Is your website ready for Law 25? A checklist

What your website should have

• A privacy policy published on the site, written in clear terms.
• The name of the person in charge of protecting personal information, with a way to reach them.
• Clear consent before collecting information: a box that is never pre-ticked, and a sentence explaining the use.
• Non-essential cookies and trackers off by default, turned on only if the visitor accepts.
• A mention of providers that process information outside Quebec, where that applies.
• A simple way to ask for access to or correction of one’s information.

Common mistakes

• A cookie banner where everything is already accepted.
• Analytics tools or advertising pixels that load before consent.
• A contact form that does not say what happens to the information.
• A policy copied from another site that does not describe your situation.

Where to start

• List the tools on your site: forms, statistics, embedded videos, social media.
• Note what information each one collects and where it is sent.
• Write or update your privacy policy based on that list.
• Fix the forms and the consent banner.
• Test it: open your site in a private window and check what loads before you accept.

What next

Plan a quick check once or twice a year, and every time you add a tool. For special cases, consult a legal professional or the Commission d’accès à l’information.