01
Free tool · Quebec Law 25 · French and English
Law 25 privacy policy generator.
Answer six questions about your business and you get a privacy policy and cookie banner text written for Quebec's Law 25, in French and English, ready to paste onto your site. The tool runs in your browser, so we never see what you type, and there is no account to create and no email to give.
Start the generator →Your documents are ready.
This is a template, not legal advice. Read it through, make sure every statement is true for your business, and change anything that is not.
Quebec's Charter of the French language means the French version has to be on your site. If you publish an English one too, put both up and link them to each other.
02
03
Before you publish.
- Put the policy on its own page and link to it from your footer and next to every form.
- Make sure the person you named has agreed to the role, and that the delegation is in writing if they are not the owner or president.
- Open your site in a private window, refuse cookies, and check that no _ga or _fbp cookie appears. A banner that does not actually block anything is the most common gap we find.
- Swap YouTube embeds to youtube-nocookie.com, which sets no tracking cookies until the visitor presses play.
- Keep a register of confidentiality incidents, even if it stays empty. Law 25 requires one.
- Come back to the policy whenever you add a tool that collects personal information, and at least once a year.
Not sure your tags really wait for consent? That check is part of our free site audit, done by a person who opens your site and looks.
What the law asks
Three things on your website.
Law 25 is long, but on a small business website it shows up as three things. The generator writes the first two. The third is a person, and you name them in step 05.
A privacy policy in clear, simple terms
Any business that collects personal information through its website has to publish a policy saying what it collects, why, who it shares it with, whether it leaves Quebec, and how people can see, correct or withdraw it. Legal boilerplate copied from a US template usually misses the Quebec-specific parts.
Permission before tracking cookies
Technology that can identify, locate or profile a visitor has to be off by default and switched on only when they agree. In practice that means analytics and advertising cookies wait for a yes, and saying no is as easy as saying yes.
A named person responsible for privacy
By default it is the person with the highest authority in the business. The role can be delegated in writing, and the person's title and contact details have to be published on your website, which is what the policy's first section does.
How it works
Written in your browser.
The generator is a script that loads with this page and runs on your computer. Your business name, your privacy officer's email and the rest of your answers never leave it. If you want to check, load the page, turn off your Wi-Fi and generate a policy. It still works.
Each answer adds or removes part of the policy. Tick online orders and you get a paragraph about billing details and your payment processor. Leave the tracking boxes empty and the policy says the site only uses the cookies it needs to run, and the banner section tells you that you do not need one. A bakery with a contact form will not end up with clauses about customer accounts.
Both languages come from the same answers. The French was written in Quebec French, not machine-translated from the English, so it says témoins and courriel where your customers expect them. Switch languages above the results and copy the one you need.
For the parts of Law 25 that happen off your website, such as incident reporting and privacy impact assessments, read our Law 25 guide.
The limits
What a template cannot do.
A generated policy is only as true as the answers behind it. If your site sends contact forms to a CRM you forgot to mention, or runs a pixel your web designer installed years ago, the policy will be wrong in a way no generator can catch. Read the result against what your site actually does.
A policy also does not make a banner work. Plenty of banners look right while Google Analytics and the Meta Pixel load the moment the page opens, before anyone clicks. Install the banner, then open your site in a private window, refuse everything, and check which cookies appear.
This is a template, not legal advice. It is written for the common case: a small business with a website, a contact form and a few marketing tools. If you handle health or financial information, sell to children, or let software make decisions about people, talk to a Quebec privacy lawyer.
Keep going
Where to go next.
The policy is what visitors see. These pages cover the rest.
FAQ
Law 25 policy
FAQs.
Is the Law 25 privacy policy generator free?+
Yes. There is no account, no email gate and no paid version. Generate as many policies as you like, for as many businesses as you like, and use the result however you want.
Is this legal advice?+
No. It is a template built on what Law 25 requires of a typical small business website, and we are a marketing agency, not a law firm. It is a sound starting point for the ordinary case. If your business handles sensitive information or your situation is unusual, have a Quebec privacy lawyer review it.
Does my small business really need a privacy policy under Law 25?+
If your website collects personal information, yes, and a contact form is enough to count. Law 25 applies to every business that handles personal information about people in Quebec, whatever its size. The policy has to be published on the website and written in clear, simple terms.
Do I need a cookie banner?+
If your site uses analytics, advertising pixels or other tools that can identify or profile visitors, yes. Those have to stay off until the visitor agrees, and the visitor has to be able to refuse as easily as accept. If your site only sets the cookies it needs to work, you do not need one, and the generator will tell you so.
Who should be our privacy officer?+
By default it is the person with the highest authority in the business, usually the owner, president or CEO. They can delegate the role in writing to someone else, such as an office manager. Whoever it is, their title and contact details have to be on your website.
Do I have to publish the policy in French?+
For a business operating in Quebec, yes. The Charter of the French language requires a French version, and an English one can sit beside it. That is why the generator writes both from the same answers.
What happens if we do not comply?+
Quebec's privacy regulator, the Commission d'accès à l'information, can impose administrative penalties of up to $10 million or 2% of worldwide turnover, and penal fines go up to $25 million or 4%. Small businesses are rarely the first target, but a complaint from a single customer is enough to start an inquiry.
Is anything I type sent to Davnoot?+
No. The policy is written by a script running in your own browser. Your answers are not uploaded, stored or logged, and closing the tab erases them.
Quebec Law 25
The policy is done.
Is the tracking?
Most Quebec websites we look at have a banner and a policy, and still load Google Analytics and the Meta Pixel before the visitor says anything. If you want someone to check yours and set your analytics up to respect consent without losing the data you need, book a free 30-minute call.