Law 25 Quebec cookie banner and consent requirements
Since 22 September 2023, Quebec’s Law 25 has required that the functions of a technology that can identify, locate or profile a visitor be switched off by default until the visitor chooses to activate them.
This covers many cookies and other tracking technologies used for analytics, advertising, personalisation and profiling.
Pre-ticked boxes and “by continuing to browse, you agree” banners do not count.
This page explains what a Law 25 compliant cookie banner has to do, who the Law applies to, what penalties can apply for non-compliance, and how CookieHub handles Quebec visitors.
What Law 25 says about cookies
Law 25, formerly Bill 64, modernised Quebec’s Act respecting the protection of personal information in the private sector.
Its provisions came into force in stages between September 2022 and September 2024, and they are enforced by the Commission d’accès à l’information du Québec (CAI).
The provision that matters most for cookies is section 8.1, in force since 22 September 2023.
When an organisation collects personal information using a technology with functions that can identify, locate or profile a person, it must inform that person.
According to the CAI’s guidance, those functions must also be deactivated by default. The person has to take an action to activate them.
Quebec does not use exactly the same test as Europe, where technologies are generally divided into “strictly necessary” and non-essential ones.
Under Law 25, what matters above all is what the technology does.
Cookies and similar technologies that can identify, locate or profile a visitor must not have those functions activated by default.
In practice, many analytics, advertising, personalisation and behavioural tracking tools must therefore stay inactive until the visitor makes a choice.
By contrast, a cookie used only to keep a shopping cart or a login session, with no identification, location or profiling function within the meaning of section 8.1, is not subject to this activation requirement.
What a Law 25 compliant cookie banner must do
A banner configured only for Canada’s general privacy requirements may not be enough in Quebec.
A Law 25 compliant banner should, in particular:
Keep identification, location and profiling functions off until the visitor activates them:
The technologies concerned must not activate before the visitor makes an affirmative choice. A banner that only informs the visitor, without controlling the tracking technologies, is not enough.
Explain the purposes clearly:
The visitor must understand why their information is collected and used. They should also be able to get more information easily about the technologies used, the third parties involved and the data practices.
Allow a choice for specific purposes:
Consent must be requested for specific, clearly defined purposes. Where different purposes require consent, visitors should be able to make the appropriate choices rather than being forced to accept all tracking.
Never assume consent:
No pre-ticked boxes, no consent by scrolling, and no “by continuing to use this site, you agree” wording. Taking no action is not valid consent.
Allow consent to be withdrawn:
The visitor must be able to change their choice later. The site should offer an easily accessible way to reopen the consent settings.
Keep proof of consent:
The organisation must be able to show that valid consent was obtained. The Law does not prescribe a particular technical method, but a consent log that records the choice, the time and the context is a practical way to document it.
Offer the interface in French:
Separately from Law 25, Quebec’s language rules generally require commercial content aimed at Quebec consumers to be available in French. The consent interface should therefore also be offered in French.
Who needs to comply with Law 25?
Law 25 applies broadly to private sector enterprises carrying on activities in Quebec.
A business based outside Quebec may also be covered where its activities have a sufficient connection with Quebec, in particular where it actively offers products or services to people in Quebec or collects their personal information.
This can include:
enterprises carrying on business in Quebec, whatever their size;
businesses based elsewhere in Canada or abroad that actively serve Quebec customers or collect personal information from people in Quebec;
non-profits, professional practices and service providers, where they are subject to the Law.
There is no general small business exemption and no revenue threshold once the Law applies.
Individual rights under Law 25
Law 25 gives people in Quebec several rights over their personal information.
A cookie banner does not cover all of these rights, but it is often the visitor’s first point of contact with a site’s personal information practices.
The main rights include:
Right to be informed
To know what information is collected, why, and, depending on the circumstances, to whom it is disclosed.
Right of access
To request access to the personal information an organisation holds about them.
Right to rectification
To request the correction of information that is inaccurate, incomplete or equivocal.
Right to withdraw consent
To withdraw consent given earlier, subject to the applicable rules.
Right to cessation of dissemination or de-indexing
In certain circumstances, to request that an organisation stop disseminating personal information or de-index a hyperlink that gives access to it.
Right to data portability
Since September 2024, to request certain computerised personal information in a structured, commonly used technological format, subject to the exceptions set out in the Law.
Right to be informed of automated decisions
To be told when a decision is based exclusively on automated processing of personal information, and to obtain certain information about that processing.
Right to be notified of certain confidentiality incidents
Where an incident presents a risk of serious injury, the people concerned must be notified in accordance with the applicable rules.
Is cookie consent required in the rest of Canada?
Outside Quebec, Canadian privacy requirements vary with the province, the organisation and the nature of the processing.
The federal PIPEDA and the private sector laws of Alberta and British Columbia can permit implied consent in appropriate circumstances, depending on factors such as the sensitivity of the information and the reasonable expectations of the individual.
Quebec takes a more specific approach for the technologies covered by section 8.1: their identification, location and profiling functions must be deactivated by default.
That difference can make a single banner for all of Canada less precise.
A configuration based only on opt-out may not be enough in Quebec where a technology identifies, locates or profiles visitors.
Conversely, a strict opt-in configuration applied across Canada may ask for explicit consent in situations where the applicable rules would allow a different approach.
A consent management platform can therefore adapt the banner’s behaviour to the visitor’s region.
Penalties for Law 25 non-compliance
Law 25 considerably strengthened the enforcement powers of the Commission d’accès à l’information.
Depending on the nature of the offence, the consequences can include:
Administrative monetary penalties: up to CAD 10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is higher.
Penal fines: up to CAD 25 million or 4% of worldwide turnover for certain offences, with amounts that can be increased for a repeat offence.
Private claims: where an unlawful infringement of a right protected by the Law causes injury and results from an intentional or gross fault, punitive damages of at least CAD 1,000 can apply.
The CAI’s decisions and orders can also be made public.
How to make your website Law 25 compliant
For cookies and other tracking technologies, the process comes down to a few steps:
Scan:
Find the cookies, trackers and technologies your site actually uses, including those added by third-party scripts, tag managers and embedded content.
Categorise:
Work out the purpose of each technology and identify the ones that can identify, locate or profile visitors.
Block until consent:
Make sure the functions concerned stay deactivated until the visitor activates them.
Ask for consent properly:
Show a clear banner, in French, that lets the visitor understand their choices and change them.
Document:
Keep proof of consents, keep the information about cookies and their purposes up to date, and publish an appropriate privacy policy.
Designate a person in charge:
The business must identify the person in charge of the protection of personal information, as the Law requires.
How CookieHub handles Quebec visitors
CookieHub is a consent management platform used on tens of thousands of websites.
It lets you apply consent behaviour suited to visitors from Quebec and the rest of Canada.
Prior consent for Canada
CookieHub detects the visitor’s region and applies the consent behaviour configured for it. New domains use opt-in consent for all visitors by default, including visitors from Quebec, so the relevant technologies remain inactive until the visitor makes their choice. Region-specific settings can be added on top, for example with the Recommended opt-in group that includes Canada.
Choice by category, easy withdrawal
Visitors can accept or refuse different categories of cookies. Categories are not activated by default when prior consent is required, and visitors can reopen their preferences later.
French and English automatically
CookieHub supports many languages, including French and English, and can match the banner language to the visitor’s browser. The text can also be customised.
Proof and cookie monitoring
Visitors’ choices can be logged to provide proof of consent and of its withdrawal. The CookieHub scanner helps detect the cookies used on the site and keep the cookie declaration up to date as the site changes.
Make Law 25 compliance easier
Add CookieHub to your site, scan the technologies it uses and configure a banner suited to Quebec visitors.
CookieHub can keep the technologies concerned from activating before consent, record visitors’ choices and keep your cookie declaration up to date.
Free for small websites, no credit card required.
Frequently asked questions about Law 25 and cookies
If your site uses a technology with functions that can identify, locate or profile a visitor, you need to take the requirements of section 8.1 into account.
This can include analytics tools, advertising pixels, heat maps, embedded content and other tracking technologies.
If a cookie has no identification, location or profiling function within the meaning of section 8.1, the specific requirement to deactivate it by default does not necessarily apply to that technology.
Other transparency or consent obligations may still apply where personal information is collected.
Standard Google Analytics configurations that use identifiers and cookies can include functions that recognise a visitor from one visit or page to the next.
Those functions must be assessed against section 8.1, and where they can identify, locate or profile a person, they must be deactivated by default until the visitor activates them.
Measurement methods that do not rely on those functions must be assessed separately.
No.
Law 25 and the GDPR are two different legal regimes.
For many tracking technologies, though, the practical result can be similar: certain identification and profiling mechanisms must not be activated automatically, and valid consent must be clear, free and given for specific purposes.
A banner that genuinely meets European requirements is therefore often a good starting point for Quebec, but it does not automatically cover every Law 25 obligation.
Law 25 has its own rules on, among other things, the person in charge of the protection of personal information, privacy impact assessments and certain communications of personal information outside Quebec.
It can.
A business located elsewhere can be subject to the Law where it carries on business in Quebec or where its activities have a sufficient connection with Quebec.
A business that actively markets its services to people in Quebec or collects their personal information should therefore examine seriously whether it is covered, rather than assume that being based outside the province is enough to exclude it.
Personal information is any information that concerns a natural person and allows that person to be identified, directly or indirectly.
Depending on how it is used and its context, this can include IP addresses, device identifiers, identifiers associated with cookies and certain behavioural data.
Personal information is sensitive when, because of its nature or the context of its use or disclosure, it entails a high level of reasonable expectation of privacy.
This can include certain medical, biometric, genetic or financial data, as well as other particularly intimate information.
Consent to the use of sensitive personal information must be given expressly.
The Commission d’accès à l’information du Québec (CAI).
It can investigate organisations’ practices, issue orders and impose administrative penalties in the situations provided for by the Law.
Quebec public bodies are governed mainly by a different legislative regime from the one that applies to private sector enterprises.
Certain activities or categories of information can also be subject to exclusions or specific rules.
There is, however, no general exemption for small businesses simply because of their size.
The Commission d’accès à l’information publishes the text of the Law, guidelines on consent and information on cookies and other tracking technologies.
These resources are available on the CAI’s website.
Last updated:
Disclaimer: The information provided on this page is for general reference purposes only and is not intended to constitute legal or regulatory advice. Data privacy regulations are complex and subject to frequent updates, interpretations, and jurisdictional variations. While efforts are made to keep the material accurate and up to date, we cannot guarantee its completeness or applicability to your specific circumstances. For guidance on compliance or legal obligations, please consult qualified legal professionals or the appropriate regulatory authorities.
