Quebec's Law 25 and your tracking stack: what changes if you sell to anyone in Quebec
Quick disclaimer up front: I’m a marketer, not a lawyer, and nothing here is legal advice. What follows is how I read the law’s requirements as someone who has to make tracking work inside them. Get your counsel to sign off on the actual policy.
That said, most of the Canadian marketing sites I look at, including ones run by companies with Quebec customers, have done nothing about Law 25 beyond a cookie bannerConsent management platform The banner and settings panel that asks visitors for cookie consent, records their answer, and switches tracking tags on or off to match. nobody tested. The law has been fully in force for the tracking-relevant parts since September 2023, and the penalties are not small.
What the law says about tracking
Law 25 amended Quebec’s private-sector privacy act, P-39.1. The section that matters for a marketing stack is 8.1. In plain terms: if you collect personal information using technology that can identify, locate or profile a person, you have to tell them first, tell them how to activate those functions, and those functions have to be off until they do.
Every tracking tool you run does at least one of those three things. The Meta pixelMeta pixel A small piece of code on your website that reports visits and actions (page views, leads, purchases) back to Meta from the visitor's browser. Blocked by ad blockers and some browser privacy settings. profiles. GA4GA4 Google Analytics 4, the current version of Google's free web analytics. Reports visits, traffic sources and conversions using its own attribution rules. identifies (pseudonymously, but it identifies). A heatmap tool records.
The law firms that wrote up the second wave of amendments, including Clyde & Co and Stikeman Elliott, read it the same way: identification, location and profiling functions need to be off by default and switched on by the person, not switched off by the person after the fact.
Section 9.1 adds privacy by default for the product or service itself: settings have to provide the highest level of confidentiality without the person doing anything. The section carves out cookieCookie A small file a website stores in your browser to recognize you on later visits. Ad tracking depends on them, and browsers and privacy laws increasingly limit them. settings specifically, which has caused a lot of confusion, but it doesn’t touch the 8.1 obligation about profiling technology.
The practical reading from Quebec’s privacy regulator, the Commission d’accès à l’information, is that tracking cookies need express opt-in consentConsent In tracking terms, the visitor's explicit permission for your site to set cookies and share their activity with ad platforms. Under laws like Quebec's Law 25, tracking that identifies or profiles someone needs it first. while strictly necessary ones don’t. Their published criteria for valid consent spell out what “express” means: clear, specific, informed, and given for a stated purpose.
The penalty side is what gets attention. Administrative penalties run up to $10,000,000 or 2% of worldwide turnover, and penal fines up to $25,000,000 or 4%. Those figures are the ceiling, not the norm, but they’re the reason legal teams care.
What this means for a typical stack
Translate the law into a checklist and it’s not that long.
Nothing that profiles fires before consent. Meta pixel, Google Ads tag, TikTok pixel, LinkedIn Insight, Hotjar, Clarity: all of them wait. In Google Tag ManagerGoogle Tag Manager Google's free tool for managing all the tracking snippets (tags) on a website in one place, so you can add or change tracking without editing the site's code. this means every one of those tags gets a consent condition, either through GTM’s built-in consent settings or a trigger that requires the consent cookie. Testing this is a five-minute job in GTM preview mode with a fresh browser. Most sites fail it.
The banner asks, it doesn’t inform. “By continuing to use this site you agree” is not consent under Law 25. The banner needs an accept and a reject that are equally easy to click, with the categories explained, and it needs to actually control the tags.
A banner that shows the right words while the pixel fires underneath is worse than no banner, because it documents that you knew.
Consent is recorded. You need to be able to show that a given visitor consented, when, and to what. Every serious consent management platform does this. A homemade banner that sets a cookie and nothing else doesn’t.
Withdrawal works. A visible way to reopen the preferences and turn things off, usually a footer link. When someone withdraws, the tags stop.
Your privacy policy matches reality. List the tools, what they collect, and why. Update it when the stack changes.
Keeping the data you’re allowed to keep
This is the part people skip, and it’s why marketers treat Law 25 as a loss. Done properly, the measurement loss is a lot smaller than the worst case.
Google’s consent mode lets the Google tags run in a restricted state before consent: no cookies, no identifiers, but an anonymous ping that Google uses to model the gap. Your Google Ads conversionConversion The action you want someone to take after seeing an ad: a purchase, a form fill, a booked call. Each platform counts conversions by its own rules, which is why two dashboards rarely agree. numbers become a modeled estimate for the unconsented share rather than a hole.
Server-side taggingServer-side tagging Running Google Tag Manager on a server you control. Tracking data goes from the visitor's browser to your server first, and you decide what gets forwarded to Google, Meta and everyone else. gives you one place to enforce the rules. Every event passes through your own container, which means the consent state is checked once, centrally, before anything is forwarded to Meta, Google or anyone else. It also means the vendor never sees the raw request from the browser, which is a cleaner story for your privacy policy.
First-partyFirst-party data Information you collect directly from your own visitors and customers (form fills, purchases, your own site's tracking), as opposed to data collected by or bought from someone else. analytics that don’t profile, such as a cookieless page-view counter, don’t trigger 8.1 in the first place and give you traffic numbers regardless of consent state. They won’t do attributionAttribution The rules for deciding which ad, click or channel gets credit for a sale or lead. Every tool uses different rules, so the same sale can be credited to Google in one report and Meta in another., but they’ll tell you the site is alive.
The order I’d do it in
Audit what fires before consent (GTM preview, fresh browser, ten minutes). Put every profiling tag behind a consent condition. Replace or configure the banner so it actually gates the tags.
Turn on consent modeConsent mode A Google feature that changes how Google's tags behave depending on whether the visitor accepted cookies. Visitors who decline still send an anonymous signal that Google uses to estimate the conversions it couldn't measure directly. for the Google tags. Then, if the account is large enough to justify it, move to a server-side container so the rule is enforced in one place.
Two days for most sites. Cheaper than the letter from the CAI, and a good deal cheaper than the reputational cost of being the case study. If you’d like the audit done and the GTM consent conditions built, that’s tracking and attribution work.