Quebec Law 25

Overview

Quebec Law 25 is the most GDPR-like privacy law in the Americas, requiring explicit granular consent per purpose before deploying any tracking technology. Implied consent is explicitly prohibited for cookies and tracking — a significantly stricter standard than PIPEDA or any US state law.

What This Means for Your Website

• Explicit consent per purpose is required before deploying ANY tracking technology — including cookies, pixels, and analytics
• Implied consent is explicitly NOT acceptable for cookies or tracking
• Penalties match GDPR levels: up to CAD $25 million or 4% of worldwide turnover
• Privacy impact assessments are mandatory for high-risk processing
• Breach notification to CAI is required within 72 hours
• Extraterritorial scope applies to organizations outside Quebec targeting Quebec residents

Key Requirements

The CAI enforces Law 25 with penalties up to CAD $25 million or 4% of worldwide turnover — the highest in North America. Consumer requests must be fulfilled within 30 days. The explicit prohibition on implied consent for tracking makes Quebec's requirements closer to GDPR than any other North American jurisdiction. A mandatory privacy officer designation is required.

How ConsentStack Handles This

ConsentStack detects Quebec visitors and applies explicit opt-in consent per purpose category before deploying any tracking technology — matching Quebec's GDPR-like requirements with no reliance on implied consent.