Quebec Law 25 and marketing: forms, cookies and email lists
Partner · Strategy, advertising and measurement
Law 25 (the Act to modernize legislative provisions as regards the protection of personal information, which rewrote the private-sector Act) touches a company's marketing in three precise places: the form that collects information, the tracking cookie that feeds your analytics tools, and the email list. The rest of compliance is a matter of law and is validated with a lawyer, not with an agency.
- The Commission d'accès à l'information can impose monetary administrative penalties of up to $10 million or 2% of worldwide turnover, whichever is higher. It can also bring penal proceedings, where the fine ranges from $15,000 to $25 million or 4% of worldwide turnover, whichever is higher. The financial risk is therefore real and quantified.
- Two of the failures it names touch marketing directly: inadequately informing people of the collection, and neglecting security measures.
- A form that does not say what will be done with the information is the most common point of contact, and fixing it costs a few hours.
- An undertaking mechanism exists: a company can commit to the Commission to correct the situation, and if the undertaking is approved and honoured, the penalty does not apply to the facts observed.
- This article reports on what the Commission publishes. It does not replace legal advice, and Falia is not a law firm.
On this page
Monetary administrative penalty
An monetary administrative penalty is a sum that Quebec's Commission d'accès à l'information can impose directly on a company, without going through a court. It applies to failures to meet certain obligations of the Act respecting the protection of personal information in the private sector. It differs from penal proceedings, which the Commission can also bring and whose fines are markedly heavier. Its ceiling is set at $10 million or 2% of worldwide turnover, whichever is higher. It is a decision taken by a person designated by the Commission, without a prior judgment, after a notice of non-compliance and the opportunity to submit observations.
The three points of contact
This subject comes up in meetings in a form too broad to be settled. Yet the Commission publishes the list of failures that carry a penalty, and two of them fall directly within an agency's scope, which makes the risk assessable rather than diffuse. Failing to adequately inform people of the collection of their information, and failing to take the security measures needed to protect it.
The form. This is the most common point of contact. A form that collects a name, an email or a phone number without clearly saying what these details will be used for and what the person's rights are leaves the company in the category the Commission names explicitly. Fixing it costs a few hours and is worth doing before anything else.
The tracking cookie. Your analytics tools and your advertising tags drop cookies and transmit data. Consent, its scope and the ability to withdraw it are at the heart of the regime. The law also requires that the visitor be told beforehand about a tool's profiling functions (which is what most advertising cookies do) and that those functions stay inactive until the visitor activates them. It is the most technical of the three, and the one that most directly affects the reliability of your numbers: poorly implemented consent also distorts your measurement, and therefore the budget decisions that follow from it.
The email list. A list built up over the years often contains addresses collected under conditions no one can still document. It is both a commercial asset and a risk, and its value does not offset the cost of an incident. No one on the outside can decide for you what becomes of the oldest addresses. For the sending itself, Canada's federal anti-spam legislation also applies: it requires consent to receive the messages, not only to the collection of the address.
Two concrete applications follow: the AI usage policy an SMB must write before its team starts using it, and the particular case of health information, which is sensitive within the meaning of the law.
What to settle before committing a compliance budget
This is work that returns nothing visible and whose cost of inaction shows up only in the event of a complaint or an incident. It is therefore hard to fund, until the day it is funded in a rush and at far greater cost.
- Do we know precisely what information our forms collect, and what becomes of it?
- Do our analytics tools fire before or after consent?
- Can we document the origin of the addresses in our oldest list?
- Who, on our side, carries this responsibility, and does that person know it?
- Have we had our position validated by a lawyer, or only by a vendor?
The answer that holds up clearly distinguishes what is a matter of law from what is a matter of technical execution, and sends you to a lawyer for the former. A vague answer sells complete, guaranteed compliance, promises legal immunity, or treats the subject as a simple banner to install.
Deciding in what order to fix these three points, and which of them also affect the reliability of your data, is settled on the real state of your site. A 90-minute consultation settles it, with a written summary your team and your legal counsel can use.
Where an agency's role stops
This has to be said clearly, because this market is full of offers that promise a compliance no one can guarantee, and that sell at a premium.
| What falls to an agency | What is a matter of law |
|---|---|
| Making forms explicit about the intended use | Judging whether each collection is necessary and whether the consent obtained is valid |
| Implementing and verifying the consent mechanism | Drafting and validating the privacy policy |
| Documenting which tools receive which data | Designating the person in charge and defining their obligations |
| Cleaning and documenting the mailing lists | Governing the handling of confidentiality incidents |
| Checking that measurement stays reliable after consent | Responding to a complaint or a request from the Commission |
The right-hand column is not subcontracted to a marketing vendor, and a company that accepts this buys a false comfort, then pays twice: the cost of the package, and the cost of the fix. The left-hand column, on the other hand, is done well and is measurable, and that is where Falia steps in, with a written scope and a written price.
What stays in-house: the decision of what to do with the information already held, the designation of the person in charge, and the legal validation. None of these three things is delegated to an agency, and a vendor who claims otherwise exposes you. What gets delegated: the inventory of forms and of the tools that receive data, the correction of collection notices, the implementation of consent, the check that measurement holds afterward, and the documented cleaning of lists. A company that has its position validated by a lawyer then hands off the technical execution moves faster than one that buys a compliance package.
Where to start
The order matters, because the first point fixes the most common risk at the lowest cost.
Start with your forms: each one must say, in clear and simple terms, what the information will be used for, how it is collected, that the person can access it, correct it and withdraw consent, and to whom it is passed on, where applicable. Then move to the consent of your analytics tools, checking what fires before acceptance: it is the most expensive item of the three. Finish with the lists, which call for a business decision more than technical work.
The Commission provides that a company can undertake to it to take the measures needed to remedy a failure or mitigate its consequences. If the undertaking is approved and honoured, no administrative penalty can be imposed for the acts observed. The undertaking can carry conditions, and even the obligation to pay a sum. In other words, a step started and documented is worth more than an empty file, which is a concrete budget argument for starting before you are forced to.
One last reminder: this article presents what the Commission publishes, for information. It does not constitute legal advice and Falia is not a law firm. Your company's compliance is validated with legal counsel.
The consent question bears directly on measurement, covered in marketing indicators and in multi-touch attribution. Collection by form is developed in what makes a landing page convert, and lists in email marketing.
The clauses framing a mandate, data handling included, are detailed in the contractual framework of a marketing mandate.
This point sits inside the plan described in building the marketing budget.
Already running a marketing team? See how we plug in as reinforcement on web design.
Frequently asked questions about Law 25 and marketing
What penalties can the Commission impose?
Monetary administrative penalties of up to $10 million or 2% of worldwide turnover, whichever is higher, imposed directly without going through a court. The Commission can also bring penal proceedings, where the law provides for a fine of $15,000 to $25 million or 4% of worldwide turnover, whichever is higher, doubled for a repeat offence. It publishes the list of failures that can lead to an administrative penalty. It is a cash-flow risk as much as a reputational one.
Where does the law concretely touch marketing?
In three places: the forms that collect information, the tracking cookies that feed analytics tools and advertising tags, and the email lists. Two of the failures named by the Commission concern these points directly, including failing to adequately inform people of the collection.
Can an agency make a company compliant?
No, and you should be wary of anyone who promises it. An agency can correct collection notices, implement consent, document data flows and clean lists. The necessity of the collection, the privacy policy, the designation of the person in charge and the response to a complaint are a matter for legal counsel. Confusing the two costs dearly when a complaint arrives.
Is it better to start even if you are late?
Yes. The Commission provides that a person can undertake to it to take the measures needed to remedy a failure. If that undertaking is approved and honoured, no administrative penalty can be imposed for the acts observed. A documented step therefore weighs more than an empty file, and its cost stays lower than that of a correction made under constraint.
- Commission d'accès à l'information du Québec, Sanctions, accessed October 2026.
- Commission d'accès à l'information du Québec, Principaux changements aux lois sur la protection des renseignements personnels, accessed October 2026.
- Gouvernement du Québec, LégisQuébec, Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), sections 8, 8.1, 12, 14, 90.1, 90.12, 91, 92 and 92.1, official text, accessed October 2026.
- Commission d'accès à l'information du Québec, Cadre général d'application des sanctions administratives pécuniaires (PDF, May 11, 2023, in French), accessed October 2026.
- National Assembly of Québec, Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, assented to September 22, 2021, accessed October 2026.
- Government of Canada, Justice Laws Website, Canada's anti-spam legislation (S.C. 2010, c. 23), accessed October 2026.
Gabriel almost always takes your first call and carries out your audit. He builds the strategy starting from your growth goal: where to put your budget, which market to test and how to connect each lead to a real sale in your CRM. He mainly leads engagements for three goals: Optimize the profitability of your digital campaigns, Develop a new market, and Generate demand and growth. With Geneviève, he also works on organic search (SEO), AI visibility (GEO) and conversion rate optimization (CRO). The sales a Google Ads or Meta Ads campaign brings in depend on the page that receives the click. He writes mainly about marketing strategy, paid advertising and measurement.
About Falia →
SEO
Paid advertising
Conversion
AI visibility
Web design