QUEBEC'S
LAW 25

Law 25

Get ready for Law 25

Understand how Québec's Law 25 will impact your business and digital activities, and how Didomi can help solve key challenges.

Law 25

What to expect?

September 2023: second round of Law 25 obligations come into effect.

Transparency obligations

Companies will need to provide more transparency when collecting  personal information, including:

Why and how personal data is being collected, as well as the the consumer’s right to access, rectify and withdraw consent.

Names of any third parties for whom data is gathered and/or shared, including any potential transfer outside of Quebec. 

Companies using automated processes to make decisions about an individual must notify this person when a decision has been made and of their right  to access, correct, understand the decision-making process, request a review or submit additional information for appeal.

Consumers can request further details such as what data has been collected; who has access to it within a company, how long it will be kept, and contact details for those responsible for data protection.

New rules for consent

The most significant provisions include:

Law 25 strengthens the need for transparent and simple messaging that is clearly marked as such.

Consumers must give their express consent for the use of “sensitive” personal information for any other purpose than that for which it was originally collected.

Companies cannot collect personal data concerning children under 14 without parental consent, except in cases of clear benefit to the child (such as an emergency).

Biometric are no longer permitted as means to verify a person’s identity without their express consent.

Financial penalties

Private-sector companies face potential fines of 10,000,000 Canadian dollars or 2% of global turnover from the previous fiscal year.

Higher penalties are foreseen for the most serious offences.

Law 25
Transparency obligations

Companies will need to provide more transparency when collecting  personal information, including:

Why and how personal data is being collected, as well as the the consumer’s right to access, rectify and withdraw consent.

Names of any third parties for whom data is gathered and/or shared, including any potential transfer outside of Quebec. 

Companies using automated processes to make decisions about an individual must notify this person when a decision has been made and of their right  to access, correct, understand the decision-making process, request a review or submit additional information for appeal.

Consumers can request further details such as what data has been collected; who has access to it within a company, how long it will be kept, and contact details for those responsible for data protection.

Law 25
New rules for consent

The most significant provisions include:

Law 25 strengthens the need for transparent and simple messaging that is clearly marked as such.

Consumers must give their express consent for the use of “sensitive” personal information for any other purpose than that for which it was originally collected.

Companies cannot collect personal data concerning children under 14 without parental consent, except in cases of clear benefit to the child (such as an emergency).

Biometric are no longer permitted as means to verify a person’s identity without their express consent.

Law 25
Financial penalties

Private-sector companies face potential fines of 10,000,000 Canadian dollars or 2% of global turnover from the previous fiscal year.

Higher penalties are foreseen for the most serious offences.


Are there any exceptions to the requirement to obtain consent?

Yes, if the use of data is necessary for providing or delivering a product or service requested by a consumer.

This includes so-called "essential" cookies and trackers.

Type=Webinar, Regulation=Law 25
Webinars
Latest webinars on Law 25 and other hot privacy topics
Learn more read more link arrow
Type=Blog, Regulation=Bill-C27
Blog article
Canada’s Bill C-27: what is it and how to prepare for it?
Learn more read more link arrow
Type=Case studies, Regulation=Law 25
Case study
Canadian bank transformed Law 25 into an opportunity
Learn more read more link arrow

They Trust us

Client=La presse, Color=Blue Client=Loto Québec, Color=Blue Client=SAQ, Color=Blue Client=CAA, Color=Blue Client=SIMONS, Color=Blue Client=Les affaires, Color=Blue Client=Centris, Color=Blue

IMG_5714

Didomi Montréal: Turning the challenges of Law 25 into opportunities

 

Didomi teamed up with Adviso and the National Bank of Canada for a conference in Montreal, addressing data protection issues in Quebec and around the world, and how companies can turn them into opportunities. Focusing on the topics of Law 25, trust, consent management and digital performance measurement, the panel included Axel Queffeulou, Senior Data Solutions Architect at Adviso, Philippe Rincon, Vice-President of Digital at the National Bank of Canada, and Raphaël Boukris, Co-Founder and CRO at Didomi.

 

  Read article

What is the digital impact of Law 25?
Consent is mandatory for triggering all trackers

desktop tablet-Sep-18-2023-12-20-43-0408-PM

LAW 25 - METRICS

Impact on analytics

Without user consent under Law 25, you cannot measure analytical performance (sessions/sales) or share data with your MarTech ecosystem.

Important: server-side tracking is not exempt. If users do not give their consent, you will have to calculate performance using data modeling.

Law 25

LAW 25 - MARKETING

Impact on media performance

As a business, your ability to run remarketing audiences depends on users providing consent.

If users do not consent, you cannot track conversions, resulting in lower in-platform performance and fewer data points for AI optimization.

If you are a website publisher, you won't be able to maximize advertising revenue without consent.


Law 25

LAW 25 - UX

Impact on user experience

Ensuring choices are respected and giving them simple and transparent ways to access their data at all times will reinforce user trust.

A reliable and efficient consent management process will prevent users from leaving a website due to confusing language or off-putting consent banners.

Didomi helps you solve
the challenges of Law 25

Law 25

ANY DEVICE, ANY ENVIRONMENT

Consent management

Collect user consent for all countries and devices.

Create consent banners that reflect your brand while easily managing vendors and purposes. 

Generate proofs of consent in a few clicks, from a single source of truth.

Measure and optimize consent rates with advanced Analytics.

Law 25

REDUCE YOUR  RISK

Advanced Compliance Monitoring

Detect and proactively react to privacy breaches.

Reduce time and optimize your compliance investment.

Ensure continued high performance with automated maintenance.