Cookie banners became common on Quebec websites after Law 25’s 2023 changes, but many of them were copied from European templates without much thought about what Quebec law actually requires. Two sections matter most: section 8.1, on technologies that identify, locate or profile people, and section 9.1, on privacy by default. They are related, but they are not the same rule.
Section 8.1: tell people first, and let them switch it on
When a business collects personal information from someone using a technology that includes functions allowing the person to be identified, located or profiled, it must inform the person beforehand of the use of that technology and of the means available to activate those functions (s. 8.1).
The act defines profiling as collecting and using personal information to assess certain characteristics of a person, in particular for analyzing work performance, economic situation, health, personal preferences, interests or behaviour (art. 8.1). Advertising pixels, cross-site tracking and many analytics configurations that build behavioural profiles fall within that description.
The CAI’s consent guidelines go a step further. In Lignes directrices 2023-1, adopted on 2023-10-31, the CAI states that identification, location and profiling functions should be deactivated by default, with the person taking a positive action to turn them on (CAI consent guidelines). The same guidelines say giving consent should be as easy as not giving it.
Section 9.1: privacy by default, with a cookie exception
Section 9.1 requires a business that collects personal information while offering a technological product or service to the public with privacy settings to ensure that, by default, those settings provide the highest level of confidentiality, without any intervention by the person (s. 9.1). This applies, for example, to apps and online accounts with privacy settings.
The second paragraph of section 9.1 states that it does not apply to privacy settings of a cookie (art. 9.1, second paragraph). That exclusion is often overlooked, and sometimes overstated. It means section 9.1 itself does not dictate cookie defaults. It does not mean cookies are unregulated: tracking and profiling cookies remain subject to section 8.1, to the general consent rules, and to the CAI’s guidance that profiling functions be off by default.
What this looks like on a real website
Sort your cookies and tags
List every cookie, pixel, SDK and script on your site and app. Group them by function: strictly necessary (session, security, load balancing), preferences, analytics, and advertising or profiling. Ask your web team or agency for this inventory; it is often longer than expected.
Keep profiling off until the visitor opts in
Advertising and behavioural tracking tags should not fire until the visitor makes a clear, positive choice. Consider configuring analytics in a way that avoids profiling, and document why you consider that configuration not to profile.
Make the choice fair
Offer “accept” and “refuse” with equal prominence. Avoid pre-ticked boxes and avoid making refusal take more clicks than acceptance, in line with the CAI’s guidance.
Inform before collection
The banner or first layer should say, in plain language, that the site uses technologies that can identify or profile visitors, what for, and how to activate them. Link to your privacy policy for detail.
Respect the setting in your apps
For mobile apps and online accounts, privacy settings must default to the most protective option under section 9.1. Location sharing, public profiles and data-sharing toggles should start off.
Test it
Load the site in a fresh browser, refuse everything, and check with developer tools that advertising tags are not firing. Repeat after each site update or new marketing campaign.
Where businesses go wrong
- A banner that only says “This site uses cookies” with a single “OK” button.
- Tags that load before the banner appears.
- Marketing teams adding new pixels through a tag manager without a privacy review.
- Copying an EU banner but never translating it or adapting it to Quebec requirements.
Why it matters
Cookie practices are visible to anyone, including regulators, competitors and consumer groups. Contraventions of the act can lead to administrative monetary penalties of up to $10 million or 2% of worldwide turnover (CAI). A clear, well-tested consent setup is one of the most visible signs that a privacy program is real.
KW Consulting can review your website’s tags and consent setup, and Accel GRC helps document the decisions. See our Law 25 and GDPR pages, our security review and remediation services, or contact us.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult