Law 25
Quebec Act to Modernize Legislative Provisions (Law 25)
Quebec, Canada
Phased in 2022 to 2024
Americas
Who must comply
Any private-sector enterprise that collects, uses or discloses personal information of individuals in Quebec.
Penalties
Administrative monetary penalties up to CA$10 million or 2% of worldwide turnover, and penal fines up to CA$25 million or 4% of worldwide turnover.
Key obligations
- Obtain clear and informed consent, express for sensitive data
- Publish governance policies and a privacy officer contact
- Run privacy impact assessments for risky projects
- Offer data portability and respond to access requests
- Report confidentiality incidents to the Commission and affected individuals
How ConsentX helps
Express, unbundled consent for sensitive and tracking uses
Geo-aware banner for Quebec visitors
Consent receipts and an audit-ready evidence trail
Rights and access request workflow
Region rule engine to separate Quebec from the rest of Canada
Get Law 25 ready with ConsentX
This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.
How to comply with Law 25 using ConsentX
- 1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under Law 25.
- 2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that Law 25 requires, automatically.
- 3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
- 4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a Law 25 audit.
- 5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.
Frequently asked questions
Does Quebec Law 25 require express consent for tracking?+
For sensitive data and many profiling, tracking and location uses, consent must be express and clearly separate from other requests.
Who enforces Quebec Law 25?+
The Commission d'acces a l'information du Quebec, known as the CAI, enforces the law and can impose significant penalties.