Consentl

Cookie consent in Canada: PIPEDA and Quebec Law 25

How cookie consent works in Canada under PIPEDA and Quebec's Law 25, which requires tracking technology to be off by default, and how Consentl applies a Quebec rule.

The Personal Information Protection and Electronic Documents Act applies to private-sector organisations that collect personal information in the course of commercial activity in most of Canada. It requires meaningful consent: people must understand what is collected, why and with whom it is shared. The Office of the Privacy Commissioner's guidance allows implied consent for some non-sensitive uses, but expects express consent where the use would be unexpected or the information is sensitive, and treats online behavioural advertising with care: visitors must be told and able to opt out easily.

Quebec Law 25: tracking off by default

Quebec's Law 25 modernised the province's private-sector privacy act in stages from 2022 to 2024. Since September 2023, an organisation that uses technology able to identify, locate or profile a person must inform them and give them the means to activate those functions: they must be off by default. For websites this means analytics and advertising cookies that profile visitors work like opt-in. Penalties reach CAD 25 million or 4 % of worldwide turnover for offences, and the Commission d'accès à l'information can impose administrative penalties of up to CAD 10 million or 2 %.

How Consentl helps

  • A ready-made Quebec rule: opt-in, so profiling cookies stay off until the visitor turns them on.
  • A notice rule for the rest of Canada; on the Business plan you can switch it to opt-out or opt-in.
  • Banner texts in French and English, a choice per category and a "Cookie settings" link.
  • A consent log, a cookie scanner with a cookie declaration, and a request form with the 30-day PIPEDA deadline.

FAQ

Does Law 25 apply to a business outside Quebec?

It applies to businesses that collect personal information of people in Quebec in the course of carrying on an enterprise, including from outside the province.

PIPEDA does not name banners, but informing visitors and getting meaningful consent online is usually done with one. In Quebec, profiling technology must be off until the visitor activates it.

Start free Pricing

This page is general information, not legal advice. Laws and guidance change; check the current rules for your situation.

Features