Law 25 is a topic owned by cookie banner vendors and law firms. The first talk about a button, the second about registers and policies. Almost nobody goes down to the technical object: the pixel itself, how it is installed on Shopify, and what actually leaves the browser before the visitor has touched anything. That is what this post does, from the point of view of someone who installs and unplugs pixels, not a lawyer. The legal passages are a practitioner’s reading, not advice: the official source is linked every time.
Short answer: yes, the pixel is covered
The Commission d’accès à l’information summarizes the obligation Law 25 introduced into the private sector act: before collecting personal information through a technology that includes functions allowing a person to be identified, located or profiled, the business must inform the person of the use of that technology and of the means available to activate those functions. Those functions must be deactivated by default. The Commission defines profiling as the collection and use of personal information to assess certain characteristics of a person, in particular their personal preferences, interests or behaviour.
Put that definition next to what the Meta pixel does on a store: it records product pages viewed, add-to-carts, purchases and their value, ties those events to a browser identifier and, when it can, to a Meta account, and it feeds audiences built on that behaviour. Identification, location, profiling: all three functions are present. So the question is not whether the pixel is covered, but when it is allowed to fire.
The law’s answer: not before the person has activated the function. “Off by default” means the pixel does not load until there has been a positive action. A banner that informs while letting the pixel run as the visitor reads it does not meet the obligation. This is where a good share of the stores we audit fall short, including those that bought a banner.
Who the law actually applies to
Law 25 applies to businesses that collect, hold, use or communicate personal information of persons located in Québec, regardless of where the business is established. A Vancouver or Toronto store shipping to Québec is covered for its Québec visitors. A Canadian brand that assumed only federal law applied usually discovers this scope during an audit.
That changes how the consent layer is designed: it cannot be “Québec only” based on IP geolocation, because that geolocation is itself a location function, and because it is wrong often enough. In practice, the strictest regime is applied to all Canadian traffic.
Meta has no mechanism for Canada
This is the central fact of this post, and it can change: we checked it on September 6, 2026. Meta’s documentation on data processing options, the feature that restricts how an event is used, is titled “Data Processing Options for US Users”. The only accepted country value is 1, for the United States, and the list of covered territories names fourteen US states. No value for Canada, none for Québec.
Consequence: there is no setting on Meta’s side that makes an event compliant with Law 25. Not limited data use, not an Events Manager parameter. Compliance is decided before the event leaves, in the store’s consent layer, and nowhere else.
The Conversions API does not solve the problem, it moves it. An event sent from the store’s server, or from Shopify on its behalf, is still a collection of personal information through a profiling technology. It must be gated by the same consent as the browser pixel. A setup where the pixel is blocked but the Conversions API sends everything is more discreet, not more compliant.
The Shopify case, concretely
On Shopify, the Meta pixel arrives through three paths, and they do not behave the same way.
The Facebook and Instagram channel, installed from the admin, sets an app pixel and feeds the Conversions API from Shopify. It honours Shopify’s Customer Privacy API: if the store requires consent and the visitor has not given it, marketing events are not emitted. Provided the consent collection region includes Canada, or is set to all countries, and provided the banner actually calls the API with the visitor’s decision.
A custom pixel, pasted under Settings, Customer events, runs in a sandbox that only receives events after consent when the pixel is declared as requiring marketing consent. A pixel set with the “does not require consent” option always fires. It is a checkbox, and it is in the wrong position on a share of the stores we see.
The third path is the worst: a code snippet pasted into the theme, often by a third-party app or a former contractor. It runs on load, outside any Shopify control, and ignores the visitor’s decision. It has to be found and removed.
The four-step test
You need no paid tool. Take twenty minutes and a browser.
Step 1: start clean. Open a private window, open developer tools (Network tab), filter on facebook.com/tr and on connect.facebook.net. Load the store’s home page. Do not touch the banner.
Step 2: read what leaves before any action. If a request to connect.facebook.net/en_US/fbevents.js appears, the pixel script loaded. If a request to facebook.com/tr with an ev=PageView parameter appears, the event went out. Either way the function was not off by default: the test fails, no point going further before fixing.
Step 3: refuse, then browse. Refuse explicitly in the banner. Open a product page, add to cart, open the cart. No facebook.com/tr request should appear. If a ViewContent or AddToCart request goes out after a refusal, you have a pixel ignoring the decision: look for it in the theme.
Step 4: check the server. The browser does not show the Conversions API. In Meta Events Manager, Test events tab, enter a test code, then replay the step 3 journey while refusing. If events arrive marked “Server” during a refused journey, the Conversions API is not gated by consent.
Document the result: date, browser, screenshots of the Network tab before and after consent, screenshots of Events Manager. The burden of demonstrating compliance is on the business, not the visitor. Here is the template we fill in at every audit.
| Checkpoint | Expected | Observed | Screenshot |
|---|---|---|---|
fbevents.js script before consent |
absent | ||
PageView before consent |
absent | ||
ViewContent, AddToCart after refusal |
absent | ||
| “Server” events after refusal | absent | ||
| Events after acceptance | present, deduplicated |
What you risk
The Commission has the power to impose administrative monetary penalties directly, without going through a court. It states those penalties can reach 2% of worldwide turnover or 10 million dollars. It publishes a general framework for applying those penalties, and a business can undertake to correct a breach to avoid the penalty if the undertaking is approved and honoured.
As of September 6, 2026, we found no published Commission decision naming an e-commerce advertising pixel. The “real penalty” amounts circulating on compliance vendors’ sites point to no referenced decision. We do not repeat them.
What is left to do, in order
- Run the test. Twenty minutes, binary result.
- Remove any pixel pasted into the theme and any custom pixel declared as not requiring consent.
- Set Shopify’s consent collection to Canada at minimum, refusal by default, and check that the banner passes the decision to the Customer Privacy API.
- Gate the Conversions API on the same decision, then redo step 4.
- Measure the loss of events and compensate with the match quality of consented events, not by plugging back what was unplugged.
The last point is the one that stings: a compliant Meta account sees fewer events than before. That is the price of the Québec regime, and the work of a Meta Ads agency in Montréal is to steer with that data, reduced but lawful. The next part of the subject, sending data outside Québec and the privacy impact assessment it requires, will get its own post.