Is Your Website Law 25 Compliant? A Plain-Language Checklist
By Danny Malouin. Updated October 22, 2026. Reviewed every quarter.
Every part of Québec’s Law 25 is now in force. Most small business websites miss the same four things: a clear privacy policy, a named person in charge, tracking that stays off until visitors say yes, and a check before data leaves Québec.
This is a practical checklist, not legal advice. For your specific situation, talk to a lawyer.
At a glance
Maximum, or 2% of worldwide turnover if higher. Imposed by the CAI.[2]
Maximum, or 4% of worldwide turnover if higher. Doubled for repeat offences.[2]
We found no public record of a large fine against a small business yet. The risk today is mostly complaints, investigations and lost trust. That changes as the CAI publishes more decisions.
The checklist
Name and publish them
By default it is the owner or CEO. Publish the title and contact details on the site. Section 3.1.[1]
Keep a register
Log every confidentiality incident. Report serious ones to the CAI and the people affected. Sections 3.5 and 3.8.[1]
Give data back on request
In a structured, common format. In force since September 2024. Section 27.[1]
Cookies and analytics
The CAI’s consent guidelines say tracking functions must be deactivated by default and need a positive action from the visitor to turn on.[3] In practice, Google Analytics, the Meta pixel, LinkedIn tags and ad cookies should only load after a visitor clicks yes.
Strictly necessary cookies, like a shopping cart or a login session, are arguably outside that rule.[7] The CAI has not published a dedicated cookie guide, so the consent guidelines are the reference.
A banner with only an OK button is not consent. Refusing should be as easy as accepting.
The CAI said in October 2026 that deceptive interfaces weaken consent.[9] Dark patterns in banners are a growing risk.
Forms, CRM and data outside Québec
Every contact form sends personal information somewhere: your inbox, a CRM, a newsletter tool, a booking app. If that tool stores data outside Québec, section 17 asks for a privacy impact assessment and a written agreement before the transfer.[5]
Choosing tools hosted in Canada makes that assessment simpler. It does not remove it, because support teams and subcontractors abroad may still access the data.
Does it apply to you?
Yes, if you carry on a business in Québec. There is no size or revenue threshold. A one-person shop with a contact form is covered.
Businesses outside Québec that collect information about Québec residents are likely covered too, according to legal commentators. The law has no explicit clause on that, so it is an interpretation, not settled law.[8]
What changed in 2026
Decisions go public
The CAI started publishing its oversight decisions online.
Where to start
Name your person in charge
Five minutes. Put the title and an email on your privacy page.
List what your site collects
Every form, cookie, pixel and plugin. Note where each one sends data.
Fix tracking consent
Block analytics and pixels until visitors opt in, with a real reject button.
Rewrite the policy
Plain words, matching what your site actually does.
Beep Digital builds and hosts websites in Montreal. We can review your site against this checklist and fix the technical parts. For legal advice, work with a lawyer.
Sources
- CAI: Main changes under Law 25 (French)
- CAI: Penalties and prosecutions (French)
- CAI: Guidelines 2023-1 on valid consent (French)
- CAI: Guide to writing a privacy policy (French)
- CAI: Privacy impact assessment guide (French)
- LegisQuébec: Act respecting the protection of personal information in the private sector
- McCarthy Tétrault: Québec’s Law 25 and cookies
- BCLP: Québec Law 25, a little-known privacy law with a big reach
- CAI: Rethinking the role of consent, October 1, 2026 (French)
- CAI: Five-year report press release, June 2026 (French)
This checklist summarizes the law and CAI guidance as of October 2026. It is not legal advice. Where I give an opinion, I say so.