Quebec's Law 25

Quebec has Canada's strictest private sector privacy law. It is usually called Law 25, it came into force in stages from September 2022, and the private right of action and data portability followed in September 2023. It matters to businesses well beyond Quebec, because it is written around whose information you handle rather than where your office is.

The rule that trips people up

Under Law 25, technology that identifies, locates, or profiles a person has to be turned off by default. The visitor has to switch it on, not switch it off. That is close to the opposite of how most websites ship, where the analytics and advertising tools are running the moment the page loads and the visitor would have to go find a way to stop them.

So the profiling and behaviour tracking a typical marketing stack does out of the box is exactly the kind of thing Law 25 wants defaulted to off. Not removed, not banned. Off until the visitor turns it on.

Does it reach a business outside Quebec

Quebec's regulator, the Commission d'accès à l'information, takes the position that the law reaches organizations outside Quebec that collect the personal information of people in Quebec. That is the regulator's reading, and it is the one you would be arguing against. It has not been settled by a court, so anyone who tells you flatly that Law 25 binds your Ontario business is going further than the record supports, and so is anyone who tells you flatly that it does not.

The practical version is simpler. If Quebec is a real market for you, treat the law as live and get a lawyer to look at your situation. If you have never had a Quebec customer and do not expect one, it is not the thing to spend your attention on.

What the penalties look like

On paper they are the sharpest numbers in Canadian privacy law. Administrative penalties run to $10 million or 2 percent of worldwide turnover, whichever is greater. Penal offences run to $25 million or 4 percent of worldwide turnover, whichever is greater. There is also a minimum penal fine of $15,000 for a corporation, which doubles on a repeat offence.

Those are maximums, and a maximum is the worst case the drafters could imagine, not a price list. We would rather you fixed the default because it is the right way to run a website than because a number frightened you. The piece on what actually happens if you are not compliant goes through what Canadian regulators have really issued.

What to actually do about it

The good news is that the fix for Quebec is the same fix that makes you stronger everywhere. If your tracking tools default to off and only switch on when someone agrees, you are in a better position under Law 25, under PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law, and under whatever comes next. Holding your tags until someone says yes is the mechanism that makes off by default possible without breaking your site, and it has its own piece.

We are not lawyers and this is not legal advice, and the reach question above is genuinely open. This is what the law says and what the regulator has said about it. For your own position, talk to a lawyer, particularly if Quebec is a real market for you.

If you sell into Quebec and you are not sure whether your site defaults your tracking on or off, that is a specific thing worth checking, and it is one of the things we look at.