Guides · STELLAIRE

Quebec Law 25 and your website: what your business needs to do

Since September 2023, most Law 25 obligations apply to the websites of businesses in Quebec. Here is, in plain language, what your site needs.

Updated October 13, 2026 · STELLAIRE team · Version française

Key dates

  • September 22, 2022: appoint a person in charge of the protection of personal information and report confidentiality incidents.
  • September 22, 2023: privacy policy, consent, privacy by default and transparency about tracking technologies.
  • September 22, 2024: right to data portability.

The checklist for your website

  1. A clear privacy policy, in plain language, published on your site.
  2. The name or title and contact details of your person in charge of personal information.
  3. A cookie banner: analytics, advertising and profiling cookies are off by default; only essential cookies are active.
  4. A "Reject" button as visible as the "Accept" button.
  5. A way for visitors to change their choices at any time.
  6. Express consent before turning on Google Analytics, the Meta pixel or other tracking tools.
  7. Forms that ask only for the information you need, and say why.
  8. A process to answer access and correction requests.

What a business risks

The Commission d'accès à l'information can impose administrative penalties, and penal fines range from $15,000 up to $25,000,000 or 4% of worldwide turnover. Beyond fines, a non-compliant site sends the wrong signal to your customers.

How we apply it

The websites STELLAIRE builds include a privacy policy, compliant cookie management and forms that collect only what is needed, by default. If your current site is not compliant, our team can review and fix it.

This article is general information, not legal advice. For your specific situation, consult a qualified professional.

Frequently asked questions

Does Law 25 apply to small businesses?

Yes. It applies to every business that collects personal information in Quebec, whatever its size.

Do I need a cookie banner?

If your site uses analytics, advertising or profiling tools (such as Google Analytics or the Meta pixel), yes: they must be off by default and turned on only with the visitor's consent.

Who is the person in charge of personal information?

By default, the person with the highest authority in the business. The role can be delegated in writing, and their contact details must be published on the site.

Planning a website?

Tell us about your business. Our team designs a free first concept, and you see a real direction before you commit.

Get a free concept

438-530-7818 · info@stellaireweb.com · Montréal, QC