Quebec Law 25 (+ PIPEDA)

Quebec's Law 25 phased in between 2022 and 2024 and contains the most specific tracking rule in North America: since September 22, 2023, any technology that allows a person to be identified, located, or profiled must be deactivated by default, and the organization must obtain consent to activate it. Privacy impact assessments are required before projects involving personal information, and the Commission d'accès à l'information can impose administrative penalties up to C$10 million or 2 percent of worldwide turnover, with court-imposed fines up to C$25 million or 4 percent. Federally, PIPEDA still governs the rest of Canada under the Office of the Privacy Commissioner; Bill C-36, introduced June 15, 2026, would replace it with a new Protecting Privacy and Consumer Data Act. For any site with Quebec traffic, analytics and advertising tags running before consent are a direct violation.