Law 25, ad pixels and consent: what the rule actually says

The rule that governs an advertising pixel fits in one sentence, and Quebec's Commission d'accès à l'information is the one that writes it: a technology carrying functions that identify, locate or profile a person cannot have those functions active by default. A Meta pixel, a Google tag or a LinkedIn insight tag that fires on page load has made the choice on the visitor's behalf. This page gives you the rule in the regulator's own words, what it means for an industrial SME, and the questions to put to whoever installed your tags.

The setup is almost always the same. A manufacturer in the Beauce had its website rebuilt two years ago. The developer installed a pixel and an analytics tag, an agency added a LinkedIn tag six months later, and nobody ever explained to the owner what Quebec's private-sector privacy law asks of the business. He does not need to become a lawyer. He needs to know what to demand. The full advertising method sits on the Facebook and Meta advertising page.

What the Commission writes, word for word

On its page about collecting personal information, the Commission sets the obligation out in two steps. Inform first, do not activate second. Its text is in French, and here it is.

« vous devez informer les personnes, dès le départ : De l'utilisation d'une telle technologie; Des moyens offerts pour activer les fonctions »

Commission d'accès à l'information du Québec, Collecte de renseignements personnels

« vous ne pouvez pas activer ces fonctions par défaut. La personne concernée doit pouvoir le faire elle-même, volontairement. »

Commission d'accès à l'information du Québec, Collecte de renseignements personnels

In plain English: people must be told from the outset that such a technology is in use and how the functions can be turned on, and you cannot turn those functions on by default. The person has to be able to do it themselves, voluntarily. The same page adds a second obligation that is far easier to check: publishing a privacy policy is mandatory when you collect personal information through a technology.

Note what the Commission does not write. Its pages impose no particular banner design, no specific button and no named consent tool. The published obligations are these: inform from the outset, do not activate by default, publish a policy. A supplier who sells you one specific product on the grounds that the law requires it is going further than the regulator's text does.

A valid consent has eight qualities

The Commission lists eight qualities, and they are cumulative. Its French terms, with what each one means.

• Manifeste: obvious, and given in a way that shows the person's real intent.
• Libre: involving a real choice, given without constraint and without undue pressure.
• Éclairé: precise, given in full knowledge of the facts and with all the necessary information.
• Spécifique: given for a precise and clearly defined purpose.
• Temporaire: valid only for as long as is necessary to accomplish the purposes.
• Granulaire: asked for each specific purpose.
• Compréhensible: asked in simple, clear terms.
• Distinct: asked separately from any other information.

Three of the eight carry most of the weight where tags are concerned. Specific and granular both point at purposes, in the plural: audience measurement, advertising and sharing with third parties are not one purpose. Temporary is the reminder that an agreement obtained once is not a permanent asset. Those are three things to have explained to you in writing, not three boxes to tick.

Why this bites differently in industrial B2B

A manufacturer's website gets few visitors, and those visitors are worth a lot. A few hundred sessions a month, maybe ten real buyers in a year, a buying committee that comes back three or four times over six months. That is the exact inverse of an ecommerce site.

The asymmetry changes the arithmetic. A retargeting audience built from tags that fire before the visitor has chosen anything is, in this context, still a small audience. You take on a legal exposure for a few hundred people, a good share of whom are suppliers, students and your own staff. The upside is thin. The exposure does not scale down with your traffic.

What actually decides an industrial sale is elsewhere: visible proof on the site, real photographs of the plant, a named person to talk to. That is the subject of the industrial marketing page. On measurement itself, the question of what your tags actually report is handled in the conversion events an SME should send.

Three dates, and one accountability you cannot delegate

The Commission groups the changes brought by Law 25 by their date of entry into force. On 22 September 2022 came communicating personal information without the person's consent. On 22 September 2023 came the bulk of what this page is about. The consent obtained has to be manifest, free, informed and given for specific purposes. The rules aimed at organisations that collect information using a technology with functions that identify, locate or profile a person date from the same day. So do incident notification to the Commission and to the people concerned, publishing the privacy officer's title and contact details on the website, and the privacy policy. On 22 September 2024 came data portability.

The most useful line for a business owner sits on another Commission page, the one about the person responsible for protecting personal information.

« La personne ayant la plus haute autorité dans l'entreprise, par exemple son dirigeant, est par défaut responsable de la protection des renseignements personnels. »

Commission d'accès à l'information du Québec, Responsable de la protection des renseignements personnels

The person with the highest authority in the business, its head for example, is by default the one responsible. Accountability does not follow the installation invoice. The same page adds that the officer's title and contact details must be published on the company's website, and that the officer must take part, from the outset, in the privacy impact assessment of projects to acquire, develop or redesign an information system. A website rebuild that comes with new tags fits that description.

One paragraph on penalties is enough. The Commission can impose administrative monetary penalties that could reach 2% of worldwide turnover or 10 million dollars. Penal fines are a different track. They are imposed by a court following a penal prosecution brought by the Commission. They run from 5,000 dollars to 100,000 dollars for an individual. For a business they run between 15,000 dollars and, whichever is greater, 25M dollars or an amount equal to 4% of its worldwide turnover. On a repeat offence the fines are doubled. Those figures explain why this belongs with your own counsel rather than with a banner vendor.

What to ask the person who installed the tags

Four questions, by email, and the answer should fit on one page.

• Which tags are installed, on which pages, and which of them fire before the visitor has done anything.
• What the visitor reads at the outset about what each of those technologies does, and where they read it.
• Where our privacy policy lives, who wrote it, and on what date.
• Who our privacy officer is, and whether their title and contact details are published on the site.

One answer should end the conversation: "that is standard, everyone installs it that way." A supplier who cannot name the tags present, the pages they load on and the moment they load does not know what your website does. That is not a legal question, it is a competence question.

When this barely concerns you

Be honest about the size of the subject. A business whose site carries no tracking tag at all, and which runs no retargeting, has far less to look at here than an ecommerce site collecting accounts, carts and purchase histories. Plenty of Quebec manufacturers run five pages and a contact form. In that case the real question is not the pixel, it is whether you want to advertise at all.

There is also the opposite case, and it is more common than people think: a company that carries tags and runs no campaigns. Nobody retargets, nobody reads the reports, and the tags load on every visit anyway. That is the worst of both worlds, and it is also the easiest one to settle.

I will not tell you whether your setup is compliant. I have not seen your site, and it is not my role. This page describes public rules. It is not legal advice. Have your own counsel confirm your situation before you publish.

Sources

• Commission d'accès à l'information du Québec, Collecte de renseignements personnels, cai.gouv.qc.ca, fetched 23 September 2026.
• Commission d'accès à l'information du Québec, Consentement des personnes, cai.gouv.qc.ca, fetched 23 September 2026.
• Commission d'accès à l'information du Québec, Principaux changements apportés par la loi 25, cai.gouv.qc.ca, fetched 23 September 2026.
• Commission d'accès à l'information du Québec, Responsable de la protection des renseignements personnels, cai.gouv.qc.ca, fetched 23 September 2026.
• Commission d'accès à l'information du Québec, Sanctions et poursuites, cai.gouv.qc.ca, fetched 23 September 2026.