Law 25 and your website: cookies, forms, analytics

An inspector wanting to check your Law 25 compliance would not need to visit your office. Your website is enough: the cookies it sets, the forms it presents, the analytics tool it loads, the privacy policy it publishes or doesn't. Our summary of Law 25 obligations for SMBs covers the whole regime; this article pops the hood on the site itself.

We build and maintain Quebec websites, and the same pattern shows up on project after project: most non-compliant sites are not careless. They imported European reflexes, a GDPR banner copied from a French site, a form that asks for everything "just in case", an analytics tool installed in 2019 and never questioned since. Quebec's law asks different questions, and sometimes simpler ones.

Let's walk through the property, room by room: cookies and the banner, forms, analytics, then the collectors nobody sees.

The short answer, for the busy

Since September 22, 2023, a Quebec website must respect three mechanisms of the Act respecting the protection of personal information in the private sector, as amended by Law 25. First, section 8.1: if the site uses technology that includes functions allowing a person to be identified, located, or profiled (advertising cookies, many audience analytics tools), it must inform the visitor beforehand and indicate how to activate those functions, which must remain deactivated by default according to the Commission d'accès à l'information. Second, forms: section 5 limits collection to the information necessary for purposes determined before collecting, and section 8 requires informing the person of those purposes at the time of collection. Third, section 8.2 requires a privacy policy published in simple and clear terms. Administrative penalties can reach $10 million or 2% of worldwide turnover.

Two sections of the law, only one of which governs your cookies

Law 25 contains a "privacy by default" provision, section 9.1: a technological product or service offered to the public with privacy settings must guarantee, by default, the highest level of privacy, without any intervention from the person. Many guides stop there and conclude your cookies are covered. The text says the opposite: its second paragraph expressly excludes "the privacy settings of a connection cookie".

The section that actually governs your cookies is 8.1. If your site collects personal information using technology that includes functions allowing a person to be identified, located, or profiled, you must, before collecting, inform them of two things: that such technology is being used, and the means available to activate those functions. The law defines profiling broadly: collecting and using information to evaluate a person's characteristics, preferences, interests, or behaviour. An advertising cookie that follows a visitor from site to site checks that box effortlessly.

The decisive word is "activate". You don't activate something already switched on. The Commission d'accès à l'information (CAI) says it plainly in its business guidance: you cannot turn these functions on by default; the person must be able to do it themselves, voluntarily. A compliant Quebec site therefore loads its tracking functions off, and they stay off until the visitor turns them on.

The penalty ceilings show how seriously the legislator takes this: up to $10 million or 2% of worldwide turnover in administrative penalties (section 90.12), double that for penal offences (section 91). Nobody will fine an SMB those amounts over a cookie, but this particular breach can be observed from any browser.

The compliant banner is not the one you think

The web ecosystem answered Law 25 by recycling its GDPR toolkit: the giant banner, the forty purposes, the "legitimate partners", the brightly coloured "Accept all" button with the refusal buried three screens deep. That hardware serves a European logic, consent before cookies are set, and it imports Europe's vices too: on many sites, trackers fire before the banner even renders, which violates the GDPR and section 8.1 alike.

Quebec's logic is an activation logic. Identification, location, and profiling functions are off; your interface offers the visitor a way to turn them on. A switch within reach rather than a wall in front of the content. And when consent is requested, section 14 sets the standard: manifest, free, informed, requested for each purpose in clear and simple terms, and presented separately from any other information. A pre-ticked box is not manifest consent; a banner that drowns the request in jargon is not informed consent.

The practical conclusion often surprises our clients: the best banner is the one you don't need. A site that loads no tracking functions has nothing to activate, so nothing to ask consent for. Law 25 requires no banner: a banner is the symptom of a tooling choice. Our consent form examples show what a properly made request looks like when one is genuinely needed.

Your forms: ask only what's necessary, and say so

Forms are the easiest item to fix and the most often neglected. Two rules cover it.

The first is minimization, in section 5: collect only the information necessary for purposes determined before collection. The word order matters: purposes first, fields second. A quote request form probably doesn't need a date of birth; a contact form doesn't need a mailing address. Every required field should survive the question "necessary for what?". The field added "in case marketing wants it someday" is exactly the one the law forbids.

The second is transparency at the moment of collection, in section 8: inform the person of the purposes, the means, their rights of access and correction, their right to withdraw consent, and where applicable the third parties involved and the possibility that the information will be communicated outside Quebec. In practice, one clear sentence under the form plus a link to the privacy policy does the job, provided the sentence tells the truth. And if the form also feeds a newsletter, that purpose gets its own request, checkbox unticked.

Analytics: GA4 or cookieless measurement

Google Analytics 4 sets cookies, _ga and its variants, whose function Google's own documentation describes without ambiguity: distinguishing users, with a default lifespan of two years. Distinguishing a visitor and following them from visit to visit is the very mechanism section 8.1 targets: our reading, a prudent one, is that a standard GA4 setup requires the activation mechanics described above and a clear mention in your policy. Cookieless analytics tools (Fathom, Plausible, and friends) measure traffic as aggregated data instead, with no cookies and no visitor identification: no identification or profiling function to activate, no banner, and numbers that are plenty for running an SMB's website. It's what we install by default for our clients. The choice deserves more than a paragraph, but the essential fits here: your analytics tool is a compliance decision as much as a technical one.

The hidden collectors: pixels, embedded videos, chat

The last item is the one site owners know least, because it's invisible. Every third-party code snippet pasted into your pages is a potential collector.

The advertising pixel is the textbook case. The Meta Pixel, by Meta's own documentation, tracks visitors' actions on your site, page views, add-to-carts, purchases, to measure ads and build audiences. That is profiling in the law's sense, installed one campaign day and forgotten since. If it still runs with no activation mechanism, it runs in the open.

Embedded videos follow the same logic. A standard YouTube embed loads Google code into your page. YouTube offers a privacy-enhanced mode (the youtube-nocookie.com domain) in which, per Google, views are not used to personalize the visitor's browsing or advertising. Two minutes to change one domain in the embed code.

The chat widget, finally, collects entire conversations, often with a name and email, processed on a third party's servers, frequently outside Quebec. Nothing forbids it, but it belongs in your privacy policy, along with the third parties involved and the possibility of communication outside Quebec.

Taking inventory requires no special tooling: your browser's network tab, homepage loaded, before any click. Whatever leaves for third-party domains before the visitor has touched anything is your starting list.

Where to start

The sequence takes three moves. Inventory: what the site actually loads, form by form, script by script. Prune: the pixel from a campaign that ended in 2023 and the cookie from an abandoned tool don't deserve compliance work, they deserve deletion. Frame what remains: tracking functions off by default with a real activation mechanism, minimized and transparent forms, an up-to-date policy. Then keep the reflex: every new widget reopens the question. It's ongoing maintenance work, which is why we fold it into our web subscriptions rather than treating it as a one-time project.

If you want to know where your site stands today, our audit checks precisely these items, cookies set, third-party collectors, forms and policy, and tells you what's urgent and what can wait.

→ Request your audit

This article explains legal obligations to help an SMB ask the right questions; it is not legal advice. The Act respecting the protection of personal information in the private sector and the positions of the Commission d'accès à l'information prevail: for a specific situation, consult a lawyer.