Quebec Law 25 compliance
Quebec asks for consent one purpose at a time.
Law 25 doesn’t accept a single blanket yes. Consent has to be clear, free and informed, requested separately for each purpose, in plain language. ConsentBit splits tracking into categories a visitor can accept one by one, and keeps the proof.
Google-certified CMP · IAB Europe registered CMP (ID 502) · 9 languages · Webflow, Framer, WordPress and any website builder
First visit to your site
We value your privacy
We use necessary cookies to run this site. With your permission, we’d also like to measure traffic and show relevant ads.
Until they choose, only necessary cookies run. The floating icon reopens their settings any time.
One toggle per purpose, not one button for everything.
Profiling technology, declared up front.
Quebec’s privacy law, enforced by the CAI.
Law 25 modernised the Act respecting the protection of personal information in the private sector. It applies to any enterprise that collects personal information in Quebec, whatever its size. The Commission d’accès à l’information (CAI) enforces it, and people can also sue directly.
Maximum penalty
$25 million
or 4% of worldwide turnover for penal offences, whichever is greater. Administrative penalties reach $10 million or 2%.
Enforced since
Phased in from 2022, with the consent and transparency rules from 22 September 2023
Private right of action
a court must award at least $1,000 in punitive damages for an intentional or grossly negligent breach
Five things Law 25 expects from your website
Each requirement in plain terms, next to how ConsentBit covers it.
What Law 25 requires
Consent requested for each purpose, in clear and simple language (s. 14)
How ConsentBit handles it
Each category is a separate choice, described in plain words.
What Law 25 requires
Tell people when you use technology that identifies, locates or profiles them (s. 8.1)
How ConsentBit handles it
The banner names the profiling and advertising category before anything loads.
What Law 25 requires
Publish a confidentiality policy on your website (s. 8.2)
How ConsentBit handles it
The banner links to your policy on the first screen.
What Law 25 requires
Express consent for sensitive information (s. 12)
How ConsentBit handles it
Sensitive tracking sits in a category the visitor has to switch on themselves.
What Law 25 requires
Let people withdraw, and show the privacy officer’s contact details (s. 3.1)
How ConsentBit handles it
A preferences link reopens the panel, and the banner links to your policy, where you list your privacy officer.
Section 14 adds that consent is valid only for as long as the purpose needs it, and that consent not given properly has no effect at all.
What a visitor sees, step by step
One choice per purpose, and nothing optional runs before it.
They land on your site
The banner explains what is collected and why, and links to your confidentiality policy. Analytics and Marketing are blocked.
They choose
Accept all, Reject all, or set each category separately in the preferences panel.
The choice takes effect
Allowed categories run. Anything they didn’t allow stays blocked.
They can change their mind
A preferences link reopens the panel, and the new choice applies straight away.
THE COOKIE EXCEPTION PEOPLE MISS
Law 25 carved cookies out of one rule, not all of them.
Section 9.1 says technological products and services must have their privacy settings at the highest level by default. Its second paragraph then says that does not apply to browser cookie settings. Teams read the headline and assume cookies are exempt from Law 25. They are not. The consent and transparency rules still apply.
Section 8.1 defines profiling as collecting and using personal information to assess characteristics such as someone’s preferences, interests or behaviour, which is what advertising pixels do.
Blocked until they agree
Nothing optional runs until the visitor answers, on every plan including the free one. Here is what that looks like.
Purpose by purpose, not all or nothing
Section 14 requires consent to be requested for each purpose separately. A single Accept button covering everything is the thing Law 25 was written to stop.
People can sue, and the floor is set
Where a breach of the Act is intentional or results from gross fault, section 93.1 says the court must award punitive damages of at least $1,000, on top of anything the CAI does.
Selling into Europe as well? See what GDPR requires →
Add a Law 25 ready banner to your site, free.
Records
A record of every consent, ready if the CAI asks
Every choice is recorded with when it was made and which categories the visitor accepted or rejected. You can export the log as a CSV file whenever you need it.
The visitor opted out, so advertising scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
Because consent has to be per purpose, a log that shows which categories were accepted is worth more than one that records a single yes.
FAQ
Quebec privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
It applies to any enterprise that collects, holds, uses or communicates personal information about people in Quebec. There is no revenue or headcount threshold, and it reaches businesses outside Quebec that collect information there.
Law 25 doesn’t name cookie banners. It requires consent for each purpose you collect for, in clear language, and it requires you to tell people when you use technology that identifies, locates or profiles them. A banner is the usual way to do both.
Only from one rule. Section 9.1 requires the highest privacy settings by default for technological products and services, and its second paragraph excludes browser cookie settings from that. Everything else in the Act, including consent and transparency, still applies.
It has to be clear, free and informed, given for specific purposes, and requested for each purpose in clear and simple language. In writing, it must be presented separately from other information. Consent is valid only for as long as the purpose requires, and consent that doesn’t meet these rules has no effect.
Administrative monetary penalties reach $10 million or 2% of worldwide turnover, whichever is greater. Penal offences reach $25 million or 4% of worldwide turnover. Both are decided case by case.
Yes. Where an unlawful breach of a right under the Act is intentional or results from gross fault, the court must award punitive damages of at least $1,000, in addition to compensation for the injury.
They are close in spirit. Law 25 is more explicit that consent must be requested purpose by purpose, it sets a floor for punitive damages, and it excludes browser cookie settings from its privacy by default rule. GDPR has no equivalent carve-out and no fixed damages floor.
See what GDPR requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
Give Quebec visitors a choice per purpose
ConsentBit splits tracking into categories a visitor can accept one at a time, acts on a withdrawal straight away, and records every choice.
This page is a general overview of Quebec’s Law 25 and the Act respecting the protection of personal information in the private sector, not legal advice. The Act covers far more than website tracking, including confidentiality incidents, automated decisions, data portability and transfers outside Quebec, which sit outside what a consent banner handles.