Quebec Law 25 for websites

Quebec Law 25 (formerly Bill 64) is the reform of Quebec's private-sector privacy law that came into force in stages between September 2022 and September 2024. For websites and marketing, it means: tracking that can identify, locate or profile visitors should be off by default and switched on only with their agreement; consent must be clear, specific and separate for each purpose; a privacy policy in plain language must be published; the person in charge of personal information must be named on the website; and data sent outside Quebec needs an assessment first. It applies to businesses that handle personal information about people in Quebec, including many outside the province.

For a small business, Law 25 is less about paperwork on the website and more about how your marketing tools behave. This article walks through the practical changes. It is an overview for owners, not legal advice; Law 25 has nuances, so confirm your obligations with a lawyer who practises Quebec privacy law.

The three phases at a glance

Most of what affects websites and marketing arrived in September 2023.

Eight changes that affect your marketing

1. Tracking is off by default. Law 25 expects privacy-protective default settings, and requires you to inform people when you use technology that can identify, locate or profile them, and how to activate it. For analytics and ad pixels, that usually means a consent banner where non-essential tracking starts only after the visitor agrees. I explain the technical side in cookie consent in Canada.

2. Consent must be specific. Consent should be requested for each specific purpose, in clear and simple terms, separately from other information. A single "I accept the terms" checkbox covering newsletters, data sharing and ad tracking does not fit that model.

3. A named privacy contact on your website. By default, the person with the highest authority in the business is responsible for protecting personal information. That role can be delegated in writing. Their title and contact details must be published on your website.

4. A clear privacy policy. Published on the website, in plain language, describing what you collect and why. See what your website privacy policy needs in Canada.

5. Transfers outside Quebec need an assessment. If your CRM, email platform or hosting stores Quebec residents' data outside the province (which covers most popular marketing tools), you are expected to assess whether the data will be adequately protected and to have a written agreement with the provider. This is internal, but it affects which tools you choose.

6. Profiling and automated decisions. If you make decisions about people based only on automated processing, you must inform them. Lead scoring that automatically refuses service, for example, deserves a careful look.

7. Retention and destruction. Once the purpose is fulfilled, personal information should be destroyed or anonymized, subject to legal retention periods. Old exported spreadsheets of leads on someone's laptop are a classic risk.

8. Incident handling. If a confidentiality incident (a breach, a misdirected export, a hacked account) creates a risk of serious injury, you must notify the Commission d'accès à l'information and affected people, and keep a register of all incidents.

Penalties

Law 25 introduced administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4% of worldwide turnover, whichever is greater, for the most serious cases. It also allows people to sue for damages, with punitive damages possible for intentional or grossly negligent breaches. Small businesses are unlikely to face the maximums, but complaints and investigations are costly in time and reputation.

What this means for each marketing channel

• Website analytics: consent banner, Consent Mode, accept that tracked numbers will drop. Compare them with real enquiries in your CRM.
• Meta and Google remarketing: only for visitors who agreed. Audiences shrink.
• Email and SMS: CASL consent already applies; under Law 25, keep consent requests specific and clear, and record them.
• CRM: limit access, set retention rules, know where it is hosted, and include it in your transfer assessment.
• Chatbots and AI tools: disclose them, avoid feeding sensitive data, check the vendor's data use.
• Forms: collect only what you need. A quote form rarely needs a date of birth.

If you also need French versions of your marketing, that is a separate law, the Charter of the French Language. See French on your website: what Quebec rules mean.

A starter checklist for small businesses

1. Name the person in charge of personal information and publish their title and contact details.
2. List every tool that receives personal data from your website and marketing.
3. Install a consent banner with real accept and reject options, off by default for non-essential tracking.
4. Rewrite your privacy policy so it matches that list, in plain language, in French and English if you serve Quebec.
5. Review consent wording on forms and sign-ups: specific, separate, clear.
6. Note where each tool stores data and document your assessment of providers outside Quebec.
7. Set retention periods and clean up old exports.
8. Create a simple incident register and a plan for what to do if something goes wrong.

A lawyer handles the legal documents; the technical steps (banner, tags, forms, CRM access) can be done alongside.

Law 25 and the federal picture

Outside Quebec, PIPEDA still governs most private-sector businesses, with Alberta and British Columbia having their own laws. A federal reform bill (C-27) was introduced in 2022 but died when Parliament was prorogued in early 2025; check whether any newer federal reform has passed since. In practice, Law 25 has become the strictest privacy standard many Canadian marketers design around.

How I can help

I handle the technical side of compliance for marketing: consent banners and Consent Mode v2, tag rules in Google Tag Manager, forms with clear consent fields, and CRM setups with access controls and consent records. I work remotely with businesses across Canada, in English: French text for your banner and policy comes from your own team or translator. For the legal text and your overall obligations, I recommend working with a privacy lawyer, and I am glad to coordinate with them.