QUEBEC'S
LAW 25
.png)
Get ready for Law 25
Understand how Québec's Law 25 will impact your business and digital activities, and how Didomi can help solve key challenges.
.png)
What to expect?
September 2023: second round of Law 25 obligations come into effect.
Companies will need to provide more transparency when collecting personal information, including:
Why and how personal data is being collected, as well as the the consumer’s right to access, rectify and withdraw consent.
Names of any third parties for whom data is gathered and/or shared, including any potential transfer outside of Quebec.
Companies using automated processes to make decisions about an individual must notify this person when a decision has been made and of their right to access, correct, understand the decision-making process, request a review or submit additional information for appeal.
Consumers can request further details such as what data has been collected; who has access to it within a company, how long it will be kept, and contact details for those responsible for data protection.
The most significant provisions include:
Law 25 strengthens the need for transparent and simple messaging that is clearly marked as such.
Consumers must give their express consent for the use of “sensitive” personal information for any other purpose than that for which it was originally collected.
Companies cannot collect personal data concerning children under 14 without parental consent, except in cases of clear benefit to the child (such as an emergency).
Biometric are no longer permitted as means to verify a person’s identity without their express consent.
Private-sector companies face potential fines of 10,000,000 Canadian dollars or 2% of global turnover from the previous fiscal year.
Higher penalties are foreseen for the most serious offences.

Companies will need to provide more transparency when collecting personal information, including:
Why and how personal data is being collected, as well as the the consumer’s right to access, rectify and withdraw consent.
Names of any third parties for whom data is gathered and/or shared, including any potential transfer outside of Quebec.
Companies using automated processes to make decisions about an individual must notify this person when a decision has been made and of their right to access, correct, understand the decision-making process, request a review or submit additional information for appeal.
Consumers can request further details such as what data has been collected; who has access to it within a company, how long it will be kept, and contact details for those responsible for data protection.

The most significant provisions include:
Law 25 strengthens the need for transparent and simple messaging that is clearly marked as such.
Consumers must give their express consent for the use of “sensitive” personal information for any other purpose than that for which it was originally collected.
Companies cannot collect personal data concerning children under 14 without parental consent, except in cases of clear benefit to the child (such as an emergency).
Biometric are no longer permitted as means to verify a person’s identity without their express consent.

Private-sector companies face potential fines of 10,000,000 Canadian dollars or 2% of global turnover from the previous fiscal year.
Higher penalties are foreseen for the most serious offences.
Are there any exceptions to the requirement to obtain consent?
Yes, if the use of data is necessary for providing or delivering a product or service requested by a consumer.
This includes so-called "essential" cookies and trackers.



They Trust us

Didomi Montréal: Turning the challenges of Law 25 into opportunities
Didomi teamed up with Adviso and the National Bank of Canada for a conference in Montreal, addressing data protection issues in Quebec and around the world, and how companies can turn them into opportunities. Focusing on the topics of Law 25, trust, consent management and digital performance measurement, the panel included Axel Queffeulou, Senior Data Solutions Architect at Adviso, Philippe Rincon, Vice-President of Digital at the National Bank of Canada, and Raphaël Boukris, Co-Founder and CRO at Didomi.
What is the digital impact of Law 25?
Consent is mandatory for triggering all trackers

LAW 25 - METRICS
Impact on analytics
Without user consent under Law 25, you cannot measure analytical performance (sessions/sales) or share data with your MarTech ecosystem.
Important: server-side tracking is not exempt. If users do not give their consent, you will have to calculate performance using data modeling.

LAW 25 - MARKETING
Impact on media performance
As a business, your ability to run remarketing audiences depends on users providing consent.
If users do not consent, you cannot track conversions, resulting in lower in-platform performance and fewer data points for AI optimization.
If you are a website publisher, you won't be able to maximize advertising revenue without consent.

LAW 25 - UX
Impact on user experience
Ensuring choices are respected and giving them simple and transparent ways to access their data at all times will reinforce user trust.
A reliable and efficient consent management process will prevent users from leaving a website due to confusing language or off-putting consent banners.
Didomi helps you solve
the challenges of Law 25

ANY DEVICE, ANY ENVIRONMENT
Consent management
Collect user consent for all countries and devices.
Create consent banners that reflect your brand while easily managing vendors and purposes.
Generate proofs of consent in a few clicks, from a single source of truth.
Measure and optimize consent rates with advanced Analytics.

REDUCE YOUR RISK
Advanced Compliance Monitoring
Detect and proactively react to privacy breaches.
Reduce time and optimize your compliance investment.
Ensure continued high performance with automated maintenance.