What does Quebec's Law 25 require on a website?

Who it applies to, which is more businesses than expected

Law 25 follows the person, not the office. Any enterprise that collects personal information about someone in Quebec is covered, regardless of where the business is registered or how many people it employs. A Toronto roofer taking quote requests from Gatineau, or an Ontario retailer shipping to Montréal, is inside the law.

There is no small-business exemption and no employee threshold. That is the single most common misreading, because both PIPEDA guidance and Ontario's accessibility rules do carry thresholds.

The three things a visitor can actually see

A privacy policy, published on the site, written in clear and simple language rather than the copied template most sites carry. It has to say what is collected, why, who it is shared with, and whether anything leaves the province.

A person responsible for the protection of personal information, named on the site with a way to reach them. By default this is the person with the highest authority in the business, and the role can be delegated in writing, but the name and title have to be public.

Tracking technology off by default. Section 8.1 requires that any function that identifies, locates, or profiles a person be deactivated until the visitor is told about it and turns it on.

How it differs from PIPEDA and from Loi 96

PIPEDA is the federal privacy law and works on meaningful consent, which in practice has allowed implied consent for ordinary analytics. It has no default-off rule and, until recently, very little enforcement teeth.

Loi 96 is a language law. It governs whether the French version is displayed as prominently as the English one and says nothing about data. The two get conflated because both arrived around the same time and both are enforced from Quebec, but a site can satisfy one and fail the other.

What it changes about the contact form and analytics

Collect only the fields that are genuinely needed to answer the enquiry, and say at the point of collection what the information will be used for. A phone number field marked required on a form that only ever gets answered by email is now a compliance question as well as a conversion one.

Consent boxes cannot be pre-ticked, and consent to be contacted about the enquiry is not consent to be added to a mailing list. Those are separate purposes and need separate agreement, which is also what CASL has required since 2014.