary for the site to work. With your agreement, we also use them to measure our audience and for advertising. You can accept or refuse each use, and change your mind at any time."
Client photos and testimonials
A photograph is personal information; the CAI cites it as an example in its guidelines. Publishing a client's photo or testimonial for promotional purposes is a distinct purpose from the service you delivered: it needs its own consent, with the channels and the duration spelled out. For instance: "I authorize [company] to publish my photo and testimonial on its website and social media, for promotional purposes, for two years. I can withdraw my authorization at any time by writing to [email]." The time limit comes from the law itself: consent is only valid for the time the purpose requires.
Personalized offers and profiling
Using a customer's purchase history to send them tailored offers is a secondary purpose, and if an algorithm is involved, it is profiling within the meaning of section 8.1: the function must be off by default and the person told how to activate it. The CAI supplies the wording to keep in its own guidelines, by rewriting an unreadable contract-style clause into this: "Receive personalized offers. I authorize the company to use my purchase history to determine my buyer profile using an artificial intelligence system. The company may choose to send me personalized discount offers matching my profile." A bold heading that names the purpose, a verb of authorization, the information used, the means, the outcome. Nothing else.
Sensitive information
The Act defines information as sensitive when, by its medical, biometric or otherwise intimate nature, or because of the context of its use, it carries a high reasonable expectation of privacy. To use or share it, consent must be express: an active, unambiguous gesture, such as a dedicated checkbox or a signature, never an inference. A clinic collecting health history, a broker handling financial documents, a business deploying a conversational agent that may receive confidences: all of them should isolate that request in its own paragraph and name who will access the information and why. For example, for a disclosure to a third party: "I authorize clinic] to send my treatment file to [name of the professional or institution] to ensure the follow-up of my care, until that follow-up ends. ☐ Yes ☐ No" If an automated system is involved, our article on [AI agents and Law 25 covers the additional obligations.
Three phrasings not to copy
"I authorize [company] to collect, use and retain my personal information in accordance with the terms described in this form." This is the most widespread clause and the weakest: it consents to a document, not to a purpose. It fails the specific criterion, and if the document describes several uses, the granular one too.
"I am aware that my information may be used for marketing purposes." A verb of awareness does not express agreement. The CAI asks for verbs that clearly convey consent, "I consent", "I agree", "I authorize", and options that reflect a choice, "Yes" and "No", rather than "Next" and "Skip".
"By submitting this form, you agree to receive our communications." The gesture that obtains the service cannot double as consent to something else: the consent is neither manifest nor free, since refusing is impossible without giving up the service.
Frequently asked questions
Where can I find the official Law 25 consent form?
There is none for businesses in general. The CAI publishes a model for biometric information only, and some professional orders provide one to their members. For everything else, the form has to be written from your actual purposes; the template above is a starting point.
Does consent have to be written and signed?
No. The law prescribes no form. The CAI lists as valid express consents the signature of a document, ticking a box, an affirmative answer to a question and verbal approval. The requirement of separate presentation only applies when the request is made in writing. What matters is being able to show afterwards that consent was given, and in what terms.
How long does a consent remain valid?
For as long as the purpose requires, no longer. The CAI asks that this limit be set in advance, as a period (one year, three years) or an event (the end of the contract, the closing of the file), and disclosed to the person. The validity of a consent and the retention period of the information are two different things: an expired consent does not force you to destroy the information if another law requires you to keep it.
Do I need to get all my existing clients to sign again?
Only for secondary purposes that rely on consent and for which you do not hold a valid one. Uses necessary to the service the client asked you for never needed separate consent. For the newsletter, the test is simple: if you cannot say when and how the person said yes, you do not have consent.
A good form is a symptom
A compliant consent form is the visible sign of sound design: the business knows which purposes it pursues, collects only what it needs, and therefore has only one or two boxes to offer. If your form needs six checkboxes, the problem is not the wording, it is the collection. That is the kind of question we settle upstream when designing a site as part of our web services, rather than by taping a banner over it at the end.
If you want a second look at your current forms, write to us. We will tell you what passes the test and what does not.
This article explains legal obligations to help an SMB ask the right questions; it is not legal advice. The official texts, Quebec's Act respecting the protection of personal information in the private sector (LégisQuébec) and the Commission d'accès à l'information's Guidelines 2023-1, prevail. For your specific situation, consult a lawyer.
Written byXavier Peich