What does Quebec's Law 25 require on a website?

Who it applies to, which is more businesses than expected

The law applies to any business operating in Quebec, whatever its size. It also very likely reaches businesses based elsewhere that actively serve Quebec customers, although the law does not spell out its reach and the question has not been settled. A Toronto roofer with regular jobs in Gatineau, or an Ontario retailer that ships to Montréal, should plan on being inside it.

There is no small-business exemption and no employee threshold. That is the single most common misreading, because Ontario's accessibility rules do carry one.

The three things a visitor can actually see

A privacy policy, published on the site, written in clear and simple language rather than the copied template most sites carry. It has to say what is collected, why, who it is shared with, and whether anything leaves the province. The site also has to publish detailed information about how the business governs personal information, including how long it is kept, how it is destroyed, and how complaints are handled.

A person in charge of the protection of personal information, whose title and contact details are published on the site. By default this is the person with the highest authority in the business, and the role can be delegated in writing. The law asks for the title rather than the name, though naming the person is allowed.

Tracking technology off by default. Section 8.1 requires telling the visitor about any technology that can identify, locate, or profile them, and how to switch those functions on. The Commission d'accès à l'information reads that as off by default, switched on only by a positive act from the visitor.

How it differs from PIPEDA and from Loi 96

PIPEDA is the federal privacy law and works on meaningful consent, which in practice has allowed implied consent for ordinary analytics. It has no default-off rule, and the federal Privacy Commissioner still cannot fine a business or issue binding orders. Quebec's Commission can impose administrative penalties of up to $10 million or 2 percent of worldwide turnover, whichever is greater, and court fines run higher.

Loi 96 is a language law. It governs whether the site exists in French on terms at least as favourable as the English one and says nothing about data. The two get conflated because both arrived around the same time and both are enforced from Quebec, but a site can satisfy one and fail the other.

What it changes about the contact form and analytics

Collect only the fields that are genuinely needed to answer the enquiry, and say at the point of collection what the information will be used for. A phone number field marked required on a form that only ever gets answered by email is now a compliance question as well as a conversion one.

Consent to be contacted about the enquiry is not consent to be added to a mailing list. Law 25 asks for consent to each purpose separately, and marketing never counts as a purpose consistent with the original one. For the email list itself, CASL has ruled out pre-ticked boxes since 2014.