Quebec Makes Tracking Opt-in

What Changed

Quebec's Law 25 overhauled the province's private-sector privacy law in stages, and its main provisions, including new enforcement powers, took effect on September 22, 2023.¹

The section that matters most for marketing is section 8.1. A business that collects personal information using technology able to identify, locate or profile a person has to tell them beforehand and explain how to activate those functions. Law firm McCarthy Tétrault notes that an earlier draft said "deactivate", and reads the change as meaning the technology must be off by default. It concludes that non-essential cookies, such as advertising and analytics cookies, should stay off until a visitor turns them on.²

The law isn't entirely clear. Another section requires privacy settings to default to the highest level of confidentiality but expressly excludes browser cookies, and the firm calls the provisions new and untested.² Quebec's privacy regulator, the Commission d'accès à l'information (CAI), settled the question for its own enforcement in consent guidelines published in October 2023. They say these functions must be deactivated by default, and that a person has to take a positive action to turn them on. One of the CAI's examples is a magazine that uses cookies to infer readers' interests: it has to explain this on the first visit and tell readers how to activate those cookies.³

The Canadian Marketing Association notes that the guidelines also require consent to be requested separately for each purpose, so it can't be bundled into a privacy policy.⁴

Penalties

Law 25 lets the CAI impose administrative penalties of up to $10 million or 2% of worldwide turnover, whichever is greater. Penal fines reach $25 million or 4%, and double for a repeat offence. People can also claim punitive damages of at least $1,000 when an intentional or grossly negligent breach harms them.¹

Why It Mattered

Law 25 brought European-style consent to part of the Canadian market. For marketers, that means a cookie banner with a real opt-in for Quebec visitors, and the same kind of measurement gap that GDPR created in Europe: people who don't opt in drop out of tracked conversions.

Federal reform has moved more slowly. Bill C-27, which would have replaced the federal private-sector privacy law, didn't pass. In June 2026 the government introduced Bill C-36, its third attempt since 2020, with penalties of up to $25 million or 5% of gross global revenue for some offences. It isn't yet law.⁵