This post completes two articles in the series. The one on the Meta pixel covers when the tool is allowed to fire. The one on data leaving Québec covers what to document before the data leaves Québec. This one covers what the visitor can read on the site. The documents of the Commission d’accès à l’information (CAI) were reopened on October 14, 2026, the text of the Act on October 21, 2026.
Three points of method. The CAI’s website says its texts aim to popularize the laws, that they have no force of law, and that the legislative texts prevail in case of discrepancy. The text of the sections cited here (3.1, 3.2, 8, 8.1 and 8.2) was reread in the consolidated version of the Act published on LégisQuébec, which states that the document has official value: in French in the update to February 23, 2026, and in English in the official PDF updated to December 11, 2025; in both, the amendment notes of these five sections cite no amendment after the 2021 Act (S.Q. 2021, c. 25). LégisQuébec was not responding on October 21, 2026: both versions were read in the copies kept by the Internet Archive (May 5, 2026 for the French page, April 11, 2026 for the English PDF). The dates of coming into force come from section 175 of the Act assented to on September 22, 2021, published by Les Publications du Québec. Check the up-to-date text on LégisQuébec before relying on it. Quotations of the Act come from its official English version; quotations from the CAI are our translations of the French texts. Finally, this post is a practitioner’s reading, not legal advice; it describes the rules of Québec law based on the text of the Act and on the CAI’s presentation of it, and does not cover the case of a business established outside Québec. What we write from our own reading is marked “in our view”.
Three publication duties, three documents
For a business, the CAI presents three duties that translate into texts published on the site.
| Duty | Section | What the section requires |
|---|---|---|
| Person in charge of the protection of personal information | 3.1 | The title and contact details of the person in charge are published on the business’s website (without a website, they are made available by any other appropriate means) |
| Governance policies and practices | 3.2 | Detailed information is published on the site, in simple and clear terms: retention and destruction, roles and responsibilities, complaint process (without a website, by any other appropriate means) |
| Privacy policy (“confidentiality policy” in the official English version) | 8.2 | It is written in simple and clear terms, published on the business’s website, if it has one, and distributed by any means suited to reach the persons concerned, as is the notice of any change |
The CAI guide stresses that the privacy policy is neither the governance policy, nor the consent request, nor the terms of use. Terms of use can refer to the privacy policy, but they must not be merged with it. In our view, this concerns stores whose single “Policies” page mixes terms of use and privacy.
What section 8 requires you to announce at collection
Since September 22, 2023, a person who collects personal information from the person concerned must inform them, at collection and afterwards on request, of the purposes of the collection, the means used, the rights of access and rectification, and their right to withdraw consent to the communication or use of the information.
Where applicable, they also inform the person of the name of the third party on whose behalf the collection is made, the name of the third parties or the categories of third parties to whom it is necessary to communicate the information for the purposes of the collection, and the possibility that the information is communicated outside Québec. On request, they further specify the information collected, the categories of persons who have access to it within the business, the retention period and the contact details of the person in charge. All of this is provided in simple and clear terms, whatever the means used to collect the information.
One drafting detail matters for a store. The CAI’s page on the main changes writes “the name of the third parties to whom it is necessary to communicate the information”. The official English version of section 8 on LégisQuébec says “the name of the third persons or categories of third persons”. We keep the wording of the Act, which admits the category of third party alongside the name.
When collection uses a technology that includes functions allowing the person to be identified, located or profiled, section 8.1 adds prior information: the use of that technology and the means offered to activate those functions. Our article on the Meta pixel covers this point.
What the CAI guide suggests writing in the policy
The guide states that, for the private sector, there is no regulation equivalent to the public sector’s on the content of the policy. The content it offers therefore rests on what a business must provide when it collects information, with a few additions inspired by the public sector regulation, and it calls that content “suggested”. It nonetheless writes “you must” for most of the elements below, and “you may” for the options, which we flag. Here is what matters most to a store that advertises.
- At the top, the business name, the date the policy takes effect and the date of the last update.
- The technological means of collection. The guide gives as examples emails received by customer service, an online appointment request form, an app, some cookies on the site, video surveillance, a connected object.
- The persons or organizations that collect information for the business. The guide’s examples: a technology service provider such as an ordering platform or a newsletter manager, a consultant who provides part of the services offered to customers, an agency in charge of answering questions or handling complaints.
- If an identification, location or profiling technology is used, the use of that technology and how to activate those functions, which must be off by default. The guide cites the consumer profile among its examples of profiling.
- The information collected and the purposes. The guide lists under “technical or digital information” the IP address, the date and time of connection, the pages visited and the actions taken on a website. Among its examples of purposes is “offering personalized recommendations based on the purchase profile”, which it ties to profiling and therefore to section 8.1.
- The measures offered to refuse the collection of certain information and their consequences. One example from the guide: refusing cookies and using the site without certain features.
- The persons who have access to the information: the internal categories and, if the information is passed on to others to achieve the purpose, the purposes of the communication, the names or categories of the recipients, the information concerned and the possibility that it is transmitted outside Québec.
- The rights of access, rectification and complaint and, as an option, the name and contact details of the person in charge.
The guide adds, as options, a description of security measures and the technological means of accessing or rectifying the information.
What this changes for a store that advertises
The grid below translates the guide for an ad account. The first two columns come from the CAI, the third is our reading.
| What the text lets people read | Basis | Our reading for an ad account |
|---|---|---|
| The collection tools | Guide: means of collection, cookies | The list of active pixels, tags and conversion APIs is taken from the browser’s Network tab and the tag manager, not from memory. Each line of the list should be found in the text. |
| The third parties | Section 8: names or categories; guide: organizations collecting for the business, recipients | In our view, an event sent to Meta or Google is a communication to a third party. Naming Meta and Google answers most directly. In our view, “advertising platforms” is a category that the text of the section admits, but the CAI does not say what level of detail a category needs. |
| The purposes | Section 8: purposes; CAI page: a consent for each purpose | One purpose per line. In our view, measuring sales attributed to an ad and building an audience from behaviour are two distinct purposes. |
| Leaving Québec | Section 8; guide | State, where applicable, that the information may be communicated outside Québec. The record described in our article on data leaving Québec already contains the recipient and the data transmitted. |
| Activation | Section 8.1 | The text says how the visitor activates the profiling functions, and the banner does what the text says. |
| Refusal | Guide: measures to refuse | Say what happens if the visitor refuses advertising cookies. |
| Access to the text | Section 8.2; guide | The guide gives the example of a link to read before placing an order online. In our view, the footer and the banner are two other access points. |
| Updates | Section 8.2; guide | A date of last update, and the notice of any change distributed the same way as the policy. |
One question remains open for an agency like ours. The guide mentions a consultant who provides part of the business’s services and an agency in charge of answering questions or handling complaints. It does not say whether a media agency falls under these examples. In our view, if an agency has access to personal information, for example customer list exports or audiences, the question deserves to be put to the person in charge of the protection of personal information rather than settled by default.
The banner and the policy do not carry the same information
In its guidelines on the validity of consent (version 1.0, October 31, 2023), the CAI lists the information an organization should generally provide when obtaining consent: who is asking, why, what information, from whom, how, to whom it will be communicated, the possibility of leaving Québec, rights, who has access, for how long, who to contact.
It gives as an example a split into two levels. At the first level (the consent request itself, as an example), one could find the purpose, the information or its categories and the third parties. The second could consist of a privacy policy, an appendix to a form or a “Learn more” button placed next to the request. On its page on the main changes made by Law 25, the CAI also writes that, when the consent request is made in writing, it must be presented separately from any other information.
In our view, a banner that says only “we use cookies to improve your experience” and links to the policy does not carry the first level described by the CAI: no precise purpose, no third parties. The guidelines speak of an example (“could”) and not of a formal obligation.
What to do, in order
- List the active advertising and measurement tools: pixels, tags, conversion APIs, newsletter platform.
- For each, write the third party (its name or its category), the purpose, the information transmitted and the possibility of leaving Québec.
- Reread the policy with the grid above, in simple and clear terms, and date it.
- Publish the policy through a visible link before checkout, in the footer and from the banner, and check that the title and contact details of the person in charge appear on the site.
- Redo the list whenever a tool or a purpose changes, update the date and distribute the notice of change the same way.
Our Google Ads in Montréal page describes our work on Canadian Merchant Center and on Law 25 compliance.