# Quebec Law 25: what it means for cookies and tracking

> Quebec's Law 25 is the strictest privacy law in Canada and the closest to the GDPR. Since 22 September 2023, a business that collects personal information through technology with functions that identify, locate or profile a person must tell the person first and explain how to activate those functions, which the Commission d'accès à l'information reads as tracking off by default. Advertising cookies, analytics that profile, and location tracking therefore need an opt-in, while the privacy-by-default rule explicitly leaves browser cookie settings aside. The Commission can impose administrative penalties of up to C$10 million or 2% of worldwide turnover, and courts can fine up to C$25 million or 4%.

Source: https://cookiequiet.com/laws/quebec-law-25
Published: 2026-10-20
Publisher: Cookiequiet

## Quick facts

- **Applies to:** Every enterprise that collects, holds, uses or communicates personal information in Quebec, whatever its size or where it is based (Act respecting the protection of personal information in the private sector)
- **Consent model:** Opt-in for functions that identify, locate or profile a person: they must be deactivated by default and explained before collection (section 8.1); consent must be clear, free, informed and purpose-specific (section 14)
- **Cookie rule:** Section 8.1 for tracking and profiling technologies; section 9.1 (highest privacy settings by default) does not apply to browser cookie settings
- **Maximum fine:** Administrative monetary penalties up to C$10 million or 2% of worldwide turnover; penal fines up to C$25 million or 4% of worldwide turnover, doubled for repeat offenses
- **Authority:** Commission d'accès à l'information du Québec (CAI)
- **In force since:** Assented 22 September 2021; obligations phased in on 22 September 2022, 2023 (including section 8.1 and the penalties) and 2024

## What is Law 25?

Law 25, introduced as Bill 64 and assented on 22 September 2021 (S.Q. 2021, chapter 25), rewrote Quebec's two privacy statutes: the Act respecting the protection of personal information in the private sector, which applies to businesses, and the Act respecting access to documents held by public bodies. It came into force in three waves. On 22 September 2022 businesses had to appoint a privacy officer and report confidentiality incidents. On 22 September 2023 the bulk of the obligations arrived: privacy impact assessments, consent rules, privacy by default, the transparency duties for tracking technologies, and the new penalty regime. On 22 September 2024 the right to data portability followed.

## Who does Law 25 apply to?

The private sector Act applies to any person carrying on an enterprise that collects, holds, uses or communicates personal information about Quebec residents, with no threshold of size or revenue and no requirement to be established in Quebec. An online business elsewhere in Canada or abroad that serves Quebec customers or tracks Quebec visitors is covered. Quebec's law is one of the three provincial regimes considered substantially similar to the federal [PIPEDA](/laws/pipeda), which it replaces for businesses operating in the province.

## What does Law 25 require for cookies and trackers?

Two sections matter for websites.

Section 8.1 says that anyone who collects personal information from a person using technology that includes functions allowing the person to be identified, located or profiled must first inform the person of the use of that technology and of the means available to activate those functions. Profiling is defined broadly as collecting and using personal information to assess characteristics, in particular to analyze or predict work performance, economic situation, health, preferences, interests or behavior. The Commission's reading, stated on its own Law 25 page, is that such functions cannot be enabled by default: the person has to switch them on. Advertising cookies that build interest profiles, analytics tools that follow individuals across sessions, and geolocation all fall under this rule, which makes them opt-in.

Section 9.1 requires products and services offered to the public to provide the highest level of confidentiality by default, without any intervention by the person. Its second paragraph says this does not apply to privacy settings for browser cookies, which is often misread as a cookie exemption. It only means that the website does not have to force a browser's cookie settings; section 8.1 still governs the tracking functions themselves.

Section 14 sets the standard for consent: it must be clear, free, informed and given for specific purposes, requested separately from any other information, in clear and simple language, and it is valid only for the time needed to achieve the purposes. Consent for sensitive information must be express. Section 8 lists what the person must be told at collection: purposes, means, rights, and whether the information may be sent outside Quebec.

Strictly necessary cookies that do not identify, locate or profile anyone (a session identifier, a cart, the record of the consent choice itself) are outside section 8.1 and need only the general transparency of section 8. First-party analytics that counts visits without following individuals sits at the border; analytics configured to recognize a returning visitor or to build audiences is profiling and needs the opt-in.

## What must a compliant banner do?

- Describe, before any tracking runs, that the site uses technology that can identify, locate or profile the visitor, and what it is used for.
- Keep those functions off until the visitor activates them: an Accept or per-category opt-in, not pre-ticked boxes or tracking that starts on page load.
- Offer a Reject option as visible as Accept, and a way back to the settings to withdraw.
- Present the request in French for Quebec visitors (the Charter of the French language applies to websites serving Quebec), and in plain language.
- Record the choice, since the enterprise must be able to show it obtained valid consent.

## Enforcement and fines

Since 22 September 2023 the Commission d'accès à l'information can impose administrative monetary penalties without going to court, up to C$50,000 for an individual and up to C$10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is greater, for an enterprise. Penal proceedings before the courts carry fines of C$15,000 to C$25 million or 4% of worldwide turnover, whichever is greater, with the amounts doubled for a second offense. Officers and directors who authorize or tolerate the offense are personally liable. The Commission published its general framework for administrative penalties and has so far favored investigations, orders and cooperation; the first penalties have concerned incidents and surveillance rather than cookie banners, but the tracking rule is explicitly on its agenda.

## How Cookiequiet handles Law 25

Canada is in Cookiequiet's list of regulated countries, so with geo-targeting on, visitors from Quebec and the rest of Canada see the consent banner. The default banner matches section 8.1: nothing in the analytics and marketing categories runs before the visitor chooses, the Accept all and Reject all buttons have equal weight, the preferences center has all optional categories off, and the French strings are picked from the browser language and editable. The consent log keeps each choice as evidence, and [Google Consent Mode v2](/guides/google-consent-mode-v2) keeps Google tags in their denied state until the visitor opts in. Policies generated by Cookiequiet are templates written for the GDPR and the CCPA; adapt the Quebec-specific wording (privacy officer, transfers outside Quebec) with your advisor. See also [the Reject all guide](/guides/reject-all-button).

## Questions

### Does Quebec Law 25 require opt-in consent for cookies?

For cookies that identify, locate or profile a person, yes in practice: section 8.1 requires the business to inform the person first and to explain how to activate those functions, and the Commission d'accès à l'information says they cannot be on by default. Strictly necessary cookies that do none of those things are not caught.

### What does the browser cookies exception in section 9.1 mean?

Section 9.1 requires the highest privacy settings by default for products and services, and its second paragraph excludes browser cookie settings from that specific duty. It does not exempt websites from section 8.1, which still requires tracking and profiling functions to be explained and activated by the person.

### What are the penalties under Law 25?

The Commission can impose administrative monetary penalties of up to C$10 million or 2% of worldwide turnover, and penal fines imposed by the courts go up to C$25 million or 4% of worldwide turnover, doubled for repeat offenses. Both regimes have applied since 22 September 2023.

### Does Law 25 apply to businesses outside Quebec?

Yes. The private sector Act applies to any enterprise that collects personal information about people in Quebec, regardless of where it is established. Serving Quebec customers or tracking Quebec visitors online is enough.

## Sources

- [Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), Légis Québec](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1)
- [National Assembly of Québec, Bill 64 (Law 25): assented 22 September 2021](https://www.assnat.qc.ca/en/travaux-parlementaires/projets-loi/projet-loi-64-42-1.html)
- [Commission d'accès à l'information, Principaux changements apportés par la Loi 25](https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/principaux-changements-loi-25)