What does Quebec's Law 25 say that touches digital advertising?
Part of US and Canada targeting
The short answer
Law 25 changed how organizations collect and use personal information in Quebec. Since September 2023, technology that can identify, locate or profile a person must be disclosed beforehand and left off until the person activates it, consent must be given for each specific purpose, and personal information sent outside Quebec first needs a privacy impact assessment.
Key takeaways
- Law 25 amended Quebec's private sector privacy act in stages, on September 22 of 2022, 2023 and 2024, and the rules on identification, location and profiling technology have applied since September 22, 2023.
- The Commission d'accès à l'information (CAI) defines profiling broadly, including the evaluation of a person's personal preferences, interests or behavior.
- The CAI's consent guidelines list eight validity criteria and say it must be as easy to refuse consent as to give it.
- The default privacy settings rule in section 9.1 expressly does not apply to the privacy settings of a cookie, while the profiling technology rule in section 8.1 has no such carve out.
What is Law 25, and when did each part take effect?
Law 25 is the name Quebec uses for the 2021 statute that modernized its privacy laws. The CAI's overview of the main changes (opens in a new tab) says that Law 25, adopted in 2021, brought significant changes to the laws on the protection of personal information. For businesses, the law it changed is the Act respecting the protection of personal information in the private sector, chapter P-39.1, referred to here as the private sector act.
The changes arrived in stages. The CAI's administrative version of the private sector act, a reference copy it says has no official value, marks each new section with its date in force. Every date below has passed.
| Date in force | What changed | Sections of the private sector act |
|---|---|---|
| September 22, 2022 | The person with the highest authority in a business is responsible for protecting personal information; confidentiality incidents must be handled, recorded and, where there is a risk of serious injury, reported to the CAI | 3.1, 3.5 and following |
| September 22, 2023 | Consent rules, notice before using identification, location or profiling technology, privacy by default, a privacy impact assessment before sending data outside Quebec, commercial prospecting rules and administrative monetary penalties | 8.1, 8.2, 9.1, 14, 17, 22, 90.12 |
| September 22, 2024 | On request, a business must give a person the computerized personal information collected from them in a structured, commonly used technological format | Portability right |
Which Law 25 rules come up in programmatic and social advertising?
Law 25 sets duties for how an organization runs its privacy program, and some provisions bear directly on the tools of digital advertising: tags and pixels, audience segments, location data and the vendors that receive data. The table pairs each rule with the CAI's description, translated from French, and a question the plan's records can answer for review.
| Provision | What the CAI or the Act says | Question for the plan's records |
|---|---|---|
| Section 8.1, identification, location or profiling technology | An organization collecting personal information with technology that can identify, locate or profile the person must inform them beforehand of its use and of the means to activate those functions; the CAI says these technologies cannot be activated by default | Do the tags, pixels or software development kits on our site or app have such functions, and are they off until the person turns them on? |
| Section 9.1, privacy by default | Privacy settings of a technological product or service offered to the public must provide the highest level of confidentiality by default, without any intervention by the person; this does not apply to the privacy settings of a cookie | Which of our products offer privacy settings, and are any of them outside the cookie exception? |
| Section 14, valid consent | Consent must be manifest, free, enlightened and given for specific purposes, requested for each purpose in clear and simple terms, and presented separately when requested in writing | Is advertising use requested as its own purpose, apart from other uses? |
| Section 17, communication outside Quebec | Before communicating personal information outside Quebec, a business must conduct a privacy impact assessment; the communication may proceed if the information would receive adequate protection, under a written agreement | Does any campaign data leave Quebec, for example to an ad platform or measurement vendor based elsewhere? |
| Section 22, commercial prospecting | A business using personal information for commercial or philanthropic prospecting must identify itself to the person it addresses and inform them of their right to withdraw consent to that use | Do customer list uploads or email based audiences count as prospecting in our case? |
How does the CAI define profiling, and where do cookies fit?
Profiling is the Law 25 term that bears on interest based advertising. The private sector act defines it in section 8.1, and the CAI repeats the definition on its overview page.
La Loi définit le profilage comme la collecte et l’utilisation de renseignements personnels dans le but d’évaluer certaines caractéristiques d’une personne physique, notamment à des fins d’analyse du rendement au travail, de la situation économique, de la santé, des préférences personnelles, des intérêts ou du comportement de cette personne.
In English: the Act defines profiling as the collection and use of personal information to evaluate certain characteristics of a natural person, in particular for the purpose of analyzing work performance, economic situation, health, personal preferences, interests or behavior.
The CAI's consent guidelines 2023-1 (opens in a new tab), version 1.0 of October 31, 2023, include a private sector example built on cookies. A magazine website recommends articles from readers' interests, inferred by an algorithm from pages viewed, clicks, browser language and time on page, all collected with cookies. Because this technology allows profiling, the magazine shows a pop-up window on the first visit with the information the law requires, then explains how to activate the cookies.
The cookie carve out sits only in section 9.1, the privacy by default rule. The separate notice and activation rule for profiling technology in section 8.1 contains no cookie exception.
What makes consent valid under the CAI's guidelines?
Section 14 of the private sector act sets the consent standard, and the CAI's guidelines break it into eight criteria. The CAI says the first four are fundamental and the last four ensure their full validity, and that if any one criterion is not met, consent is invalid and without effect.
| Criterion | English | What the CAI says it means |
|---|---|---|
| Manifeste | Manifest | Obvious and given in a way that shows the person's real will; it can be express or, in some circumstances, implicit |
| Libre | Free | Real choice and control, given without constraint or pressure |
| Éclairé | Enlightened | The person understands what they agree to |
| Spécifique | Specific | Given for specific purposes, requested for each one |
| Granulaire | Granular | The person can show agreement or disagreement purpose by purpose |
| Compréhensible | Understandable | Requested in clear and simple terms |
| Temporaire | Temporary | Valid only for the time needed to achieve the purposes |
| Distinct | Separate | A written request is presented apart from any other information |
The guidelines use the industry's own vocabulary. Express consent is an active, positive gesture, which the CAI notes is also called opt in. Implicit consent is inferred from another action, silence or inactivity, also called opt out, and the person should have a valid opportunity to refuse. In case of doubt, the CAI says express consent should be obtained.
Who enforces Law 25, and what penalties can apply?
The CAI supervises the private sector act. Its overview lists new powers that include imposing administrative monetary penalties on businesses and bringing penal proceedings for offenses under the act. It also notes that a business can give the CAI an undertaking to remedy a failure, which, if approved and respected, rules out a monetary penalty for the acts the CAI found.
| Measure | Natural person | Other cases, such as a business |
|---|---|---|
| Administrative monetary penalty, section 90.12 | Up to $50,000 | Up to $10,000,000 or 2 percent of worldwide turnover for the preceding fiscal year, whichever is greater |
| Penal fine, section 91 | $5,000 to $100,000 | $15,000 to $25,000,000 or 4 percent of worldwide turnover for the preceding fiscal year, whichever is greater |
What should a media team write down before a Quebec campaign's legal review?
Law 25 questions are easier to answer when the plan already shows where personal information enters the campaign. A site list chosen by page content is a list of publishers and articles; the tags, audiences and reporting around it are where personal information can appear. The checklist records facts for review and decides nothing.
Facts to record for each Quebec campaign before legal review
- Every tag, pixel or software development kit on the advertiser's site or app, with what it collects and whether it can identify, locate or profile a person.
- Whether the targeting uses audience segments, customer lists, retargeting or precise location, or only page and site content.
- Each vendor or platform that receives campaign data, and the country where it processes that data.
- The consent wording shown to Quebec visitors, and whether advertising is requested as its own purpose.
- Whether the audience includes people under 14, since the CAI says their information cannot be collected from them without a parent's or tutor's consent unless the collection is clearly for their benefit.
Fictional example
A Massachusetts course provider plans its first Quebec campaign
Tessaline Learning, a fictional online continuing education provider based in Boston, wants French display ads in Quebec beside articles on careers, management and professional training. The planner builds the site list from page content, choosing French publishers whose recent articles match, with no personal information used to pick sites.
The client also proposes a retargeting pixel on its course catalog and an upload of past student emails to an ad platform based outside Quebec. The planner records both, with the platform's processing country, as data flows for review under sections 8.1, 14 and 17, and sends the file to the client's counsel before any tag goes live.
What personal information does PlacementGraph use to build a Quebec site list?
PlacementGraph plans by page content and public site data.
Frequently asked questions
Does Law 25 require a cookie banner?
The Act does not use the word banner. Section 8.1 requires informing people beforehand about technology that can identify, locate or profile them and about how to activate those functions. In the CAI's own magazine example, that information appears in a pop-up window on the first visit, followed by instructions to activate the cookies.
Who must be named as the person in charge of personal information?
The CAI says the person with the highest authority in the business holds the role of person in charge of the protection of personal information and may delegate it in writing, in whole or in part. The title and contact details must be published on the business's website, or made available by other appropriate means.
When is a privacy impact assessment required under Law 25?
The CAI lists two cases among others: any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information, and before communicating personal information outside Quebec. It says the assessment must be proportionate to the sensitivity, purpose, quantity, distribution and medium of the information.
Does Law 25 treat inferred interests as personal information?
The CAI states that it considers information generated by artificial intelligence systems, and inferred information, to be personal information subject to the applicable laws. Interest categories inferred from browsing therefore fall within the CAI's stated view. The CAI's test is whether the information allows a person to be identified, directly or indirectly.
Sources
- Principaux changements apportés par la Loi 25 (opens in a new tab)Commission d'accès à l'information du Québec
- Lignes directrices 2023-1, Consentement : critères de validité (version 1.0, October 31, 2023) (opens in a new tab)Commission d'accès à l'information du Québec
- Loi sur la protection des renseignements personnels dans le secteur privé, administrative version (opens in a new tab)Commission d'accès à l'information du Québec
- Qu'est-ce qu'un renseignement personnel? (opens in a new tab)Commission d'accès à l'information du Québec
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.