Law 25 compliance for websites
Law 25 is Quebec’s privacy law, known in French as Loi 25 and rolled out in three stages between September 2022 and September 2024, enforced by the Commission d’accès à l’information. It is provincial, not federal, so a team that has covered Canada through PIPEDA has not covered Quebec, where consent has to be explicit, sought one purpose at a time, and tracking technology has to ship switched off.
- Quebec, consent rules in force since 2023
- Opt in, and one purpose at a time
- Privacy on by default is in the statute
From €10 a month. No credit card, no per-visitor billing.
What Law 25 asks for
A handful of duties fall on a website specifically. The rest of the Act covers how you govern personal information across the organisation.
- Consent express, specific, and sought one purpose at a time
- The consent request kept separate from other terms, in plain words
- Technology that profiles or locates ships with those functions off
- A privacy officer named and reachable from the site
- Confidentiality incidents recorded, and reported where there is risk
This page explains what the law asks for and what our software does about it. It is not legal advice, and it cannot tell you whether your organisation is compliant, because that depends on everything else you process.
What Consent Studio does about it
Asks the Quebec way, per purpose
The banner requests consent for each purpose on its own, in the languages you have activated, and a tag you have placed under that purpose waits until it is granted. Bundling analytics and advertising into one Accept is the pattern Law 25 rules out, and it is the default shape of most consent tools.
- Per purpose
- Plain language
- Blocks until granted
Ships switched off
Scripts that can profile or locate a visitor stay inactive until consent once you have marked them, which is the state section 9.1 asks technology to start in. The defaults follow the visitor’s region, so a Quebec visitor gets the stricter starting point without your team maintaining a second configuration.
- Default deny
- By visitor region
- One configuration
Keeps a record you can produce
Each choice is stored with a timestamp against the wording that was on screen, and withdrawal stays one click from every page. Demonstrating valid consent means showing what the visitor actually saw and agreed to, not what your settings say now.
- Timestamped
- Versioned wording
- Withdraw anywhere
Where sites get Quebec wrong
Three assumptions carried over from other privacy laws account for most of what a first scan turns up on a site aimed at Quebec.
Canada is treated as one problem
A PIPEDA-shaped approach leans on implied consent for routine purposes, which Law 25 does not extend to tracking. A site can be fine for the rest of Canada and offside in Quebec on the same page load, because the stricter rule is the provincial one.
One Accept covers every purpose
Consent under Law 25 is purpose by purpose, and a single button that turns on analytics, advertising and personalisation together is not specific in the way the Act requires. The fix is not more text, it is separate choices.
The banner is shown but nothing is held back
Tags fire on the same load that displays the banner, so the visitor is asked a question whose answer is already being ignored. Law 25’s default-off rule makes this an explicit failure rather than an implied one.
Consent was buried in the terms
A line about cookies inside a general terms-of-use acceptance is not a request made separately and in clear language. Law 25 names both of those, so consent gathered that way does not count even if the visitor clicked.
Essential
€10/month
For a single site that has to be compliant, and stay that way.
- Unlimited pages and displays
- 200,000 consent actions a month
- The full stack, not a starter tier
Professional
€36/month
For growing teams that run on data, and the agencies serving them.
Try Professional for FreeEnterprise
From €250/month
For a volume, or an obligation, a standard plan cannot answer.
Explore EnterpriseAgencies & Resellers
Buy at a partner rate and resell client sites at your own price.
Discover Partner ProgrammePublic Sector
Government, healthcare and education run on Enterprise.
See Enterprise
Running under rules like these, in more than one country
Other rules that may apply to you
Common questions about Law 25
Does Law 25 apply to a business outside Quebec?
Yes, if it collects, holds or uses personal information about people in Quebec in the course of business. Where the company is based does not decide it. Carrying on activities that reach Quebec residents, including running a website they use, is what brings you in.
Is Law 25 the same as Canada’s PIPEDA?
No. PIPEDA is the federal law and Law 25 is Quebec’s own, and Law 25 is stricter on consent, on default settings and on penalties. A business active across Canada has to meet both, and meeting PIPEDA does not mean meeting Law 25.
Do I need a cookie banner for Law 25?
In practice yes, for anything that is not strictly necessary. Consent has to be obtained before non-essential tracking runs, asked for each purpose, and kept separate from your other terms, which is what a properly configured banner does and a terms checkbox does not.
What does the privacy by default rule mean for my tags?
Section 9.1 says that where a product or service has technical settings that identify, locate or profile a person, those functions must be deactivated by default. For a website that means tracking scripts start blocked and are enabled only by a consent choice, not the other way round.
What are the penalties under Law 25?
Administrative monetary penalties reach 10 million Canadian dollars or 2 percent of worldwide turnover, and penal fines reach 25 million dollars or 4 percent, whichever is higher. Law 25 also created a private right of action, so individuals can claim damages directly.
Does Consent Studio make us compliant?
No single tool can, and any vendor saying otherwise is selling you something. Consent Studio handles the part a consent platform can handle: asking properly, holding every tag to the answer, keeping the record, and telling you when the site changes. What you process elsewhere is yours.
Where is our consent data stored?
In Amsterdam, on infrastructure owned and operated by Scaleway, a French company. Ownership matters more than location here: Scaleway is independently French rather than a European subsidiary of a US parent, so neither they nor we fall under the US CLOUD Act. Consent Studio itself is built and owned in the Netherlands.
Get Started with the Full Consent Stack
Everything you need in one bundle. Consent Studio provides you with a consent banner, scanner and client-side tag manager that guarantees no data ever gets transferred overseas.
Read the documentation
Our help center walks through every integration, plugin and template step by step, with screenshots. It is written and kept current by the people who build Consent Studio.