Guide · Quebec privacy law

Law 25, in
plain language.

Law 25 (formerly Bill 64) reshaped how Quebec businesses are required to handle personal information, and a lot of the digital marketing and website practices companies have run for years now carry real compliance risk. This guide breaks down what actually matters, in plain language.

Get your marketing stack reviewed
What Law 25 requires, in short

What Law 25
requires.

Clear, specific consent before collecting personal information
No more buried, vague privacy policies.
A designated person responsible for the protection of personal information at your organization.
Mandatory breach notification to affected individuals and Quebec's privacy regulator (the CAI).
The right for individuals to request deletion or portability of their personal data.
Privacy impact assessments before adopting new technology that handles personal data.
Where this touches your marketing

Where it touches
your marketing.

Cookie consent banners, email opt-ins, ad pixel tracking, and even how your CRM stores lead data all fall under Law 25's scope. Non-compliant cookie consent setups and vague privacy policies are two of the most common gaps we see when we audit Quebec business websites.

Practical next steps

Practical next steps.

Review your website's consent banner and privacy policy first — they're the most visible (and most commonly non-compliant) piece. Then audit what personal data your marketing stack actually collects and where it's stored, and confirm someone at your organization is formally responsible for it.

This guide is educational and not legal advice — for a formal compliance opinion, talk to a Quebec privacy lawyer. If you want your website and marketing stack reviewed for the practical gaps we see most often, that's a conversation we're glad to have.

Quebec Law 25

Find the gaps
we see most.

This guide is educational and not legal advice. If you want your website and marketing stack reviewed for the practical gaps we see most often, book a free 30-minute call.