Quebec's Law 25: what the law requires of your website and your marketing

We explain the law without legal jargon, then show you exactly how we apply it to the websites and campaigns we manage in Quebec.

Quebec's Law 25 is the Quebec law that governs the collection, use, retention and communication of personal information. It requires four things: a designated person in charge of the protection of personal information whose contact information is published, a privacy policy written in simple and clear terms, separate consent for each purpose, and the reporting of incidents that present a risk of serious injury. It applies to any business that processes information about people in Quebec, regardless of its size or where it is established.

Adopted in 2021, it has been fully in force since 2024. Quebec's Commission d'accès à l'information (CAI) can impose penalties of up to $10M or 2% of worldwide turnover, and penal fines of up to $25M or 4%. An honest clarification: Wavency is not a law firm. We cover the web, measurement and marketing side (your website, your cookies, your advertising tools). For the legal analysis, we work with your advisor.

Check my compliance
Response within 24 business hours · No long-term commitment

Trusted by

Context

Quebec's Law 25 isn't solved with a cookie banner added at the last minute

Most of the websites we look at are non-compliant without knowing it. Tracking cookies fire before any consent, the banner doesn't offer a “Reject all” option as visible as “Accept all”, the privacy policy predates 2023, and nobody in the company knows who the designated person in charge is.

The problem is that these gaps are fairly easy to fix, but they're invisible from the website's interface. You have to open the code, look at what is being sent to Google, Meta or an analytics tool, and check when it's sent. That's exactly the kind of check we do before touching a campaign: non-compliant tracking is also, very often, tracking that measures poorly.

01

You don't know what data your website collects
Forms, live chat, pixels, analytics tools, plugins: we draw up the actual list of what is collected, by which tool, for what purpose and where it goes.

02

You advertise online
Meta pixels, Google Ads tags, remarketing: these tools do profiling. They must be disabled by default and only activate after clear consent, not after a simple page scroll.

03

You have no person in charge, no policy and no register
The law requires an identified person in charge with published contact information, a policy in plain language and a register of confidentiality incidents. We put all three in place, without turning it into a six-month project.
Why us
Compliance handled by people who also understand your marketing
Selling the fear of $25M fines to get you to sign quickly.
Explaining the requirements, ranking them by actual risk, and fixing them one by one.
An “Accept all” plugin installed in ten minutes that lets pixels fire before the click.
Profiling cookies disabled by default, refusing as visible as accepting, preferences that can be changed at any time.
Becoming compliant by breaking tracking, then running campaigns blind.
Consent Mode and modelled conversions configured so your data stays usable, fully within the law.
Promising “full compliance” without being qualified for the legal side.
We cover web, measurement and marketing. For the legal side, we work with your advisor or refer you to one.
Our services

What we check and set up for Quebec's Law 25

Web compliance comes down to six areas. None of them is complicated on its own; forgetting them is what ends up being costly.

Here's what we cover every time.
DATA AND TOOLS INVENTORY
We list everything that collects information on your website (forms, chat, pixels, analytics, plugins), with the purpose, retention period and destination of each piece of data.
CONSENT AND COOKIE MANAGEMENT
Profiling cookies disabled by default, a banner that names each purpose, “Reject all” as visible as “Accept all”, preferences that can be changed at any time, and choices recorded so you can prove them.
PRIVACY POLICY
A policy in simple, clear terms that's easy to find: what is collected, why, for how long, who it's shared with, and how to exercise your rights.
GOVERNANCE AND INCIDENTS
A designated person in charge of the protection of personal information with published contact information, a register of confidentiality incidents, and a procedure for reporting to the CAI when there is a risk of serious injury.
COMPLIANT AD TRACKING
Consent Mode, GA4, Google Ads tags and Meta pixels configured to fire only after consent, without losing your ability to measure and optimize.
INDIVIDUALS' RIGHTS
Access, rectification, withdrawal of consent and data portability (mandatory since September 22, 2024): we set up a concrete process to respond to these requests within the required time limits.
Get a compliance diagnostic for my website
strategy

How we make a website compliant without breaking your measurement

No need to redo everything. We work in stages, fixing what exposes you the most first, and we document each decision so you can justify it if you're ever asked.

01

We take inventory
We look at your website's code and at what is sent outside. You get the actual list of your tracking tools and of the data collected. It takes a few days, without changing anything on your end.

02

We rank by risk
Not all gaps are equal. We separate what really exposes you, what's easy to fix right away, and what requires a business decision on your part.

03

We put it in place
Consent banner and management, privacy policy, Consent Mode, contact information of the person in charge, incident register. We fix, we test, and we confirm that tracking still holds up.

04

We document it and keep it up to date
A written record that shows what was done and why. We revalidate every time a new tool is added to your website, because in practice, that's where compliance gets lost.
FAQ
The questions we get asked the most
Direct answers, without the unnecessary jargon.
What is Quebec's Law 25?
It's the Quebec law that governs the collection, use, retention and communication of personal information. Its official name is the Loi modernisant des dispositions législatives en matière de protection des renseignements personnels (An Act to modernize legislative provisions as regards the protection of personal information). It was adopted in 2021 and applies to businesses and public bodies alike.
Does it apply to my business?
Yes, as soon as you process personal information about people in Quebec. There is no size or revenue threshold, and your business doesn't need to be established in Quebec to be subject to it.
Since when has it been in force?
In stages: September 2022 for a first set of provisions, September 2023 for most of the obligations (consent, transparency, privacy impact assessments, anonymization), and September 22, 2024 for the right to data portability. It is now fully in force.
Do I need a cookie banner?
If your website uses profiling, identification or location cookies (in other words, if you have analytics or advertising), yes. These cookies must be disabled by default, and the option to refuse must be as visible and as simple as the option to accept.
What are the penalties?
The Commission d'accès à l'information can impose administrative penalties of up to $10M or 2% of worldwide turnover. Penal fines can reach $25M or 4%. There is also a private right of action: affected individuals can claim damages.
Will complying wreck my campaign data?
No, not if it's done right. With Consent Mode and conversion modelling, Google Ads and GA4 keep learning from visitors who have consented. You lose a bit of granularity, not your ability to optimize.
Does Wavency handle the legal side?
No. We cover the website, measurement and marketing: inventory, consent, privacy policy, compliant tracking, individuals' rights. For legal analysis, service provider contracts and formal assessments, we work with your legal advisor.
Let's talk

Ready for your audit?

Fill out the form and receive a proposal tailored to your business within 24 business hours. No pressure, no commitment.

Response within 24 business hours · Your data stays confidential
Our work

Élexpertise

Content creation

Constance

Branding

Cheval Blanc

Content creation
see all our work
© 2026 Wavency Media
Privacy policy