Law 25 affects your website concretely through five technical elements. Consent before information is collected, actual blocking of cookies until consent is given, a working mechanism for access and opt-out requests, minimization of what is actually collected, and a privacy policy that reflects the site's true practices rather than text copied from elsewhere. This guide covers the technical aspect. The precise obligations that apply to your business are a matter for your legal advisor.
The most common misunderstanding
Many companies believe they have solved the issue by adding a banner that displays a message about cookies. The problem is that the banner and the actual behaviour of the site are two different things. You can display a perfect message and let the measurement tools trigger exactly as before, before the visitor has even clicked on anything. It's more common than you think, and it can be verified in just a few minutes.
What is actually regulated on your site
Consent before collection. The visitor must be able to choose before the measurement or advertising tools begin to collect information.
Effective blocking. It's not just showing a choice, it's technically preventing scripts from firing until the choice has been made.
The distinct categories. A visitor should be able to accept the measure without necessarily accepting advertising, for example, rather than a single all or nothing button.
Traceability of consent. Keep track of what was chosen, with the date, in case it needs to be demonstrated later.
The access request and withdrawal mechanism. A clear way for someone to ask what you have on them, or to request that it be removed.
Minimizing collection. Do not ask for more information than is actually necessary in your forms.
The privacy policy aligned with reality. The published text should reflect what the site actually does, not some generic template found online.
| Angle | Dimension to examine | Use in the decision |
|---|---|---|
| 01 | The most common misunderstanding | Setting the Context |
| 02 | What is actually regulated on your site | Identify dependencies |
| 03 | The test that takes three minutes | Compare options |
| 04 | Measurement and consent can coexist | Preparing for the next step |
The test that takes three minutes
Here is a simple exercise that anyone can do. Open your site in a browser, use the inspection tools embedded in the browser, refuse everything in your banner, and then look at what continues to load. In a surprisingly high proportion of the sites I examine, something continues to start despite the refusal. This is exactly the gap that this guide helps you understand and correct.
Set your decision
Select the dimensions that describe your situation. The result is to organize the next conversation, not to replace an analysis.
Choose the dimensions that apply to show the recommended level of attention.
Measurement and consent can coexist
A common fear. If we really ask for consent, we'll lose all our measurement data and we won't know anything about our visitors. In fact, a well thought-out configuration retains a largely sufficient decision-making capacity. Visitors who accept are measured normally. Techniques exist to reasonably estimate the rest without violating the choices expressed. You lose perfect individual precision, you retain the ability to arbitrate your marketing decisions.
What is up to your advisor, and what is up to technical implementation
Your legal advisor determines which specific obligations apply to your business, how to interpret the requirements in your particular context, and what risks are acceptable to you. The technical implementation takes care of making these requirements real in the operation of your site, through the consent mechanism, the effective blocking of cookies, application forms, and the configuration of your measurement tools.
A company that entrusts legal interpretation to its technical provider takes an unnecessary risk. A company with well-identified legal requirements but never technically executed takes an equally real risk.
What I see on the ground
The most common scenario. A banner was installed quickly, often by an external provider or an automatic extension, without anyone then checking whether it really worked. Management believes the matter has been resolved. Nobody has tested.
The three-minute test mentioned above resolves this uncertainty immediately. Either everything works as expected, and so much the better. Or a discrepancy appears, and we know exactly what to correct.
When this guide does not apply
If your site does not collect any personal information, form, measurement tool, advertising tool, the issues in this guide apply much less directly to you. This is rare in practice, but it happens for very simple and purely informative sites.
GXN offers technical implementation and operational support. Legal interpretation must come from qualified legal counsel.
Frequently asked questions
01Is our current cookie banner enough for Quebec Law 25?
It's objectively tested in a few minutes, as described above. The result often surprises, one way or the other.
02Can Google Analytics be configured for Quebec Law 25 compliance?
The question relates more to the configuration and your management of consent than to the tool itself. We take care of the technical aspect, the exact interpretation falling to your advisor.
03What should we do if a customer requests access to their information?
Technically, it is necessary to be able to retrieve the information held about this person and to communicate or withdraw it as requested. The exact organizational process to follow is defined with your legal advisor.
04Do we need to completely rewrite our privacy policy?
If it does not accurately describe what your site actually does, yes. We document the actual technical practices, the drafting of the legal text under your advisor.
In-depth guide prepared by GXN based on real business situations. Recommendations remain independent of brands and providers.
References to verify for your situation
These references support the external rules and frameworks cited in this guide. They do not replace legal or professional advice tailored to your organization.