Quebec Law 25 and Website Tracking: The Default-Off Rule
Summary
Quebec’s Law 25 is the strictest tracking rule in Canada. Section 8.1 requires telling people up front when technology can identify, locate or profile them, and how to turn those functions on. Quebec’s regulator, the CAI, reads this as off by default: profiling cookies, tracking pixels and geolocation scripts should not run until the visitor turns them on.
Most privacy laws say “get consent before you track.” Law 25 goes a step further and says the tracking must be off until the visitor switches it on. For a marketing or analytics team, that is a meaningful difference in how a consent banner has to behave.
The sections below cover what Section 8.1 requires, the consent standard, and who enforces it, with the penalties. They finish with how Law 25 relates to PIPEDA, and how to verify your Law 25 setup.
What Section 8.1 requires
Section 8.1 targets a specific category: technology used to identify, locate, or profile a person. For that technology, the section requires the business to inform the visitor and give them a way to activate it. The CAI reads this as meaning the technology must be off by default, so nothing profiling runs on page load until the visitor turns it on, which is where consent comes in.
An ordinary strictly-necessary cookie, such as a login or cart, is not profiling technology and is not caught. A behavioral analytics cookie, an advertising pixel, or a geolocation script is, so it stays off until the visitor opts in.
The consent standard
Law 25’s consent bar is high, and higher than Canada’s federal law. Consent must be clear, free, and informed, and given for specific purposes. Each tracking purpose needs its own choice, and a written consent request must be presented separately from other information. The CAI expects a simple way to withdraw.
Who enforces it, and the penalties
The Commission d’accès à l’information, the CAI, enforces Law 25. The penalties are among the most severe in North America. Administrative monetary penalties reach CAD 10 million or 2 percent of worldwide turnover, and penal fines reach CAD 25 million or 4 percent, doubled for repeat offences. Individuals can also sue for damages, with a minimum of CAD 1,000 in punitive damages for an intentional or grossly negligent breach.
For specific CAI enforcement actions, see our Enforcement Watch tracker.
Law 25 and PIPEDA
Most of Canada is governed federally by PIPEDA, which is more permissive: it allows implied consent for lower-sensitivity processing, so a well-disclosed analytics cookie can sometimes rely on implied consent. Only Quebec has the default-off rule. If you have visitors in Quebec, Law 25 is the stricter standard you build to, and meeting it generally covers PIPEDA as well. See our Canada website tracking compliance hub for the federal picture.
How to verify your Law 25 setup
The default-off rule is testable, and it is exactly the kind of thing sites get wrong without knowing. DataTrue loads your site in a real browser and records what fires before the visitor makes any choice, so you can confirm that no profiling cookie, pixel, or geolocation script runs on page load, and that these only activate after an opt-in. Sensitive Data Detection inspects the payloads with fictitious personas. The result is a record that your tracking is genuinely off by default, which is what Section 8.1 requires.
See how consent verification works
Questions
What does Quebec Law 25 require for cookies?
Section 8.1 requires telling visitors up front about technology that identifies, locates, or profiles them, and how to turn it on. The CAI reads this as meaning that technology must be off by default, so profiling cookies, tracking pixels, and geolocation scripts should not run until the visitor actively opts in. Strictly necessary cookies, like a login or cart, are not caught.
How is Law 25 different from PIPEDA?
Law 25 is stricter. PIPEDA, the federal law, can allow implied consent when information is not sensitive and the use is within what people would reasonably expect. Under Law 25, as the CAI reads it, profiling technology must be off by default, and consent must be clear, free, informed, and given for each specific purpose. Only Quebec has the default-off expectation.
Who enforces Quebec Law 25 and what are the penalties?
The Commission d’accès à l’information (CAI). Administrative penalties reach CAD 10 million or 2 percent of worldwide turnover, and penal fines reach CAD 25 million or 4 percent, doubled for repeat offences. Individuals can also sue for damages.
Related guides
See what your tags do in every consent state
DataTrue loads your real pages as a visitor who accepts, rejects, or sends an opt-out signal, and reads what each tag sends. A tag that ignores the visitor’s choice shows up in a test.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
