Law 25 and your website, in practice

If your site has a contact form, you are collecting personal information. That is the threshold, and it is low: a name and an email are enough. A newsletter, an analytics tool or a booking widget put you in the same position.

This piece covers what Law 25 asks of a small business website, what it does not ask, and how the site you are reading is set up. It is not legal advice.

Consent has to come before collection

This is the point most sites get wrong, and it is mechanical rather than legal.

Implied consent, the "by continuing to browse, you agree" kind, is no longer enough. Section 14 of the Act respecting the protection of personal information in the private sector requires consent that is manifest, free, informed and given for specific purposes, asked for each of those purposes and presented separately from any other information. Section 8.1 adds that if you use technology that can identify, locate or profile a person, you must inform them beforehand that you are using it and of the means available to activate those functions. The Commission d'accès à l'information publishes the eight criteria it applies to that consent.

In other words, the visitor agrees before collection starts, not after.

In practice that means your analytics tool must not load until someone has clicked. A banner that appears while the tool is already running in the background does not make you compliant: it documents you.

I know because that was the case here. The first version of this site loaded its measurement tools on page open, roughly 1.8 seconds before the banner appeared, and the "Essential only" button changed nothing on the next visit. The banner said "nothing is enabled before you agree". That was false. Today the measurement scripts mount only after a recorded consent, and refusing genuinely prevents them from loading.

If you check one thing after reading this, check that one on your own site.

Essential cookies are not handled like the rest

The Act does not talk about "cookies" as such. Section 8.1 covers technology that can identify, locate or profile a person, and a cookie holding your cart, your session or your language choice does none of those three things. Plenty of small businesses hobble their own site by treating everything as optional.

The distinction is not "Google or not Google". It is: can the site do what the visitor asked without this cookie?

A policy that describes your site, not someone else’s

Section 8.2 requires a privacy policy published on the site and written in clear, simple terms. A policy copied from another site is worse than none, because it describes practices you do not have.

Section 8 sets out what has to be announced at collection time: the purposes, the means used, the rights of access and correction, the right to withdraw consent, and the possibility that the information travels outside Quebec. Third parties have to be announced too, either by name or by category. The law allows the choice, but naming the supplier is more use to a reader than writing "our partners".

And if your forms go through an American service, section 17 comes in on top: communicating personal information outside Quebec requires a privacy impact assessment before it is sent, then a written agreement with the supplier. A small business using three or four cloud tools has that question to answer three or four times.

The vocabulary matters too: Quebec law refers to the responsable de la protection des renseignements personnels. That is not the European regulation’s “DPO”, even though templates found online often use that word.

By default, the responsible person is you

That is section 3.1, and it is short: within the business, the person with the highest authority carries the function of person in charge of the protection of personal information. They can delegate that function in writing, in whole or in part. In a three-person company that is the owner, without having to appoint themselves, and not delegating does not create an absence of responsibility.

The same section adds that this person's title and contact details are published on the business's website. That is a line in your policy, not a position to create.

Keep things for less time

Section 23 is direct: once the purposes for which information was collected are fulfilled, it must be destroyed or anonymised, subject to a retention period set by a statute. Keeping quote requests "just in case", indefinitely, is the most common failing and the easiest to fix: decide on a duration, write it into your policy, and delete what exceeds it.

If you do not know what to pick, a short period is easier to defend than a long one. What you do not keep cannot leak.

What it actually costs

For a brochure site with a form and an analytics tool, the four basic moves take a few hours: a banner that genuinely holds the scripts, a policy written from your own practices, a retention period, and the contact details of the person in charge.

What those few hours do not cover is the rest of the Act. Sending information outside Quebec requires a written assessment before it goes, and that assessment is not a box to tick. The note below says the same thing.

This is a plain-language summary. Law 25 carries further obligations depending on company size and the nature of the information handled, including privacy impact assessments and disclosure outside Quebec. For your specific situation, consult a legal advisor.