Law 25: 5 mistakes that expose your website to penalties
Quebec's Law 25 applies to any business that collects personal information. Here are the 5 most common website gaps — and how to fix them before the privacy commission (CAI) gets involved.
Law 25 in a nutshell
Since September 2023, Quebec's Law 25 requires every private business that collects personal information — a name, an email, an IP address, a cookie — to meet concrete obligations. A simple contact form or analytics tool is enough to trigger the law.
The Commission d'accès à l'information (CAI) can impose administrative penalties up to $10M or 2% of worldwide revenue, and penal fines up to $25M or 4%. The good news: the CAI favors education before sanctions, and being proactive is a mitigating factor.
- Applies as soon as personal data is collected
- No minimum company size
- The burden of proof is on you
Mistake 1 — Dropping cookies and trackers before consent
This is the most widespread gap. Many sites load Google Analytics, the Meta pixel or third-party maps the moment a visitor arrives, before any consent. Law 25 requires free and informed consent BEFORE placing non-essential cookies.
In practice, that means blocking tracking scripts until the person agrees.
- Check what loads on first paint
- Defer trackers until consent
Mistake 2 — A decorative consent banner
A "This site uses cookies — OK" banner is not enough. Consent must be granular (accept/refuse per purpose), as easy to refuse as to accept, and revocable at any time.
A banner that only offers "Accept" is not valid consent under Law 25.
- "Refuse" button as visible as "Accept"
- Choice per category (analytics, marketing…)
- Ability to withdraw consent
Mistake 3 — A missing or vague privacy policy
The law requires a clear, accessible policy written in plain language: what information is collected, why, who it is shared with, how long it is kept, and how to exercise your rights.
A generic policy copied from a foreign template does not cover Quebec requirements.
- Precise purpose for each collection
- Retention periods
- Contact to exercise rights
Mistake 4 — No privacy officer designated
Law 25 requires designating a person responsible for the protection of personal information (by default, the person with the highest authority) and publishing their contact details.
Many SMBs overlook this — yet it is a simple, publicly verifiable obligation.
- Name a privacy officer
- Publish their contact email
Mistake 5 — Forms without a clear purpose or consent
Every requested field must have a reason. A form that asks for unnecessary information, or auto-subscribes to a newsletter without a separate checkbox, breaks the minimization and specific-consent principles.
The rule: collect only what is strictly necessary, and get separate consent for each secondary use.
- One field = one justified purpose
- Newsletter consent not pre-checked
Take action in 30 seconds
Not sure where your site stands? Run the free compliance scan: in 30 seconds it analyzes your cookies, banner, policy and forms, then gives you a score and the points to fix — with cited law articles.
Then I guide you to put everything in order, no legal jargon. We fix the essentials first, the rest step by step.
— Melissa Manuelita Joseph, compliance & SEO advisor at SEOparAI.
