← ALL REGULATIONS
Quebec Law 25: tracking off until the visitor turns it on.
Quebec’s Law 25 requires a business to tell people before it uses technology that can identify, locate or profile them, and to leave those functions off until the person activates them. For cookies, that works out as opt-in: tracking stays off until the visitor chooses it.
Quebec Law 25 at a glanceOpt-in before tracking
- Applies to
- Businesses that collect personal information of people in Quebec
- In force
- In three stages from 2022; tracking rules since 22 September 2023
- Enforced by
- Commission d’accès à l’information (CAI)
- Penalties
- Administrative penalties up to C$10 million or 2% of worldwide turnover, and fines up to C$25 million or 4%
WHAT QUEBEC LAW 25 REQUIRES
What Law 25 asks of a site that uses tracking cookies.
THE RULETracking off until the visitor turns it onFunctions that identify, locate or profile a person must be activated by that person, not switched on for them.
WITH KATLARun Katla in GDPR mode: analytics, marketing and personalisation cookies stay off until the visitor turns them on. Auto mode treats Canadian timezones as opt-out, so set the mode explicitly.
THE RULETell people firstPeople must be told that the technology is used, and how to activate its functions, before any information is collected.
WITH KATLAKatla scans the site, classifies every cookie it finds and generates the cookie policy from that list, in 13 languages.
THE RULEClear, specific consentConsent must be clear, free and informed, given for specific purposes, and requested separately from other information.
WITH KATLAAccept, Reject and Customise sit together on the first layer of the banner, and nothing is pre-selected.
THE RULEInformation in FrenchQuebec’s language law expects information for consumers to be available in French.
WITH KATLAKatla’s banner and generated policies are available in French.
Quebec Law 25 questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Does Law 25 require a cookie banner?
- In practice, yes, for any cookie that can identify, locate or profile a visitor: the person has to be told first and has to activate those functions themselves.
- Is Law 25 stricter than PIPEDA?
- For tracking, yes. PIPEDA accepts opt-out consent for some online advertising, while Law 25 requires those functions to stay off until the person activates them.
- When did the cookie rules take effect?
- The rules on technologies that identify, locate or profile took effect on 22 September 2023, the second of Law 25’s three stages.
- What are the penalties?
- The CAI can impose administrative monetary penalties of up to C$10 million or 2% of worldwide turnover, and penal fines reach C$25 million or 4%, whichever is greater.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.