Quebec Law 25 website checklist (and Bill 96)

How to use this list

Law 25 is Quebec's modernized private-sector privacy law. It sets rules for how a business collects, uses, keeps and shares personal information, and the Commission d'accès à l'information (CAI) oversees it. Bill 96 strengthened the Charter of the French Language, overseen by the Office québécois de la langue française (OQLF). Both reach your website.

Each item says what to look for on the site. Whether your business has to do it, and how far, depends on your situation, so confirm the legal part with a lawyer or with the CAI and OQLF guidance. Written October 2026; the rules and the regulators' guidance move, so check the current versions.

Cookie banner and Google Analytics: consent before anything loads

Analytics, advertising pixels, session recordings and some embeds (video, maps, chat) set cookies or send visitor data to the company behind them. Law 25 requires that people be told beforehand when you use technology that can identify, locate or profile them, and how to turn those functions on. The CAI reads this as meaning those functions cannot be on by default: the person has to switch them on. What to check (our working standard, which in places goes further than the text of the law):

• Nothing loads before the choice Open the site in a private window, click nothing, and watch the Network tab. If requests to Google Analytics, Meta or similar go out before the visitor chooses, consent is not working. A banner shown over a script that has already run protects nobody.
• Refuse is as easy as Accept Same screen, same size, same number of clicks, and no pre-ticked boxes.
• The choice can be changed later A cookie settings link in the footer that reopens the banner, so withdrawing consent is as easy as giving it.
• The banner names the tools "Google Analytics" is clear. "To improve your experience" is not.
• Embeds wait too A YouTube video or a Google Map can sit behind a click-to-load placeholder until the visitor opts in.
• Tag managers are gated If everything runs through Google Tag Manager, the container itself should not fire before consent.

A privacy policy people can find and read

If you collect personal information through your site, the law requires you to publish a privacy policy in clear and simple language, and to give notice when you change it. The CAI's guidance lists what it should cover. Look for these points:

• What you collect, and through what Contact form, newsletter, booking, analytics, cookies. Name each one.
• Why you collect it One plain sentence per purpose.
• Who receives it Your analytics provider, your email tool, your booking or payment service.
• Whether it leaves Quebec Many tools process data on servers elsewhere. Say so.
• How long you keep it A real period where you can set one. Vague wording helps nobody, and people can ask you for it.
• How to ask about it Access, correction, withdrawing consent, and who to write to.
• Your governance rules How you keep and destroy information, who is responsible for what, and how to file a complaint. The law asks for detailed information about these to be published in simple and clear language.
• Where it is linked Footer of every page, and next to every form.

A named person in charge of privacy

Someone has to be responsible for personal information in your business. By default that is the person with the highest authority in the business (in a small company, usually an owner or a partner), and they can delegate all or part of the role in writing. The title and contact details of that person must be published on your website.

Check that the policy shows a title and a working email (a role address such as privacy@yourdomain is fine), and then email it to see that someone reads it.

Contact forms: say why, and collect less

• A sentence next to the submit button What the information is used for, with a link to the policy.
• Only the fields you need A phone number field on a "download the guide" form is a flag.
• Marketing emails are a separate choice An unticked checkbox, not bundled with the contact request. Canada's anti-spam law has its own rules, separate from Law 25.
• You know where submissions go An inbox, a CRM, a form service. Know which company and which servers.
• Spam protection counts too A captcha usually loads a third-party script. It belongs on your list of tools.

Third-party tools and data leaving Quebec

Every service that receives visitor data is part of your privacy picture: analytics, fonts loaded from a CDN, map and video embeds, chat widgets, booking, form handlers, email tools. Law 25 requires a privacy impact assessment before personal information is communicated outside Quebec, including when a provider outside Quebec collects or keeps it on your behalf, and a written agreement with that provider. A separate assessment applies to projects that build or overhaul a system handling personal information. Whether a given tool or a website project triggers either one is a legal question. The technical part is knowing your list.

• Build the list Open the Network tab, sort by domain, and write down every third-party domain that appears.
• For each one, note three things What data it receives, where the company is based, and whether you could do without it.
• Host what you can yourself Fonts and scripts served from your own domain mean fewer requests leave the site.
• Keep the list up to date It feeds the privacy policy and any assessment your lawyer asks for.

Retention: keep less, delete on a schedule

Personal information should be destroyed or anonymized once the purpose it was collected for is done, unless another law requires you to keep it longer. For a website, in practice:

• Pick a retention period For contact-form emails, CRM entries and exports, and write it in the policy.
• Clear out the leftovers Old submissions, test entries and exports should not sit forever in inboxes and spreadsheets.
• Know who has access A form tool login shared by five people is a flag.
• Be able to answer a request Someone can find, show or correct a person's information. The law requires a written reply within 30 days of receiving the request.
• Have a plan for an incident Law 25 requires a register of confidentiality incidents (unauthorized access, use, disclosure or loss) and, when there is a risk of serious injury, prompt notice to the CAI and to the people concerned.

Bill 96: French on the website

The Charter of the French Language, as amended by Bill 96, gives consumers the right to be informed and served in French, and the OQLF says they can expect a complete French version of a business's website. Exceptions exist, so read the OQLF guidance for your case. On the technical side, these are the things that get missed:

• A French version exists and is easy to reach A visible language switch on every page, and a French version at least as easy to find and as complete as the other language.
• Real French pages Their own URLs (such as /fr/), a lang="fr" attribute, a translated title and description. Not machine-translated paragraphs under an English layout.
• The parts around the content Form labels and error messages, confirmation emails, the cookie banner, the privacy policy and the terms of sale.
• Online contracts and terms If customers accept standard terms online, the Charter generally requires the French version to be offered first, before any other language. Your lawyer can confirm whether your terms count as a contract of adhesion.
• Ads and promo banners In commercial advertising, French has to be markedly predominant over any other language.
• Language tags lang and hreflang attributes, so search engines and screen readers know which page is which.

A self-test you can run today

• 1. Private window, no clicks Open your site in a private window and leave the banner alone.
• 2. Look at the Network tab Reload with developer tools open. Any third-party request before you chose anything is a problem.
• 3. Click Refuse and reload Still nothing third-party? Good. Then click Accept and confirm the tools you named now load.
• 4. Check the footer Privacy policy link, cookie settings link, language switch.
• 5. Read the policy Does it name the tools your site actually uses, and a person to contact?
• 6. Send your own contact form Read the confirmation email, and check what language it is in.

On the websites we build for local businesses, the consent banner keeps analytics from loading until the visitor accepts, Refuse is as easy as Accept, and the French and English versions share one layout. The wording of the policy and the legal conclusions belong to your lawyer; we implement what they decide. You can see how a plain-language policy reads on our own privacy page.

Planning a new site or a redesign? Put these items in the written scope from the start. Our guide on how to compare website quotes shows what else a quote should spell out.