Law 25 and Your Business Website: What Quebec Companies Need to Know

Quebec’s Law 25 (formerly Bill 64) modernizes private-sector privacy rules. If you operate a business website in Quebec with contact forms, analytics, cookies, or CRM integrations, you need more than a generic privacy policy pasted from a template.

Short answer: your website must clearly explain what personal data you collect, obtain meaningful consent for non-essential tracking, appoint a privacy lead, and document how data flows between your site, vendors, and internal tools.

01Who does Law 25 apply to?

Law 25 applies to organizations that collect, use, or communicate personal information about individuals in Quebec, including through a website, client portal, careers page, or marketing automation stack.

If your site collects names, emails, IP addresses, form submissions, or behavioral analytics tied to identifiable users, Law 25 likely applies to you.

02What must a business website include?

At minimum, a Law 25-aligned business website should have:

• A privacy policy in plain language (French required for Quebec audiences)
• Consent mechanisms before non-essential cookies or tracking (analytics, ads, pixels)
• Clear contact for privacy requests (access, correction, deletion)
• Documented data flows: what goes to Google Analytics, Meta, HubSpot, etc.
• Retention rules: how long you keep form submissions and applications

03Cookies, analytics, and marketing pixels

Law 25 expects consent before collecting personal information through non-essential tools. That includes:

• Google Analytics and similar analytics platforms
• Meta Pixel and advertising trackers
• Chat widgets that identify users
• Marketing automation that profiles visitors

Essential cookies (session, security, load balancing) are generally treated differently from analytics and advertising cookies. When in doubt, ask for consent first.

04Privacy policy: what "good" looks like

Your policy should name:

• What personal data you collect (contact forms, careers, server logs)
• Why you collect it (service delivery, analytics, recruitment)
• Who you share it with (hosting, email, CRM vendors)
• How long you retain it
• How individuals can exercise their rights

Generic copy that says "we don’t use tracking cookies" while running analytics or ad pixels creates legal and trust risk.

05Vendor accountability

Most business websites rely on third parties: hosting (Railway, AWS), email (SendGrid), CRM (HubSpot), analytics (GA4). Under Law 25, you remain accountable for personal information processed on your behalf.

Practical step: maintain a vendor register listing each tool, what data it receives, where data is stored, and whether a data processing agreement exists.

06How Nukleo helps Quebec businesses

Nukleo builds and integrates business websites and digital systems with privacy-by-design: consent banners, accurate privacy policies, data minimization, and integration maps that show where client data flows.

We don’t replace legal counsel, but we implement the technical and UX layer that makes compliance operational: cookie consent, policy pages, form data handling, and vendor integration documentation.

07Checklist: 10 actions this month

1. Audit every script and integration on your site
2. Update your privacy policy to match reality
3. Add consent before non-essential tracking
4. Name a person responsible for privacy (PRP)
5. Document retention periods for form data
6. Review careers page and contact form data handling
7. Sign DPAs with key vendors where required
8. Provide a clear privacy contact email
9. Train staff who handle personal information
10. Schedule an annual review. Laws and tools change.

Need help aligning your site with Law 25? Nukleo works with Quebec businesses on privacy-by-design web platforms and integrations. Contact us →