Québec Law 25
Not legal advice
The law as we understand it on 5 November 2026. See the overview for what these pages are and are not.
What the law asks
Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25, applies to businesses that collect personal information about people in Québec.
- Off by default (section 8.1, in force since 22 September 2023). A technology that can identify, locate or profile a person must have those functions turned off by default. The person must be told beforehand that it is used and how to turn the functions on — they have to act to switch them on.
- Consent (section 14) must be manifest, free and informed, given for specific purposes, asked for each purpose separately, and can be withdrawn. Express consent is required for sensitive information; the Commission d'accès à l'information (CAI) recommends express consent in general.
- Disclosure: your privacy policy must say that you use such technologies.
Commentators still disagree on how far section 8.1 reaches ordinary analytics cookies; advertising and profiling cookies are clearly covered. The CAI enforces.
For the rest of Canada the federal PIPEDA applies; this page does not cover it.
How ConnectWiz handles it
| The rule | In ConnectWiz |
|---|---|
| Tracking off by default | Every category except strictly necessary is denied until the visitor turns it on. |
| Told beforehand, act to turn on | The banner explains each category and its providers; turning anything on takes a click. |
| Consent per purpose | Analytics, marketing and functional are asked separately in Preferences. |
| Withdrawal | The cookie button stays on every page. |
Canada is never given the US opt-out model: a visitor's province cannot be told from the address, and Québec wants tracking off first.
What you still need to do
- Do not open Canada with a region rule. A rule that grants analytics or
marketing by default for
CAwould also turn them on for visitors in Québec. - Say in your privacy policy that you use cookies and similar technologies, for what, and how visitors can turn them on or off.