This is not legal advice. We set up websites, analytics and ad tracking for Quebec businesses, and this guide explains how Law 25 affects that work. For your own obligations, check with a lawyer or the Commission d’accès à l’information du Québec (CAI).
If your business collects personal information from people in Quebec through a website, Law 25 says you must publish a privacy policy, name a person in charge of personal information, and get the visitor’s consent before turning on cookies that track, locate or profile them. In practice that means a cookie banner where refusing is as easy as accepting, and analytics and ad pixels that stay off until the visitor says yes.
Below: what applies to a typical business website, how to handle Google Analytics, the Meta Pixel and Shopify, and a checklist you can work through.
Law 25 in plain words
Law 25 (formerly Bill 64) modernised Quebec’s private sector privacy law, the Act respecting the protection of personal information in the private sector. It was adopted in September 2021 and came into force in three steps:
| Date | What came into force |
|---|---|
| September 22, 2022 | A person in charge of protecting personal information (by default, the head of the business), and reporting of privacy incidents to the CAI |
| September 22, 2023 | Most of the rules that touch websites: privacy policy, consent, tracking technologies, privacy impact assessments, transfers outside Quebec, and the CAI’s power to impose penalties |
| September 22, 2024 | The right to data portability (getting your information in a structured, commonly used format) |
It applies to businesses of every size, not just large ones. Administrative penalties can reach $10 million or 2% of worldwide turnover, and penal fines up to $25 million or 4%, whichever is higher. Small businesses are unlikely to face numbers like that, but complaints to the CAI and the work of fixing things after the fact are real costs.
What Law 25 means for a website
For most small business and e-commerce sites, it comes down to five things.
1. A person in charge of personal information. By default it’s the person with the highest authority in the business (the owner or CEO). That role can be delegated in writing. Their title and contact details must be published on your website.
2. A privacy policy, in clear and simple terms. If you collect personal information through a website, you must publish a privacy policy on it. The CAI’s guide says it should explain, among other things, what you collect, why, how (including whether you use cookies), who it’s shared with, whether it may be sent outside Quebec, and how people can refuse or withdraw consent.
3. Tracking technologies off until the visitor turns them on. Section 8.1 of the Act covers technology that can identify, locate or profile a person. You must tell people you use it and how to activate those functions. Advertising pixels and analytics tools that follow behaviour fall in this category, which is why the common practice in Quebec is to keep them off until the visitor accepts. Cookies strictly needed for the site to work (the cart, the login, remembering the consent choice itself) don’t need consent.
4. Consent that means something. Consent must be clear, free, informed and given for specific purposes. The CAI’s guidelines add that silence or inaction isn’t consent, and that consent should be granular. In practice: no pre-ticked boxes, no “by continuing to browse you accept”, and one consent per purpose rather than a blanket yes.
5. Easy withdrawal. People must be able to change their mind. A “Cookie settings” link in your footer that reopens the banner does the job.
Law 25 also asks for a privacy impact assessment before personal information is communicated outside Quebec. Google Analytics, Meta, Shopify and most form tools store data outside Quebec, so a short written assessment of those services belongs in your files. It doesn’t go on the website, but your privacy policy should say that information may be processed outside Quebec.
Cookie banners: what complies and what doesn’t
| Usually fine | Usually not |
|---|---|
| “Accept” and “Refuse” buttons of the same size and weight, side by side | A big “Accept” button and a small grey “Settings” link |
| Analytics and ads stay off until the visitor clicks “Accept” | Tracking that loads first and asks later |
| A short sentence on what you track and why, with a link to the privacy policy | “We use cookies to improve your experience” and nothing else |
| Separate choices for analytics and advertising, if you use both | One “Accept all” with no way to choose |
| A “Cookie settings” link in the footer to change the choice | No way to withdraw consent once given |
| The banner in French (and English if your site is bilingual) | A banner only in English on a Quebec site |
On our own site, nexasolutions.ca, the banner has two equal buttons, analytics stays off until a visitor accepts, and a link in the footer reopens it.
Google Analytics and the Meta Pixel under Law 25
Google Analytics 4 and Google Ads: use Consent Mode. Consent Mode is Google’s way of telling its tags what the visitor agreed to. Version 2 has four signals: analytics_storage, ad_storage, ad_user_data and ad_personalization. You set all four to “denied” by default, and your banner switches them to “granted” when the visitor accepts.
There are two ways to run it:
- Basic: Google’s tags don’t load at all until the visitor accepts. Nothing is sent before consent.
- Advanced: the tags load, but without cookies, and send anonymous “pings” that Google uses to model the visits and conversions it can’t see.
Advanced recovers more data, but it does send something before consent. Talk to your lawyer about which one fits your policy. Either way, check in GA4 (Admin › Data collection) that Google signals and user-provided data collection match what your privacy policy says.
The Meta Pixel has no equivalent of Consent Mode, but it has a consent switch: fbq('consent', 'revoke') before the pixel starts, then fbq('consent', 'grant') when the visitor accepts. Most consent tools and Shopify’s own banner can handle this for you. The Conversions API (server-side tracking) should respect the same choice.
What you lose. Once tracking waits for consent, Analytics and the ad platforms see fewer visits and fewer conversions. Your sales don’t change, only what gets measured. That’s one more reason to judge ads on blended numbers (total online revenue divided by total ad spend), which don’t depend on cookies. We explain this in what is a good ROAS.
From our accounts
When we set up tracking on a store, consent is part of the job, not an extra. We connect the cookie banner to Google Consent Mode and to Shopify’s privacy settings, so Google Analytics and Google Ads follow the visitor’s choice. On the Meta side, the pixel and the Conversions API send the same events with a shared ID, and both follow the same choice.
The first step is always an audit of what’s already there. A problem we run into isn’t a missing banner: it’s a banner that’s installed while analytics still loads before the visitor answers it. On one Quebec store we audited, Google Analytics was firing before consent even though the banner looked fine. The banner was there; the tags just weren’t listening to it.
Then we place test orders in French and English and check them in every tool. If something fires without consent, it shows up there.
Shopify stores: what to check
Shopify has its own consent tools, which makes the basics simpler.
- Customer privacy settings. In Shopify admin › Settings › Customer privacy, you can turn on Shopify’s cookie banner and choose the regions where it shows. Make sure your Quebec visitors are covered (check whether the list offers Quebec on its own or only Canada as a whole).
- Apps add trackers. Review apps, pop-ups, chat widgets and upsell apps often load their own scripts and cookies. Every one of them should wait for consent, or be listed as strictly necessary only if it truly is. Remove the apps you no longer use.
- Pixels and customer events. Shopify’s Facebook & Instagram and Google & YouTube channels read the visitor’s consent from Shopify. Pixels pasted into the theme by hand, or added years ago by an old app, usually don’t. Look for them in the theme code and in Settings › Customer events.
- French. The banner text, the privacy policy and the checkout must be available in French.
If you’re also working on your store’s visibility, our Shopify team handles this kind of clean-up as part of a store review.
Law 25 website checklist
| ✓ | Item |
|---|---|
| ☐ | Person in charge of personal information named, with title and contact details on the website |
| ☐ | Privacy policy published, in clear terms, in French (and English if the site is bilingual) |
| ☐ | Policy says what you collect, why, which tools and cookies you use, and that data may be processed outside Quebec |
| ☐ | Cookie banner with “Accept” and “Refuse” equally easy |
| ☐ | Analytics and ad pixels off until the visitor accepts (Consent Mode set to denied by default) |
| ☐ | Separate choices for analytics and advertising if you use both |
| ☐ | “Cookie settings” link in the footer to change the choice |
| ☐ | Every app and script checked: does it wait for consent? |
| ☐ | Forms collect only what you need, with a link to the privacy policy |
| ☐ | Newsletter sign-up is a separate, unticked box (that’s also required by Canada’s anti-spam law, CASL) |
| ☐ | Short privacy impact assessment on file for tools that store data outside Quebec |
| ☐ | A simple incident register (even if it stays empty) |
To check the tracking side in more depth, use our conversion tracking checklist. If you advertise on Google or Meta, we set up consent and tracking together so you stay compliant without losing more data than you have to. Get in touch and we’ll check your site.
FAQ
Does Law 25 apply to small businesses? Yes. It applies to businesses that collect personal information in Quebec, whatever their size. What changes with size is mostly how much documentation is reasonable.
Do I need a cookie banner in Quebec? If your site uses analytics or advertising tools that can identify or profile visitors, you need a way for visitors to turn those on. A cookie banner is the usual way to do it. A site that uses only strictly necessary cookies doesn’t need one.
Is Google Analytics allowed under Law 25? Yes, with consent. Set Consent Mode to “denied” by default, turn analytics on when the visitor accepts, mention it in your privacy policy, and keep a short assessment of the transfer outside Quebec on file.
Is Law 25 the same as GDPR? They’re close in spirit (consent, transparency, penalties based on turnover), but they’re separate laws with their own wording. A GDPR-ready banner is a good start, but check the French language requirements and the Quebec-specific rules.
Who enforces Law 25? The Commission d’accès à l’information du Québec (CAI). It handles complaints, can investigate and can impose administrative penalties.
Sources: CAI, main changes brought by Law 25; CAI, writing a privacy policy (guide for businesses); CAI guidelines 2023-1 on valid consent; Shopify Help Center, customer privacy settings.
Want this done for you?
Email MarketingKlaviyo flows that turn first orders into repeat customers.→ShopifyShopify stores built to rank and sell.→ Free checklistKlaviyo email and SMS checklist, 36 checks, online or as a PDF.→Want to know what email could bring in?
We look at your Klaviyo flows, your sign-up forms and how much of your revenue email brings today, then tell you what we’d fix first. You don’t have to hire us afterwards.
Free retention audit