When we examine the source code of a typical small business website in Quebec, we usually find several trackers: analytics, a Facebook pixel, sometimes an old chat widget, and a booking tool that loads its own scripts. In most cases, the website offers visitors no way to decline any of them.
This is now a compliance issue. The final provision of Quebec's Law 25 came into force on September 22: the right to data portability, which allows individuals to ask a business for the personal information it holds about them in a structured, commonly used format. With this step, the three-year rollout that began in September 2022 is complete, and the entire law now applies.
Many business owners have not yet heard of it, or assume that "Loi 25" concerns only banks and large retailers. That is not the case. If your website has a contact form, a newsletter sign-up or analytics, the law applies to you. This article does not constitute legal advice. It presents the points we examine first from a web development perspective.
What are the three phases of Quebec's Law 25?
Law 25 (originally Bill 64) modernized Quebec's private sector privacy legislation. It came into force in stages:
- September 2022. Every business must have a person in charge of the protection of personal information. By default, this is the person with the highest authority, which in a small business is most likely the owner. Confidentiality incidents must be recorded in a register, and serious incidents must be reported.
- September 2023. The most substantial phase: privacy policies, clearer consent, privacy impact assessments in certain cases, rules on tracking technologies and profiling, and significantly higher penalties.
- September 2024. Data portability.
The penalties attracted the most media attention. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines can reach $25 million or 4%. A small business is unlikely to face amounts of that scale. However, the Commission d'accès à l'information can still investigate and order changes, and a lack of awareness of the law is not a valid defence.
Who is responsible for personal information in a small business?
A person in the business is responsible for personal information. If this role is not delegated in writing, it falls to the owner or the highest-ranking executive. That person's title and contact information must be published on your website. This is the simplest step on the list, yet many websites still omit it.
For a small business, a single line on the privacy page is sufficient: the person's name, title and email address. We recommend against a personal cell phone number. The address should be a professional one that is monitored regularly, because if someone writes to ask what information you hold about them, you must respond.
When must you obtain consent before tracking visitors?
This is the area where most small websites fall short, and the owner is often not at fault. The website was built years ago, someone added Google Analytics and a pixel, and no one has reviewed the setup since.
Law 25 states that if you use technology capable of identifying, locating or profiling a person, you must inform them and explain how to activate those functions. The prevailing interpretation is that anything beyond what the website strictly needs to function should remain disabled until the visitor consents. This covers most marketing and advertising trackers.
On a website, this means:
- A cookie banner that effectively blocks trackers until consent is given. Many banners are purely decorative, and the scripts load regardless.
- A genuine choice, with both the accept and refuse options easy to find.
- Analytics configured to respect that choice. Google's consent mode is helpful for this purpose.
- No forgotten pixels. Verify what actually loads on your pages, rather than what you believe is loading.
Your analytics will show less data as a result. This is a trade-off we consider worthwhile: honest partial figures are preferable to complete figures collected without consent. When properly configured, conversion tracking and analytics still show you what is working.
Do website forms fall under the law?
Yes. Every form on your website collects personal information. Ask only for the information you need. If you need an email address to answer a question, you do not need a date of birth or a home address. Adding that person to your newsletter is a separate purpose, which requires a separate request, with a checkbox that is not pre-ticked.
What should a privacy policy contain?
If you collect personal information through your website, you must publish a privacy policy on it, written in clear and simple terms. The policy should describe what you actually do.
Many websites use a policy copied from another source, sometimes a U.S. template. This creates a problem, because such a policy describes practices you do not have and omits those you do. A sound policy for a small business can be brief. It sets out what you collect, why, where it is stored, with whom you share it (your email tool, your booking system, your host), how long you keep it, and how to contact the person responsible.
The policy should also be available in French, which is in any case a requirement for a business website in Quebec.
Where does your data go?
This requirement often surprises business owners. If personal information leaves Quebec, which is the case with most email tools, booking systems and AI services, the law requires you to assess the risks before transferring it. For a small business, this means knowing which services you use and where they store data. We recommend documenting this on a single page, which will also make your privacy policy accurate.
What should a small website fix first?
If your website does not yet meet any of these requirements, the situation can be addressed methodically. We recommend the following order:
- Publish the name, title and email address of the person responsible on the website.
- Identify which scripts and trackers your website actually loads.
- Install a consent banner that effectively blocks them until the visitor consents.
- Rewrite your privacy policy so that it describes your actual practices.
- Review and streamline your forms.
On a typical small website, this represents a few hours of work. If the website runs on WordPress and has not been updated for some time, this is a good opportunity for a technical review, which regular site maintenance should cover in any case.
For official guidance, we recommend consulting the source directly. The Commission d'accès à l'information du Québec provides plain-language material for businesses in French and English.
These requirements may appear to be one more administrative obligation from Quebec City. In our view, however, the law is reasonable for small businesses. It gives every business a reason to remove trackers that no one remembers installing, and asking before collecting information is simply a matter of courtesy toward clients.