Quebec Law 25 and website tracking: cookies, pixels, consent

Quebec Law 25 requires websites to keep tracking that can identify, locate or profile a visitor switched off until the visitor actively turns it on, and to explain the technology in plain language before it is used. For most sites this means advertising pixels, remarketing and similar profiling tags should not fire for Quebec visitors before consent.

Law 25 is the common name of the Act to modernize legislative provisions as regards the protection of personal information, formerly Bill 64. It amended the Act respecting the protection of personal information in the private sector, and the Commission d'accès à l'information du Québec (CAI) enforces it. This guide covers what it means for cookies, pixels and Google Tag Manager. This article is not legal advice.

What changed for website tracking under Quebec Law 25?

Quebec Law 25 changed website tracking through four rules in the private sector act. Section 8.1 deals with technology that can identify, locate or profile a person. Section 8.2 requires a privacy policy on the website. Section 14 sets the conditions for valid consent. Section 17 adds an assessment before personal information leaves Quebec. Together they cover almost every tag a marketing team adds to a site.

Section 8.1: profiling functions must be off by default

Section 8.1 applies when a business collects personal information using technology that includes functions allowing the person to be identified, located or profiled. The business must inform the person beforehand of the use of that technology and of the means to activate those functions. The CAI and most commentators read this as: such functions are deactivated by default and the visitor switches them on.

Profiling in the law means collecting and using personal information to evaluate characteristics of a person, such as interests, preferences, behavior, economic situation or health. Retargeting pixels from Meta, TikTok or LinkedIn, Google Ads remarketing audiences and cross-site advertising IDs fall into this category. A cookie that only keeps a shopping cart, or measures page views without building a profile, is a different case.

→ Cookie banner with Consent Mode v2: compliant, with no monthly license

Section 9.1 and the cookie exception

Section 9.1 requires that a technological product or service offered to the public uses the highest level of confidentiality by default, without any action by the user. Its second paragraph excludes the privacy settings of cookies, which confuses many site owners. The exception does not make cookies free of rules: section 8.1 still applies to profiling and identification functions, and consent rules still apply to secondary uses.

Privacy policy and consent for Quebec visitors

The privacy policy required by section 8.2 must be written in clear and simple terms and published on the website. For tracking, it should name the tools you use, what each one collects, why, whether data leaves Quebec, and how visitors can change their choice. Keep it in line with what actually runs on the site, and update it when you add a new pixel.

Consent under section 14 must be manifest, free, informed and given for specific purposes, and it must be requested separately for each purpose in clear terms. In practice this means one banner choice per category, such as analytics and advertising, no pre-ticked boxes and an option to refuse that is as easy as accepting. The CAI's guidelines on valid consent give detailed examples.

• Advertising and retargeting tags: off until the visitor turns them on
• Analytics: informed in the banner and policy, advertising features off by default
• Banner: separate choices per purpose, refusing as easy as accepting
• Privacy policy: tools, purposes, transfers outside Quebec, how to change the choice
• Records: keep proof of what each visitor chose and when

→ Setting up Google Consent Mode v2 correctly: no warning in Tag Assistant

Section 17: tracking tools that process data outside Quebec

Section 17 requires a privacy impact assessment before a business communicates personal information outside Quebec, and that includes service providers that process data for it. Most analytics and advertising platforms process data on servers in other provinces or countries, so the assessment usually concerns every major tag on the site. It weighs the sensitivity of the information, the purpose, the protection measures, including contract terms, and the legal framework of the place where the data goes.

The assessment does not have to be long for a typical marketing site, but it should exist in writing. A practical starting point is a tag inventory: each tool, the data it receives, where it is processed, the contract or terms that apply, and whether it can run with reduced data. The result often leads to simple changes, such as turning off data sharing settings in Google Analytics 4 or removing a pixel nobody uses anymore.

How to set up Google Tag Manager for Quebec Law 25

Google Tag Manager can apply Quebec rules with Google Consent Mode and a region-specific default. Set a consent default for the region CA-QC where ad_storage, ad_user_data and ad_personalization start as denied, and analytics_storage according to your analysis of section 8.1. When the visitor turns on advertising in the banner, a consent update grants those values and the tags start. Tags from Meta, TikTok or LinkedIn need triggers that check the same consent state.

A typical case: a Montreal furniture shop ran its Meta Pixel from a theme setting, outside Google Tag Manager. The banner looked correct, but the pixel loaded before any choice. Moving the pixel into Google Tag Manager with a consent trigger, and turning off the theme setting, solved it. Test the result in Google Tag Manager preview mode and in the browser network tab, once with the banner refused and once accepted.

Check what your site loads before consent

The free Trackum check at trackum.app/check shows quickly whether profiling tags load too early. It opens your homepage three times in a real browser, with the banner unanswered, refused and accepted, plus two subpages, and lists the tags and cookies in each state. No sign-up, about two minutes. If you want it fixed, Trackum sets up Google Tag Manager, GA4 and Consent Mode v2 at a fixed €150 one-time, tested with and without consent. Prices plus VAT.