Consent and Law 25: What’s Valid and What’s Not
Consent is where Law 25 breaks the most existing forms. A pre-checked box, a single 'I Accept’ button covering three different purposes, a notice saying 'by continuing to browse, you agree’: these three practices are still widespread on Quebec small business websites, and none of them produce valid consent.
This page covers the law’s conditions, the required disclosures at the point of collection, the rules for minors, and the special cases of geolocation and profiling.
Quick answer: Valid consent must be manifest, free, informed, given for specific purposes, and requested for each of those purposes, in plain and clear language. Consent that fails even one of these conditions has no legal effect, as Article 14 states explicitly. For sensitive personal information, consent must also be express.
1. The Five Conditions of Article 14
Broken down, the law gives five tests. Consent that fails even one of them has no effect.
Manifest. There must be an action. Silence is not consent. A pre-checked box is not an action by the person. Neither is a notice saying 'by continuing to browse, you agree.'
Free. The person must be able to refuse without losing access to the service. Article 9 prohibits denying a good, a service, or employment because someone refuses to provide personal information, except when collection is necessary to enter into or perform a contract, when authorized by law, or when there are reasonable grounds to believe the request is unlawful. When in doubt, Article 9 specifies that personal information is presumed not necessary.
Informed. The person knows what they are agreeing to, which ties back to the required disclosures under Article 8.
Specific and requested for each purpose. This is the change that breaks the most forms. A single button covering order delivery, newsletters, and partner data sharing at once is not valid. Each purpose needs its own separate request.
Simply worded and clearly presented. When the request is written, Article 14 requires it to be presented separately from other information. Consent buried in paragraph 14 of the terms and conditions won’t hold up.
Two additional rules apply. Consent is only valid for as long as it takes to fulfill the stated purposes. And when someone asks for help understanding the scope of what they’re consenting to, you must provide it.
2. Express Consent for Sensitive Information and the Case of Minors
Articles 12 and 13 require express consent for any sensitive personal information, whether it’s being used for a new purpose or shared with a third party. In practice, that means a dedicated, unchecked checkbox with a label that names the data and its purpose.
Article 4.1 prohibits collecting personal information from children under 14 without consent from a parent or legal guardian, unless the collection clearly benefits the minor. Article 14 adds: under 14, consent is given by the parent or guardian; at 14 and older, it can be given by the minor, the parent, or the guardian.
If your business sells to the general public, runs day camps, sports programs, training, or e-commerce, this rule applies directly to you.
3. What You Must Disclose at the Point of Collection
Article 8 requires you to inform the person at the time of collection, and afterward upon request:
- the purposes for which the information is collected;
- the means by which it is collected;
- the rights of access and correction provided by law;
- the right to withdraw consent to the communication or use of the information.
Where applicable, you must also name the third party on whose behalf collection is done, identify the third parties or categories of third parties who may receive the information, and disclose the possibility that information may be communicated outside Quebec.
On request, the person must also be informed of the information collected about them, the categories of people within the organization who have access, the retention period, and the contact information of the person responsible for protecting personal information.
Article 8.3 clarifies that a person who provides their information under Article 8 consents to its use and communication for the stated purposes. In other words, if the disclosures are made correctly, providing the information counts as consent for those specific purposes. Any other purpose requires separate consent.
4. Geolocation, Profiling, and Privacy by Default
Article 8.1 covers technologies with features that can identify, locate, or profile a person. The law defines profiling as collecting and using personal information to assess certain characteristics of a person, including work performance, economic situation, health, preferences, interests, or behavior.
Two obligations apply before collection: disclose the use of such technology, and inform people of the means available to activate these features. For small businesses, this covers geolocation of company vehicles and issued phones, productivity measurement tools, behavioral analytics on a website, facial recognition, and customer scoring tools.
Article 9.1 adds privacy by default: any business offering the public a technology product or service with privacy settings must ensure those settings provide the highest level of privacy by default, with no action required from the person. The law expressly excludes cookie settings from this requirement. If you operate an app or a customer portal, this obligation applies to you.
5. Your Website’s Privacy Policy
Article 8.2 is short and direct. Anyone who collects personal information through technological means must publish a privacy policy on the company’s website (if applicable) and distribute it through any means that reaches the people concerned. The policy must be written in plain, clear language. The same requirement applies to any notice of changes to that policy.
A contact form on your site is a technological means of collection. This obligation applies to just about every business with a website, including simple brochure sites with just a few pages.
The technical work involved is real: knowing which forms collect what, which analytics tools load on your pages, where submissions go, and how long they’re kept. That’s the kind of audit we run as part of our managed IT services.
Frequently Asked Questions
Is a Pre-Checked Box Valid Consent in Quebec?
No. Article 14 requires manifest consent, meaning an action by the person. A pre-checked box, a default acceptance, or a browsing notice does not constitute valid consent.
Does a Newsletter Require Separate Consent from an Order?
Yes. Consent must be requested for each separate purpose. Fulfilling an order and sending commercial communications are two different purposes, so the form needs two separate requests.
Does a Brochure Website Need a Privacy Policy?
If it has a contact form, analytics tracking, or any other technological means of collection, yes. Article 8.2 requires publishing a policy in plain, clear language and notifying users of any changes.
Review Your Forms with a Quebec IT Partner
Bringing consent up to standard means work in both the copy and the configuration: forms, analytics tools, mailing lists, CRM connectors. Our IT services for small businesses cover the inventory of those collection points and the cleanup needed, in Trois-Rivieres and across Quebec. Reach us through the contact form or call 450-231-3836 to go through your forms.
This guide simplifies legal obligations for general understanding. It is not legal advice and does not replace reading the actual legislation or consulting a legal professional. Legal references point to the Act Respecting the Protection of Personal Information in the Private Sector (CQLR, chapter P-39.1), as amended by Law 25.
An article sets out the principle. Putting it in place happens one workstation at a time: our managed cybersecurity service, backup and disaster recovery and our IT services in Montreal.
