Law 25 for websites: what Québec's privacy law requires

Law 25 governs the protection of personal information in Québec, and it applies to every business and nonprofit that collects it, including through a website. Concretely, your site must: display a privacy policy faithful to what it actually collects, obtain valid consent before activating cookies beyond the necessary ones, designate a privacy officer and publish their contact details, govern data transfers outside Québec, and let people exercise their rights (access, correction, withdrawal). It also reaches businesses outside Québec that serve Québec customers. Generic template policies fail exactly where the law insists: the policy must describe your site's real collection, not someone else's.

Who does Law 25 apply to?

Every private enterprise operating in Québec, whatever its size, along with nonprofits. A freelancer with a simple contact form is covered just like a large organization: as soon as personal information is collected (a name, an email, an IP address), the law applies. Businesses based outside Québec that serve Québec customers are covered as well, which makes this law relevant far beyond the province's borders.

The five things to check on your site

1. A privacy policy faithful to reality. It must describe what your site actually collects: forms, analytics tools, ad pixels, newsletter, orders. A policy copied from elsewhere describes someone else's collection, and that is precisely what the law faults.

2. Cookie management with consent. Cookies beyond the strictly necessary (statistics, advertising, personalization) require clear consent before activation, with refusal as easy as acceptance, and privacy-respecting defaults.

3. A designated privacy officer. Every organization must designate one (by default, the person with the highest authority, who can delegate in writing) and publish their title and contact details, typically in the privacy policy.

4. Cross-border transfers, governed. Hosting, newsletters, analytics: many services store data outside Québec. The law requires assessing those transfers and informing the people concerned. Knowing where your data sleeps is part of your obligations.

5. Rights people can actually exercise. Access to one's information, correction, consent withdrawal: your organization must be able to answer these requests, and your policy must explain how to make them.

What are the most common mistakes?

The generic template leads the list: an elegant policy describing imaginary collection. Then come the decorative cookie banner (which shows a message and activates everything anyway), the privacy officer never designated, and the analytics tools or pixels installed over the years that nobody remembers. That last one deserves a technical scan: the real cookie list of a site almost always surprises its owner.

How does compliance actually get done?

The sound path takes four steps: examine what the site really collects (forms, cookies, third-party tools, through a technical scan), write the policy from that examination, install genuine consent management, and document (privacy officer, register, retention practices). It is precise work rather than heavy work, and it goes well with a partner who can read a site under the hood.

A welcome side effect: this housekeeping doubles as a trust foundation for your customers, and a healthy prerequisite for any AI project, which runs on clean, well-governed data.

Frequently asked questions

My site only has a contact form. Am I covered by the law? Yes. A name and an email are personal information, and collecting them is enough to trigger the obligations: faithful policy, designated privacy officer, exercisable rights.

We are based outside Québec but have Québec customers. Does Law 25 apply to us? Yes. The law reaches organizations that collect personal information from people in Québec, wherever the organization sits. If Québec customers fill your forms or buy from your store, the obligations are yours too.

Is a generic privacy policy found online enough? It mostly creates a false sense of safety: the law asks for a policy describing your real collection. The starting point is a technical examination of your site, and the policy gets written from it.

What are the risks of falling short? The law provides administrative and penal sanctions that can be substantial. The most immediate risk for a small business remains trust: customers, partners, and clients increasingly check these practices before signing.

Are nonprofits really covered? Yes, on the same footing as businesses. Members, donors, volunteers: a nonprofit handles plenty of personal information, and the housekeeping protects the organization as much as the people.

The next step

The starting point is always the same: knowing what your site actually collects. That examination is routine work for us, and every site we deliver ships compliant. A first call, on us, to take stock.