By Cody Wise, Founder, Wise Media. Published 11 September 2026.
Quebec’s Law 25 requires you to tell visitors before any technology identifies, locates or profiles them, and to leave those functions switched off until they turn them on. That makes non-essential cookies an opt-in, not a notice. It applies based on whose personal information you handle, not where your office is, so an Alberta or Ontario business with Quebec customers is in scope. Penal fines for an enterprise start at $15,000 CAD.
Summary
- The operative section is 8.1. It requires you to disclose identifying, locating or profiling technology and tell people how to activate it. If a function has to be activated, it starts off. That is an opt-in in everything but name.
- Your cookie banner needs a refuse button with exactly the same weight as the accept button. Quebec’s regulator has published worked examples on this, including the number of clicks each path takes.
- The widely repeated “Law 25 consent expires every six months” rule does not exist. The regulator’s own guidance ties consent duration to purpose and gives examples ranging from 30 days to six years. Several competing pages state the six-month figure as fact. It is not in the statute or the guidance.
- Penalties are two separate regimes. Administrative monetary penalties up to 2% of worldwide turnover or $10 million CAD, and penal fines from $15,000 CAD to the greater of $25 million CAD or 4% of worldwide turnover, doubled on repeat.
- Cookie consent is the smallest part of the job. A published privacy policy, a named privacy officer on your website, an incident register, privacy impact assessments and a data portability path are all live obligations.
Table of Contents
- Does Law 25 apply to my business if I am not in Quebec?
- What section 8.1 actually says about cookies and trackers
- What a compliant cookie banner looks like in practice
- The six-month consent myth, and what the guidance really says
- The obligations beyond the banner
- Penalties, in CAD
- Common mistakes
- The implementation checklist
- FAQ
Does Law 25 apply to my business if I am not in Quebec?
Probably, if you handle personal information of people in Quebec as part of carrying on an enterprise there. Law 25 amends the Act respecting the protection of personal information in the private sector, which binds any person carrying on an enterprise. It does not contain a “head office in Quebec” test.
Here is where most pages on this topic overreach, so read this part carefully. A lot of compliance vendors will tell you that a single website visitor from Quebec puts you in scope. That is a defensible, cautious reading. It is not settled law. No Quebec court or regulator decision has held that one visitor with no other business activity in the province triggers the Act. What the case history does support is that an out-of-province business actively selling into Quebec can be caught even with a thin physical presence.
The practical test we use when scoping a build:
- Do you advertise into Quebec, ship there, or serve Quebec clients?
- Do you collect personal information through your site, meaning forms, accounts, bookings, chat, or analytics tied to an identifiable person?
- Do you run any script that profiles, retargets or locates a visitor?
If the answer to the first question is yes and the answer to either of the others is yes, treat yourself as in scope and build accordingly. The cost of complying is a few hours of configuration. The cost of being wrong is in the penalties section below.
How this differs from PIPEDA
PIPEDA tolerates implied consent in far more situations, has no mandatory privacy impact assessment regime, and until recent reform proposals carried no comparable hard-dollar administrative penalties. Law 25 adds an express consent standard for profiling technology, mandatory assessments before certain projects and before any transfer outside Quebec, a portability right, and a penalty structure with real numbers attached. If you built to PIPEDA and stopped, you are behind.
How this differs from Bill 96
Different statute, different problem. Bill 96 is language law and governs whether your site has to be available in French. Law 25 is privacy law and governs consent and data handling. They intersect in exactly one place worth noting: if Bill 96 requires your Quebec-facing pages in French, your cookie banner and privacy policy are part of that. Keep the two compliance tracks separate in your head. We covered the language question in Does my website need to be in French.
What section 8.1 actually says about cookies and trackers
Most articles paraphrase this section badly, so here is the statutory text:
In addition to the information that must be provided in accordance with section 8, any person who collects personal information from the person concerned using technology that includes functions allowing the person concerned to be identified, located or profiled must first inform the person (1) of the use of such technology; and (2) of the means available to activate the identification, locating or profiling functions.
Act respecting the protection of personal information in the private sector, s. 8.1, in force 22 September 2023
Read the second limb again. You must tell people how to activate the function. A thing you activate is a thing that is currently off. That is why the regulator treats this as requiring the identifying, locating and profiling functions to be disabled by default, and why a banner that fires your analytics and retargeting scripts on page load fails regardless of what the banner says.
Which cookies this covers, and which it does not
| Cookie or script | Identifies, locates or profiles? | Fire before consent? |
|---|---|---|
| Session and login state | No, strictly functional | Yes |
| Cart contents, language preference | No | Yes |
| Security and fraud prevention | No, where strictly necessary | Yes |
| Google Analytics, any analytics tied to an identifiable person | Yes | No |
| Meta Pixel, Google Ads remarketing, any retargeting tag | Yes, profiling | No |
| Heatmaps and session recording | Yes, profiling | No |
| Geolocation and IP-based location targeting | Yes, locating | No |
| Chat widgets that persist an identifier | Yes | No |
The confidentiality-by-default carve-out, stated correctly
Section 9.1 requires that privacy settings on a technological product or service offered to the public default to the highest level of confidentiality without any action by the user. Several competing pages then write “but this does not apply to cookies,” which overstates it.
The Commission d’acces a l’information states the exception in French as applying to the privacy settings of a temoin de connexion, a connection or session cookie. That is much narrower than “browser cookies.” Your session cookie is carved out. Your retargeting pixel is not, and it was never governed by 9.1 anyway because section 8.1 already covers it. Do not let a vendor tell you 9.1 exempts your marketing stack.
What a compliant cookie banner looks like in practice
Quebec’s regulator published Criteres de validite du consentement as Guidelines 2023-1, and it is the most useful document in this entire area because it contains worked examples rather than abstractions. Four rules come straight out of it.
1. Equal visual prominence
The regulator’s own approved example is a municipal website presenting two buttons, one to accept and one to refuse, described in the guidance as being at exactly the same height, in the same colour, at the same font size. A bright accept button beside a grey text link is the single most common failure on Canadian sites and it is explicitly the pattern the guidance calls out.
2. Equal effort, measured in clicks
The guidance states that the number of clicks required to consent or to refuse should be equivalent. One worked example flags an app requiring eight clicks to withdraw consent against one click to grant it as imposing disproportionate effort, and therefore as failing. If accepting takes one click and refusing takes you into a preferences modal with three toggles and a save button, you have built the non-compliant version.
3. Dark patterns void the consent entirely
The guidance is blunt that emphasising acceptance over refusal can render consent without effect, whatever the exact method: visual emphasis through colour or font size, effort measured in clicks or navigation, deliberately ambiguous wording, or misleading text. Note the consequence. It is not a fine for a bad banner. It is that the consent you collected does not exist, which means every downstream use of that data was unconsented.
4. Granularity per purpose
Consent has to be granular. Bundling analytics, advertising and functional cookies behind a single “I agree” fails, because the person cannot accept one purpose and refuse another. In practice that means categories, and it means the categories have to be real rather than three checkboxes that all load the same tag manager container.
What about cookie walls?
Honest answer: the regulator has not published an explicit position on blocking site access entirely for refusing non-essential cookies. Several pages will tell you cookie walls are banned in Quebec. We could not find that statement in the guidance. What the guidance does establish is a free-consent criterion under which organisations should not penalise refusal, and a full-site block is hard to reconcile with that. Treat cookie walls as high risk and unresolved rather than as settled either way, and do not let anyone sell you certainty on this point.
The six-month consent myth, and what the guidance really says
If you have read three articles on Law 25 cookie consent, at least one told you consent expires after six months and you must re-prompt. At least one told you to keep consent records for eighteen months. Neither rule exists.
Guidelines 2023-1 addresses consent duration under the heading of delimiting duration, and ties it to purpose. It gives two ways a purpose can be considered fulfilled: a period of time, with 30 days, one year and six years given as illustrations, or an event, such as a payment completing, an employee leaving, or a contract ending. Those are examples of how to think about it. None is a mandated cookie-consent lifespan.
The guidance also separates two concepts that the vendor pages routinely merge, distinguishing the validity period of consent from the retention period for the information. They are not the same clock and neither of them is eighteen months.
What you should actually do: define a renewal interval, write down the reason you chose it, and apply it consistently. Twelve months is a common and defensible choice for marketing cookies on a Canadian site. The defensibility comes from having a documented rationale tied to purpose, not from hitting a magic number.
The obligations beyond the banner
A cookie banner is the visible 10% of Law 25. Here is the rest, with the dates they landed.
A named privacy officer, published on your website
Live since 22 September 2022. The person carrying on the enterprise is responsible by default, and the title and contact details of the responsible person must be published on the enterprise’s website, or made accessible by other appropriate means if there is no website. Note the wording carefully: title and contact details. A role-based contact such as a privacy officer address is the usual way this is satisfied.
A published privacy policy in clear and simple language
Section 8.2, in force 22 September 2023. If you collect personal information through technological means, you must publish a confidentiality policy on your website, drafted in clear and simple language, and publish notice of any amendment to it. The clear-and-simple-language requirement is doing real work here. A policy copied from a US template and full of defined terms is not compliant just because it exists.
Privacy impact assessments
Live since September 2023. An assessment is required for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information, and before communicating personal information outside Quebec. The depth must be proportionate to the sensitivity, purpose, quantity and format of the information.
Read that second trigger again, because it is the one that catches agencies and their clients. Your CRM, your email platform, your analytics, your hosting, your backup provider. If the data leaves Quebec, an assessment is required before it does. Most Canadian small business stacks send data to the United States by default and nobody assessed anything.
Breach handling and an incident register
Sections 3.5 to 3.8. Where you have cause to believe a confidentiality incident has occurred, you must take reasonable measures to reduce the risk of injury and prevent new incidents. Notification to the Commission and to affected individuals is triggered where there is a risk of serious injury. Separately, and this catches people out, you must keep a register of confidentiality incidents regardless of severity, and send a copy to the Commission on request.
Data portability
Live since 22 September 2024. On request, you must provide computerised personal information you collected from the individual in a structured, commonly used technological format, and you may be asked to send it to a third party instead. For a website that means a real export path. A CSV or JSON export satisfies this. A PDF screenshot of an account page does not.
Penalties, in CAD
Two separate regimes, which is why you see conflicting numbers everywhere. Figures below are from the Commission’s own sanctions page.
| Regime | Who | Amount |
|---|---|---|
| Administrative monetary penalty | Enterprise | Up to 2% of worldwide turnover or $10 million CAD |
| Penal fine | Natural person | $5,000 to $100,000 CAD |
| Penal fine | Enterprise | $15,000 CAD to the greater of $25 million CAD or 4% of worldwide turnover |
| Repeat offence | Either | Fines are doubled |
| Private action | Either | Statutory minimum $1,000 CAD punitive damages where the infringement is intentional or results from gross fault |
Two corrections worth making, because both errors are circulating. First, the 2% administrative cap and the 4% penal cap are different things and several pages present one as if it replaced the other. Second, we found claims that a 2026 amendment raised administrative penalties to 4%. We could not verify any such amendment against the statute or the regulator, and the claim looks like a conflation of the two caps above. Do not plan around it.
The $1,000 punitive damages minimum deserves more attention than it gets. It is a floor per claimant, not a cap, and it does not require the regulator to act. That is the mechanism most likely to reach a small business.
Common mistakes
- Installing a banner that does not actually block anything. The most common implementation failure by a distance. The banner renders, the visitor clicks refuse, and Google Tag Manager already fired on page load. Test with the network tab open before and after refusing.
- Accept in colour, refuse as a grey link. Directly contrary to the equal-prominence example in the guidance.
- One click to accept, four to refuse. Fails the equal-effort test.
- Treating a US or EU banner as sufficient. A GDPR-configured banner gets you most of the way, which is genuinely useful, but it does not deliver the French-language requirement, the published privacy officer, or the impact assessment before cross-border transfer.
- No mechanism to withdraw consent. If there is no persistent way back into preferences, the person cannot withdraw, and withdrawal must be as easy as granting.
- Never running an assessment before sending data to a US platform. Widespread, and the least visible of these until something goes wrong.
- Believing the six-month rule. Covered above. Vendors repeat it because it sells a recurring re-consent feature.
The implementation checklist
This is the sequence we run on a build. It takes a competent developer a day, not a quarter.
- Inventory every script. Open the network tab on a clean profile and list everything that sets a cookie or calls a third party. Most sites have between four and twelve more than the owner expected.
- Classify each one as strictly functional or as identifying, locating or profiling. Use the table above.
- Block by default. Nothing in the second category fires until consent. In Google Tag Manager this means consent mode configured properly, not a cosmetic banner sitting on top.
- Build the banner with two equal buttons. Same size, same colour, same weight, same click count. Add a granular preferences layer behind a third equally weighted option.
- Add a persistent withdraw path. A footer link that reopens preferences is sufficient and takes ten minutes.
- Log consent with a timestamp, the version of the banner, and which categories were accepted. You want to be able to demonstrate consent, not assert it.
- Set and document a renewal interval. Twelve months, with your reasoning written down.
- Publish the privacy policy in clear language, and in French for Quebec-facing pages.
- Publish the privacy officer’s title and contact details on the website.
- Create the incident register before you need it. A spreadsheet is a register.
- Run an assessment before any cross-border transfer and keep it on file.
- Build the portability export. Structured, commonly used format.
- Re-test the refuse path on mobile. This is where the equal-effort rule usually breaks.
What this costs
Consent management platforms are the obvious line item, and their published rates run from free tiers for very low-traffic sites up into the low hundreds of dollars per month for multi-domain enterprise plans. Those are published vendor rates and you should verify current pricing directly, since this category reprices frequently. The larger cost is almost always the implementation: auditing the script inventory, wiring consent mode correctly, and rebuilding a banner that actually blocks. Budget for the integration, not the licence.
If you are already planning a rebuild, this work belongs inside it. Retrofitting consent blocking onto a site with eleven years of accumulated tags costs more than doing it once during a website build, and the ongoing obligations such as the register, renewals and assessments are exactly what a growth and maintenance engagement is for.
Where this sits alongside your other Canadian obligations
Law 25 is one of four rules that reach an ordinary Canadian business website, and they are frequently confused with each other:
| Rule | Governs | Trigger |
|---|---|---|
| Law 25 (Quebec) | Consent, trackers, data handling | Personal information of people in Quebec |
| CASL (federal) | Commercial electronic messages and consent to receive them | Sending email or SMS to a Canadian address |
| Bill 96 (Quebec) | French-language availability | Doing business in Quebec |
| Accessible Canada Act and provincial rules | Accessibility of the site itself | Varies by jurisdiction and employer size |
We have written the practical version of each: CASL for websites, forms and tracking scripts, Quebec’s French-language rules, and accessibility obligations in Canada and Alberta. Read the consent sections of the CASL piece alongside this one, because the two consent regimes interact on your forms.
Frequently asked questions
Does Law 25 apply to my Alberta business if I have Quebec customers?
Very likely yes. The Act binds any person carrying on an enterprise and has no requirement that the enterprise be located in Quebec. If you advertise into Quebec, ship there or serve Quebec clients and you collect personal information through your site, assume you are in scope. The narrower question of whether a single website visitor alone triggers the Act has not been settled by a court.
Do I need a cookie banner under Law 25?
You need the outcome, which is that identifying, locating and profiling technology is disclosed and switched off until the visitor activates it. A banner is the standard way to deliver that outcome. If you genuinely run no analytics, no advertising pixels, no heatmaps and no geolocation, you may not need one, which is rarer than owners think.
Does Law 25 cookie consent expire after six months?
No. There is no six-month expiry in the statute or in the regulator’s guidance. The guidance ties consent duration to the purpose it was collected for and offers illustrative periods ranging from 30 days to six years, as well as event-based endpoints. Choose an interval, document why, and apply it consistently.
Can I use the same cookie banner for GDPR and Law 25?
Usually yes for the banner mechanics, since a properly configured GDPR banner already blocks by default, offers granular categories and gives equal weight to refusal. What it does not cover is the rest of Law 25: French language for Quebec-facing pages, the published privacy officer contact, the privacy impact assessment before cross-border transfer, the incident register, and the portability export.
What are the penalties for a Law 25 breach?
Administrative monetary penalties reach up to 2% of worldwide turnover or $10 million CAD. Penal fines run from $5,000 to $100,000 CAD for a natural person and from $15,000 CAD to the greater of $25 million CAD or 4% of worldwide turnover for an enterprise, doubled on a repeat offence. Separately, a private action carries a statutory minimum of $1,000 CAD in punitive damages where an infringement is intentional or results from gross fault.
Are cookie walls allowed in Quebec?
Unresolved. The regulator has not published an explicit position on blocking site access for refusing non-essential cookies. The free-consent criterion in the guidance sits uncomfortably with the practice, so treat cookie walls as high risk, and be sceptical of any page that tells you the answer is settled in either direction.
Does Google Analytics require consent under Law 25?
Where it is configured in a way that identifies or profiles an individual, yes, and it should not fire before consent. The practical implementation is Google consent mode configured so that analytics and advertising storage are denied until the visitor accepts, rather than a banner that only records a preference while the tags fire regardless.
The bottom line
Law 25 is not hard. It is specific. The requirement that catches most Canadian sites is not an obscure clause, it is that the refuse button has to be as easy to press as the accept button and the scripts actually have to stay off until someone presses accept. Almost every banner we audit fails one of those two, and the consequence of failing is not a warning letter, it is that the consent underpinning your entire analytics and advertising stack is treated as never having existed.
Fix the blocking behaviour first, the button parity second, and the paperwork third. In that order you are materially compliant inside a day.
Get your site audited and fixed
We audit Canadian business websites for consent blocking, banner mechanics, policy publication and cross-border transfer exposure, then implement the fix as part of a build or a growth engagement. If you want to know where your site actually stands rather than where your cookie plugin claims it stands, tell us about your project and we will scope it.
Sources
- Act respecting the protection of personal information in the private sector, CQLR c P-39.1, Publications Quebec
- Principaux changements apportes par la loi 25, Commission d’acces a l’information du Quebec
- Sanctions et poursuites, entreprises privees, Commission d’acces a l’information du Quebec
- Lignes directrices 2023-1: criteres de validite du consentement, Commission d’acces a l’information du Quebec
- Guide d’accompagnement: evaluation des facteurs relatifs a la vie privee, Commission d’acces a l’information du Quebec
This article is general information about Quebec privacy law and is not legal advice. It does not assess the compliance status of any particular business. Verify current requirements against the statute and the Commission’s published guidance, and consult a Quebec-qualified lawyer before relying on any of it for a compliance decision.