Law 25 cookie banner: what the CAI expects
You open your site in private browsing: the banner says "refuse", but Google Analytics still loads. That gap between display and technical reality has been documented by the CAI for years, and Law 25 strengthens transparency and consent requirements for non-essential trackers.
What Law 25 changes for cookies and trackers
In Quebec, collecting, using, and disclosing personal information through a website (identifiers, advertising profiles, invasive audience measurement, etc.) must respect Law 25 principles. Cookies and similar technologies are not banned, but their use must be justified, transparent, and most often based on valid consent for non-essential purposes.
In practice: the banner "By continuing to browse, you accept..." is not enough when trackers are deployed before a free and informed choice. Users must be able to refuse as easily as they accept.
Practical requirements reiterated by the CAI
- No prior deployment of advertising or profiling cookies before consent (except strict exceptions, e.g. cookies strictly necessary for the requested service).
- Granular choices when multiple purposes coexist (advertising, measurement, social networks).
- Refusal as simple as acceptance: no dark patterns hiding the refuse option.
- Clear information on purposes, durations, and third parties, linking to an up-to-date privacy policy.
- Honour the choice on later navigation (refusal must not be bypassed on the next click).
Banner, CMP, and policy: three parts of the same puzzle
A well-configured banner relies on a privacy policy that names tracker categories, responsible parties, and individual rights. Without an accessible policy, transparency remains incomplete. See also our article on Law 25 privacy policy for SMBs and on consent beyond cookies.
Common mistakes on Quebec websites
- Third-party scripts in HTML before any consent mechanism.
- "Accept all" visible, refuse option only in a submenu.
- Pre-checked box for marketing purposes.
- No update after changing analytics or advertising tools.
Key point: the banner is not decoration: it is the technical reflection of your documented choices. If the policy says one thing and the site does another, you have a bigger problem than cookies.
Next steps for your organization
Document purposes by tracker category, align your CMP (consent management platform) with your policy, then validate technical behaviour after refusal. For high-risk projects (new CRM, geolocation, AI on personal data), a PIA may be required in parallel.
In brief
- Non-essential trackers: transparency and, as a rule, valid consent before deployment.
- Refusal = acceptance in simplicity; no advertising deployment before choice.
- Banner + policy + actual site behaviour: one coherent set.
- Validate after refusal with a scan, not only by reading CMP configuration.
Useful references
- CAI, Cookies and other technologies: expectations for sites targeting the Quebec public.
- Act P-39.1 (private sector): legal framework for collection via technologies.
- Web privacy policy essentials: minimum content to publish with the banner.
This text is informational and does not constitute legal advice. For a decision binding your organization, consult the CAI and a legal professional.
Check your website
The only reliable way to know if trackers load despite refusal is to test the live site. Our free technical scan detects scripts and cookies observable after consent or refusal. It complements, but does not replace, your compliance program.