# Quebec Law 25 and Cookies: What Your Website Must Do

Source : https://cybercaribou.com/en/blog/quebec-law-25-cookies-consent-website · Cyber Caribou

> Quebec Law 25 cookie rules explained: what section 8.1 and the CAI require, which cookies must be off by default, and how to set up a fair consent banner.

Your website was rebuilt by an agency a few years ago. Since then, someone added an ad pixel for a campaign, then an analytics tag, an embedded map and a live chat widget. Nobody at the company can say for sure what now lands in a visitor's browser.

That is exactly what Quebec's Law 25 expects you to know. The rules are clearer than most people think, especially since the Commission d'accès à l'information (CAI), Québec's privacy regulator, published detailed guidance on cookie banners on October 22, 2026.

- The Act mentions cookies only once (s. 9.1), to carve them out of the privacy-by-default rule. Your actual obligations come from section 8.1.
- A cookie that can identify, locate or profile a visitor must stay off until the visitor, once informed, turns it on.
- Per the CAI: refusing must be as easy as accepting, nothing pre-ticked, and browsing is not consent.
- Start with a real inventory of your trackers, then test that nothing fires before the visitor chooses.

## What does Law 25 say about cookies?

Law 25 mentions cookies exactly once, and only to exclude them from one rule. Section 9.1 requires technology products and services offered to the public to provide the highest level of privacy by default, but its second paragraph states that this "does not apply to privacy settings for browser cookies."

That is not a blanket exemption. The rule that applies to your cookies is section 8.1 of the Act respecting the protection of personal information in the private sector. Anyone who collects personal information using technology that includes functions allowing a person to be identified, located or profiled must **first** inform that person:

1. of the use of such technology; and
2. of the means available to activate those functions.

The Act defines profiling as collecting and using personal information to assess certain characteristics of a person, including their preferences, interests or behaviour. That is precisely what a retargeting pixel does.

The CAI draws a clear conclusion on its guidance page for businesses: you cannot turn these functions on by default, and the person must be able to turn them on voluntarily.

## Which cookies must be off by default?

Any cookie or tracker used to identify, locate or profile a visitor must stay off until the visitor turns it on. The CAI notes that this obligation covers several online tracking technologies used by most websites, including certain cookies. The word "certain" matters: what triggers the rule is what the cookie does, not the fact that it is a cookie.

The CAI does not publish an official list of cookies by category. The table below is a cautious classification to review with your legal counsel:

| Cookie or tracker type | Examples | Cautious approach |
|---|---|---|
| Strictly necessary | Session, shopping cart, form security, remembering the cookie choice | On, described in the privacy policy |
| Functional, no tracking | Display language | Generally on, described in the policy |
| Audience measurement | Analytics tool that assigns a persistent identifier | Off by default |
| Advertising and retargeting | Ad pixels (Meta, Google Ads, LinkedIn) | Off by default |
| Embedded third-party content | Videos, maps or social buttons that set their own cookies | Off by default, or loaded on click |
| Session replay | Click and scroll recording, heatmaps | Off by default |

Example: a Plateau coffee roaster with an online shop discovers that the video on its home page sets third-party cookies the moment a visitor arrives. The fix is simple: a clickable preview image that loads the player only when clicked.

## How to set up a cookie banner, according to the CAI

According to the CAI, an acceptable banner offers a real choice, makes refusing as easy as accepting and turns nothing on without a clear action from the visitor. The guidance appears on the CAI's page on deceptive design ("interfaces truquées"), published October 22, 2026. The CAI notes that an international study it conducted in 2024 with other privacy authorities found deceptive design on 97% of websites, and that cookie banners are one of the places it shows up most.

What the CAI recommends:

- Offer the choice in the banner itself, rather than sending people to their browser settings.
- Make activation a clear affirmative act: continuing to browse is not acceptance.
- Make refusing as easy as accepting: an "Accept all" button is acceptable if the option to reject all non-essential cookies is presented the same way.
- Present options neutrally, with no false hierarchy of colour or size.
- Put granular choices on a second layer if you like, as long as the link to it is clearly visible.
- Never pre-select cookies.

The CAI's consent guidelines (October 2023) add a useful principle: the number of clicks to consent or refuse should be equivalent, including when someone withdraws consent later. Add a permanent "Cookie settings" link in your footer.

As for tools, the CAI asks organizations to make sure that tools acquired from third parties, including consent management platforms, are configured in line with the law. No tool is "compliant out of the box": your configuration either is, or it is not.

## How to inventory the trackers on your site

You cannot switch off a tracker you do not know exists, so the inventory comes first. For a small business site, an afternoon is usually enough.

- [ ] Open your site in a private window with your browser's developer tools (Storage and Network tabs).
- [ ] Before touching the banner, note every cookie set and every request sent to a third-party domain.
- [ ] For each cookie or script, record its name, provider, purpose, retention period and who installed it (you, the agency, a CMS plugin).
- [ ] Classify each one using the table above.
- [ ] Reject everything, reload the page and confirm that no advertising or analytics requests go out.
- [ ] Repeat the test after every redesign, new plugin or new campaign.

The rejection test is the most revealing: a banner can display "Reject" while a pixel hard-coded in the theme fires anyway.

There is a security bonus, too: every third-party script is one more vendor running code on your site. Fewer scripts, smaller attack surface.

## What your privacy policy must say about cookies

Your privacy policy must mention the use of cookies if your site uses them. The CAI lists this among the expected contents of the policy that section 8.2 (the Act calls it a "confidentiality policy") requires from any business collecting personal information through technological means.

A "Cookies and trackers" section should explain the categories of cookies, their purposes, the third parties that set them, the possibility that data is processed outside Québec, and how to change one's choices. The CAI's guide also suggests explaining what happens if someone refuses, such as using the site without certain features. Our article on the [Law 25 privacy policy](https://cybercaribou.com/en/blog/law-25-privacy-policy-template) includes a full outline.

## Common mistakes to fix first

- An information-only banner: "This site uses cookies. OK."
- Pixels hard-coded into the site, outside the consent manager.
- A choice that is not remembered, or cannot be changed afterwards.
- A privacy policy that says nothing about cookies, or describes the ones you used three years ago.
- A banner in English only, even though the website of a business in Québec must be available in French.

Failing to properly inform people when collecting their information is among the breaches that can lead to an administrative monetary penalty (s. 90.1): see our article on [Law 25 fines and penalties](https://cybercaribou.com/en/blog/quebec-law-25-fines-penalties).

This guide explains your obligations in plain language and is not legal advice: validate your banner and your policy with your legal counsel. For the rest of your obligations, see our [Law 25 cybersecurity checklist](https://cybercaribou.com/en/blog/quebec-law-25-cybersecurity-checklist). If you would like us to look at your site with you, [book a free consultation](https://cybercaribou.com/en/free-consultation) or explore our [Law 25 compliance support](https://cybercaribou.com/en/services/law-25-compliance).

## FAQ

**Do I need a cookie banner in Quebec?**
Law 25 never uses the word banner. But if your site uses cookies or trackers that can identify, locate or profile visitors, you must tell them beforehand and give them a way to turn those functions on (s. 8.1). According to the CAI, those functions must be off by default, and a consent banner is the simplest way to meet both requirements.

**Is Google Analytics allowed under Quebec Law 25?**
The Act does not ban any specific tool; it regulates what the tool does. If your analytics setup assigns a persistent identifier to visitors or is used to profile them, treat it as a non-essential cookie that stays off until the visitor turns it on. Because that data is often processed outside Québec, also ask your legal counsel whether a privacy impact assessment is required (s. 17).

**Do essential cookies need consent under Law 25?**
In guidance published in October 2026, the CAI calls for an option to reject all non-essential cookies, which implies that cookies strictly necessary for the site to work (session, shopping cart, security, remembering the visitor's choice) can stay on. They still need to be described in your privacy policy.

**Can my banner say that continuing to browse means accepting cookies?**
The CAI recommends the opposite: turning cookies on should be a clear affirmative act, and simply browsing the site should not be treated as acceptance. It adds that refusing should be as easy as accepting and that cookies should never be pre-selected.

## Sources

- [Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), ss. 8.1, 8.2 and 9.1](https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1)
- [CAI — Interfaces truquées et protection des renseignements personnels (deceptive design, French, October 2026)](https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/interfaces-truquees)
- [CAI — Collecting personal information: guidance for businesses (French)](https://www.cai.gouv.qc.ca/protection-renseignements-personnels/information-entreprises-privees/collecte-renseignements-personnels_entreprises)
- [CAI — Guidelines 2023-1: Consent, validity criteria (French, October 2023)](https://www.cai.gouv.qc.ca/uploads/pdfs/CAI_Criteres_Validite_Consentement.pdf)
- [CAI — Writing a privacy policy: explanatory guide for businesses (French, December 2023)](https://www.cai.gouv.qc.ca/uploads/pdfs/CAI_GU_POL_Confidentialite.pdf)
- [Éducaloi — FAQ on the Charter of the French language (French)](https://educaloi.qc.ca/publications/foire-aux-questions-sur-la-charte-de-la-langue-francaise-et-les-lois-linguistiques/)