Law 25 and your website: what your business must display

According to the Commission d’accès à l’information (new tab), publishing a privacy policy is mandatory if you collect personal information using any technology. A contact form, a newsletter, an analytics tool or a chat window is enough. The policy must be written in clear and simple terms and published on the website, or made available by another means that lets people read it.

The Commission lists what it must cover: the information collected by that means and why, the third parties it could be disclosed to and in what contexts, the protection measures, the use of cookies, people’s rights and remedies, and any changes made to the policy. Its guide to writing a privacy policy (new tab) (in French) adds good practices: state the company’s name, the effective date and the date of the last update, name the providers that collect information for you, specify the categories of people who can access it and the ways to refuse certain collections. It also reminds businesses that a privacy policy should not be merged with the website’s terms of use.

Put the link in the footer of every page and next to every form. Write it for your visitors, not for a court: short sentences, subheadings, examples taken from your own site. Above all, describe what you actually do. A policy copied from another website often promises things your business doesn’t do, or says nothing about the analytics tool you installed.

The person with the highest authority (new tab) in the business is by default responsible for protecting personal information, and this role can be delegated in writing. Either way, the title and contact details of the person in charge must be published on the website. A role and a dedicated address, for example privacy@yourcompany.ca, hold up better over staff changes than a name and a personal inbox.

Businesses must also make their governance policies and practices known on their website, in detail and in clear and simple terms: retention and destruction rules, staff roles, complaint handling. Many businesses group this information in a section of the privacy page. What matters is that a visitor can find, in two clicks, whom to write to and how their request will be handled.

Finally, explain how people can exercise their rights: ask to access their information or have it corrected, withdraw consent, file a complaint. The person in charge must respond to access and correction requests within 30 days. A published address and a short procedure keep requests from getting lost in a general inbox.

Every form is a collection. The Commission reminds businesses that they must collect only the information necessary for the objectives set before the collection, and that when in doubt, information is considered unnecessary. For a first contact, a name, a way to reach the person and a description of the need are often enough. A date of birth, a full address or a detailed budget can wait for the next exchange, if you really need them.

At the time of collection, inform people of the purposes, the means used, their rights of access and correction and their right to withdraw consent. Where applicable, also mention the third parties the information will be disclosed to and the possibility that it will be disclosed outside Quebec. A sentence under the send button, with a link to the policy, often does the job: “We use this information to answer your request. It is sent to our email inbox hosted by [provider]. See our privacy policy.”

Know where each submission ends up: an email inbox, a customer management tool, a form plugin that keeps a copy in the site’s database. The guide on business website hosting explains how to protect that data and its backups. If a form also offers the newsletter, use a separate, unchecked box: consent must be requested for each purpose and separately from any other information.

Law 25 governs technologies that can identify, locate or profile a person, profiling being defined as collecting and using information to assess certain characteristics of a person, in particular their preferences, interests or behaviour. You must inform visitors, from the start, that these technologies are used and how to activate those functions. They cannot be turned on by default: the person must do it themselves, voluntarily.

Start by taking stock of what your website actually loads: audience measurement, advertising pixels, embedded maps or videos, chat, third-party fonts and scripts. Open your site in a private browsing window, or ask your provider for the list of cookies set before the visitor does anything. For each tool, note what it is for and whether it can identify, locate or profile.

A cookie banner is only a means. It is useful if it actually blocks non-essential cookies and scripts until the visitor activates them, if refusing is as easy as accepting and if visitors can change their mind later. The Commission’s privacy policy guide itself gives, as an example of a choice, the option of refusing cookies and using the website without certain features. A banner that informs without blocking anything does not meet the obligation.

Cookies that are strictly necessary for the site to work, such as those that keep a cart or a session, raise fewer questions; still describe them in the policy. For audience measurement, prefer a minimal setup. The guide on digital marketing for businesses offers a simple way to track where your inquiries come from without relying on intrusive tools.

A newsletter combines two regimes. Law 25 governs collecting the email address and using it. Canada’s Anti-Spam Legislation (new tab), a separate federal law, governs sending commercial messages: you need express or implied consent, sender identification and contact information in every message, and an unsubscribe mechanism processed within 10 business days or less. You must be able to prove consent on request, so keep the date, page and wording of each sign-up.

Many common tools (newsletter platforms, online forms, chat, booking) host data outside Quebec. Before entrusting personal information to a provider located elsewhere, including in another province, the law requires a privacy impact assessment (new tab) and a written agreement, and the disclosure is only allowed if the information will receive adequate protection. Mention this possibility in the information given at collection, too. The complete guide to Law 25 details the questions to ask these providers.

A redesign is the right time to settle all of this at once: tool choices, forms, banner and policy. The guide to preparing a website redesign helps you take stock of existing pages and connections before rebuilding, and the complete guide to business websites places these obligations among the site’s other projects.

This list covers the essentials. Do it with the person who manages the site, and note what needs fixing.

Repeat this check after adding any tool or form, and at least once a year. If your site isn’t compliant, start with the person in charge, the policy and cookies active by default: they are the most visible points for your visitors.