Quebec Law 25: Cookie Consent and Fines 2026
Quebec Law 25 for website owners: who must comply, the cookie consent rules under sections 8.1 and 9.1, the fines, and how to make your banner compliant.
Quebec Law 25 is the province’s private sector privacy law, and it now sets some of the strictest data rules in North America. It reaches any business that handles the personal information of people in Quebec, so a shop in Montreal and a software company in Texas can both fall under it. For a website, the real work lands on a few things: getting proper consent before you track anyone, telling people plainly what you collect, and being ready to show your records if the regulator asks. The fines are what make it matter, climbing into the millions of dollars for a serious breach.
Most Law 25 guides are written for corporate privacy officers with a legal team down the hall. This one is written for the person who runs the site. It covers whether the law reaches you, the cookie rules that trip almost everyone up (sections 8.1 and 9.1 pull in different directions), the exact fines, and how to make your banner compliant without hiring a lawyer.
What is Quebec Law 25?
Law 25 is Quebec’s overhaul of its private sector privacy rules, passed in September 2021 and rolled out in stages through 2024. Its full name is the Act to modernize legislative provisions as regards the protection of personal information, and you’ll still see its old name, Bill 64, in older articles.
The law rewrites Quebec’s 1994 private sector privacy act and its public sector counterpart, and it’s enforced by the Commission d’accès à l’information, the provincial regulator everyone calls the CAI. Personal information under Law 25 is any data about a person you can identify. That includes the obvious things like a name, an email, or a phone number, and the quieter ones like an IP address, a cookie identifier, device details, and location. If a piece of data can be tied back to a real human, the law treats it as personal information and holds your site responsible for it.
What changed in 2021 was the ambition. Quebec took a fairly light regime and pushed it toward Europe’s standard, with consent by default, a named person in charge of privacy, mandatory breach reporting, and fines large enough to change how a company builds. In a few places it goes further than the federal law that governs the rest of Canada.
Who does Law 25 apply to?
If your business collects personal information from people in Quebec, Law 25 applies, even when your company, your staff, and your servers sit somewhere else. The law follows the data of Quebec residents, not your postal code.
The trigger is carrying on an enterprise, which covers almost any commercial activity. If you sell a product, run ads, capture leads, or trade on the data in any way, you’re inside the law. A company based anywhere else, elsewhere in Canada or abroad, is caught the moment it offers goods or services to Quebec residents or monitors their behaviour, and running analytics or ad tracking on Quebec visitors counts as monitoring. A Shopify store based in Ontario and a software company in Berlin are both bound by Law 25 for their Quebec customers, the same as a business in Montreal.
This sits on top of Canada’s federal law, so a national site usually has to satisfy both. Canada’s federal PIPEDA governs data that crosses provincial or national borders, while Law 25 governs the Quebec layer. The safe assumption for any site that reaches the whole country is that both apply, and that Quebec is the stricter of the two.
When did each Law 25 obligation take effect?
Law 25 came in over three years, on September 22 of 2022, 2023, and 2024, so all of it is now in force. The biggest wave landed on September 22, 2023, when the consent and transparency rules started.
The first date, in 2022, was narrow. Every organisation had to name a privacy officer and stand up a breach process, meaning they report any incident that carries a risk of serious injury to the CAI and to the people affected, and keep a register of every one. The 2023 date is where most of the website work sits. Consent rules kicked in, along with a duty to publish clear privacy policies, run a privacy impact assessment before a higher risk project, tell people when a decision about them was made only by a machine, put written terms around cross-border transfers, and honour a new right to have a harmful search result de-indexed. The last date, in 2024, added the right to data portability, so a person can ask for their information in a structured, common format and move it elsewhere.
Because every stage has now passed, there’s no grace period left to lean on. A Quebec visitor who lands on your site today can expect the full set of rights, and the CAI can act on any gap.
Does Quebec Law 25 require cookie consent?
Yes, for the cookies that track or profile people. Under section 8.1, any technology that identifies, locates, or profiles someone has to stay switched off until the visitor turns it on, and the CAI reads that as an opt-in consent rule for analytics and advertising cookies.
A lot of guides get this wrong, because two sections point in different directions. Section 9.1 says a technological product’s privacy settings must default to the highest level of confidentiality, and then it carves out an exception, because that rule does not apply to browser cookies. Plenty of articles read only that line and tell you cookies are exempt from Law 25, which is only half the law. Section 9.1 exempts cookies from the default settings rule, but section 8.1 still forces an opt-in for any cookie that identifies, locates, or profiles a visitor, so the two rules work together rather than cancelling out.
In practice the split is simple. Strictly necessary cookies, the ones that keep a login or a shopping cart working, don’t need consent and can load right away. Non-essential cookies, the analytics and advertising ones that watch what a visitor does, have to stay off until that visitor agrees. If your site loads a tracking pixel or an analytics tag before anyone clicks accept, you’re offside, and the fix is a banner that holds those scripts back.
What makes a cookie banner Law 25 compliant?
A compliant banner blocks every non-essential cookie until the visitor agrees, gives reject the same weight as accept, and keeps a record of the choice. The CAI’s guidance from November 2023 is specific: the accept and reject options sit on the same screen, and withdrawing consent has to be as easy as giving it.
Work through the concrete rules and a banner almost designs itself. Put Accept all and Reject all on the same layer, at equal visual weight, so refusing is one click and not a hunt through menus. Never leave a consent box ticked by default, since a box the visitor didn’t check isn’t consent. Group cookies by purpose so people can agree to analytics but not advertising, and describe each tracker in plain language on that first screen rather than in a policy nobody opens. Give a standing way to change the answer, usually a small link in the footer, and log every choice with a date so you can prove it later. Most Quebec sites also serve French visitors, so the banner should read in French as well as English.
The consent behind all this has to hold up on its own terms. Law 25 wants it clear, free, and requested for each purpose on its own, so a single take it or leave it agreement that bundles every tracker into one click doesn’t count. The visitor also has to be able to pull that consent back at any time, which is why the footer link matters as much as the banner itself.
A cookie consent widget that holds declared scripts until consent does this work for you. It presents reject at the same weight as accept, blocks each tracker by category until its category is agreed, and keeps a 13-month consent log you can export, with no raw IP stored. Wire it to Google Consent Mode v2 and your analytics and ad tags respect the choice automatically. If you build it to the standard of a good cookie consent banner, you clear Law 25 and the European rules at the same time.
What are the penalties for breaking Quebec Law 25?
Law 25 carries two separate penalty tracks. The CAI can impose administrative penalties up to CAD $10 million or 2 percent of worldwide turnover, and the Court of Quebec can order penal fines up to CAD $25 million or 4 percent of worldwide turnover, whichever number is larger.
A lot of summaries mash those two into a single scary figure, which muddies what you’re actually exposed to. The administrative penalty is the regulator acting on its own. The CAI weighs the seriousness of the breach, how sensitive the data was, how many people it touched, and how much you cooperated, then sets an amount up to that CAD $10 million or 2 percent ceiling. The penal fine is different, because it follows a prosecution for a specific offence, tops out at CAD $25 million or 4 percent, and doubles on a repeat. On top of both, Law 25 gives people a private right of action: someone whose rights were breached can sue for damages that start at a minimum of CAD $1,000, even without proving a dollar of loss.
To see how far Quebec has moved, compare it to the federal ceiling. PIPEDA offences cap at CAD $100,000, so a serious Law 25 case can cost hundreds of times more. Those numbers sit in the same range as Europe’s GDPR, which is exactly the company Quebec wanted to keep.
What else does Quebec Law 25 require beyond cookies?
Beyond cookies, Law 25 asks you to name a privacy officer, report serious breaches, run an assessment before a risky project, and honour a longer list of individual rights. The consent rules get the attention, but these obligations carry the same weight.
The privacy officer role falls by default to the person with the highest authority in the company, usually the chief executive, unless it’s formally delegated to someone else, and the contact details have to be public. Breach reporting kicks in whenever an incident creates a risk of serious injury. You tell the CAI and the people affected, and you record the incident in a register you keep regardless. A privacy impact assessment is required before you acquire, build, or overhaul a system that handles personal information, and before you send that information outside Quebec.
The individual rights are broader than most site owners expect. People can ask to see the data you hold on them and to correct it, and they can ask you to de-index a search result that unfairly harms them. Since September 2024 they can also request portability, meaning a copy of their data in a structured, common format they can take elsewhere. And if an automated system makes a decision about someone with no human involved, you have to tell them and let them ask for a review. None of this needs a legal department, but it does need a plan you can point to.
How does Quebec Law 25 compare to PIPEDA and the GDPR?
Law 25 sits between Canada’s federal PIPEDA and Europe’s GDPR, and in a few places it’s the strictest of the three. It borrows the GDPR’s opt-in consent and heavy fines, while PIPEDA still allows a softer opt-out for ordinary tracking and caps its own penalties far lower.
The table below lays out where the three laws land for a typical website.
| Area | Law 25 (Quebec) | PIPEDA (Canada) | GDPR (EU) |
|---|---|---|---|
| Consent for tracking cookies | Opt in, off by default | Consent needed, opt out can suffice for non-sensitive use | Opt in, off by default |
| Maximum penalty | CAD $25 million or 4% of worldwide turnover | CAD $100,000 per offence | 20 million euro or 4% of global turnover |
| Regulator power | The CAI imposes penalties directly | The OPC recommends, courts impose fines | Data protection authorities fine directly |
| Who it covers | Enterprises handling Quebec residents’ data | Private business in commercial activity | Any organisation processing EU residents’ data |
| Breach reporting | To the CAI and affected people on risk of serious injury | To the OPC and affected people on real risk of harm | To the authority within 72 hours |
The practical takeaway is that a GDPR-grade setup covers Law 25 comfortably, because both demand opt-in consent and carry fines in the same range. A site that only did the federal PIPEDA work has a real gap, since PIPEDA’s opt-out allowance and its low ceiling fall short of what Quebec now expects. If you already handle the CCPA for California as well, Quebec becomes one more layer of a job you’ve mostly done.
Getting Quebec Law 25 right without a legal team
Law 25 rewards the site that’s honest about what it collects and careful about how it asks, and it goes hardest on the one that tracks first and explains later. For a typical website the load is lighter than the fines suggest. Assume the law applies if people in Quebec use your site, get the cookie banner and the consent log right, name a privacy officer, keep a short breach plan, and be ready to answer a data request.
Treat Quebec as the strict case and the rest of Canada mostly falls into place behind it. A cookie consent widget that gates tracking scripts and records every choice handles the heaviest job, the daily consent work, and leaves you with a clean record to show if the CAI ever asks. Many teams reach for one dedicated tool instead of stitching scripts together, the same reason people move off heavier suites like OneTrust.
Quebec Law 25 is the province's private sector privacy law, and it sets the rules a business follows when it collects, uses, or shares the personal information of people in Quebec. In plain terms, you need a real reason to collect data, you have to ask before you track anyone, you have to keep the data secure, and you have to let people see, correct, or delete what you hold. Quebec passed it in September 2021 and phased it in through 2024.
Yes, in most cases, because Law 25 follows the personal information of people in Quebec, not your company's address. If your site offers goods or services to Quebec residents, or tracks their behaviour with analytics or ad cookies, you're generally in scope even when your company and servers sit in another province or country. A store in Ontario or a software company in Texas with Quebec customers has to account for it.
For most sites, yes. Under section 8.1, any technology that identifies, locates, or profiles a person has to stay off until the visitor turns it on, and the regulator reads that as an opt-in rule for analytics and advertising cookies. Strictly necessary cookies, like the ones that keep a login or a cart working, don't need consent. The tracking ones do, and they have to wait behind a banner that offers a genuine reject.
Law 25 has two penalty tracks. The Commission d'accès à l'information can impose administrative penalties up to CAD $10 million or 2 percent of worldwide turnover, whichever is greater. For prosecuted offences, the Court of Quebec can order penal fines up to CAD $25 million or 4 percent of worldwide turnover, and those double on a repeat. Individuals can also sue for damages starting at CAD $1,000.
Law 25 came in over three years, on September 22 of 2022, 2023, and 2024, so every provision is now in force. The first date brought the privacy officer and breach reporting rules. The 2023 date was the big one, with consent, transparency, and privacy impact assessments. The final date, in 2024, added the right to data portability.
PIPEDA is Canada's federal privacy law and applies across the country, while Law 25 is Quebec's own private sector law and it's stricter. Law 25 wants consent by default for tracking, a named privacy officer, and impact assessments for higher risk projects. The fines are the biggest gap: PIPEDA offences top out at CAD $100,000, while Law 25 reaches CAD $25 million or 4 percent of worldwide turnover.
