Consent: what really changes

A customer fills out your contact form on Monday. On Tuesday, they receive your newsletter without having checked a marketing box. We still see this scenario too often. Under Law 25, consent is no longer a pre-checked box at the bottom of the page. It must be clear, informed, and given for specific purposes, and sometimes distinct for each use.

Valid consent: the essentials

In practice: a "send us a message" form does not automatically mean consent to the newsletter, advertising profiling, or sharing with third-party partners.

• Free: refusal must be as simple as acceptance (see also cookie banner).
• Informed: the person understands what information is collected and why.
• Specific: no catch-all consent for marketing, partners, and analytics in a single checkbox.
• Limited in time: re-consent if purposes change significantly.

Concrete examples

• Newsletter: checkbox unchecked by default; link to the policy; one-click unsubscribe.
• Contest: contest purpose separate from third-party marketing; retention period stated.
• HR (job application): "recruitment" purpose; do not reuse CVs for something else without new consent.

However, certain purposes may rely on a legal basis other than consent (contract performance, legal obligation). Do not mix everything in the same checkbox: document the basis chosen for each processing activity.

Persons under 14 years of age

For a child under 14 years, consent must in principle come from a parent or guardian, except for exceptions provided by law for certain low-risk services. If your activity reaches young people (camps, recreation, online games), have your mechanism validated by a lawyer.

Key point: consent for minors is not an HR or marketing formality. It is a distinct rule that can invalidate an entire collection if poorly designed.

In brief

• Each important purpose deserves its own explanation, and often its own choice.
• Pre-checked boxes and "by continuing to browse" consent for marketing: a bad approach.
• Newsletter, contest, and HR have different rules; adapt forms and registers.
• Under 14: parent or guardian consent, except for limited exceptions.

Useful references

• CAI, Consent: criteria and examples for Quebec organizations.
• Act P-39.1 (private sector): legal framework for consent and exceptions.
• Cookie banner and trackers: consent on the website, equivalent refusal, and CMP.

This text is for information only and does not constitute legal advice. For a decision that binds your organization, consult the CAI and a legal professional.

Check your website

Public forms and trackers are often the first place where consent falls apart. Our free technical scan helps spot observable gaps (cookies, scripts, policy). It complements, but does not replace, your compliance program.