26 %
install advertising cookies before any click
Meta pixel, Google Ads, TikTok… set by the site itself before the visitor could choose. Adding session recording and marketing tools: 28%.
Study · measured on October 9, 2026
Law 25: we checked 200 Québec small-business websites
We visited 200 websites of Québec small businesses and shops as a new visitor who clicks nothing. Here is what they do before any click, what the law asks, and how to check your own site in 5 minutes.
- Original measures
- No site named
- Laws checked
- Reading time: 8 minutes
What we found
200 websites of Québec small businesses and shops visited on October 9, 2026 without clicking anything, 189 of them measured in detail. None is named: the goal is the general picture, not pointing at anyone.
68 %
of sites that track show no notice
Among the 82 sites that use advertising, marketing or analytics tools. A site with no tracking tool needs no notice.
70 %
of notices show a refuse button on the first screen
Only buttons visible on the first screen count. For the Commission d’accès à l’information, refusing must be as easy as accepting.
17 %
mention the person in charge of personal information
At least: we looked on the home page and in the policy linked from it. Among the policies we could read, 40% mention it.
Only 21 sites out of 189 show all three signals checked
No advertising cookie before the visitor’s choice, a privacy policy linked from the home page, and the mention of the person in charge of personal information.
These are technical observations of the home page, not a compliance check: a site may have a reason or a setting we cannot see. This is not legal advice.
The detail, point by point
The tracking tools most present before any click
- Google Analytics (analytics)71 sites
- Google Ads (advertising)34 sites
- Meta: Facebook and Instagram (advertising)32 sites
- Microsoft Clarity (session recording)5 sites
- Klaviyo and HubSpot (marketing)6 sites
- TikTok (advertising)2 sites
By type of business
| Sites | Ad cookies | Notice | Policy | Person in charge | |
|---|---|---|---|---|---|
| Shops | 81 | 24 | 25 | 35 | 10 |
| Restaurants, cafés and bars | 53 | 14 | 14 | 15 | 9 |
| Lodging | 23 | 5 | 11 | 12 | 5 |
| Professional and health services | 20 | 3 | 14 | 12 | 7 |
What the law says
The texts, read on LégisQuébec and in the guidance of the Commission d’accès à l’information (CAI).
The person in charge, published on the site (s. 3.1)
The person with the highest authority in the business is in charge of protecting personal information, and may delegate this in writing. The title and contact details of the person in charge must be published on the business’s website. Read the text
Inform first, activate after (s. 8.1)
When a technology can identify, locate or profile a person, the business must inform them beforehand and tell them how to activate those functions. According to the guidelines of the Commission d’accès à l’information (2023-1), these functions must be deactivated by default: the person must take a positive step to activate them. Read the text
A published privacy policy (s. 8.2)
A business collecting personal information by technological means publishes on its site a privacy policy written in clear and simple terms. The CAI publishes a guide to write it. Read the text
Free consent: refusing as easy as accepting (s. 14)
Consent must be manifest, free, enlightened and given for specific purposes. For the CAI, giving consent must be as easy as not giving it; highlighting acceptance over refusal can make consent invalid. Read the text
Penalties
Administrative penalty up to $10,000,000 or 2% of worldwide turnover (s. 90.12), and penal fines from $15,000 to $25,000,000 or 4% of worldwide turnover for a business (s. 91), depending on the case. Read the text
Check your site in 5 minutes
Open your site in a private browsing window, click nothing, and answer. Everything happens in your browser: nothing is sent.
In a private browsing window, does your site show a cookie notice before you click anything?
Does the notice offer a “Refuse” button as visible as “Accept”, on its first screen?
Before your choice, is no advertising tool (Meta pixel, Google Ads, TikTok) active?
Is a “Privacy policy” link visible on your home page (often at the bottom)?
Are the title and contact details of the person in charge of personal information published on the site?
0 of 5 answered.
Your answers stay in your browser; nothing is sent or kept.
If an agency builds (or rebuilds) your site
Write Law 25 into the request for quote
Notice with “Refuse” on the first screen, advertising tools blocked before consent, privacy policy, person in charge published. It is one of the 12 points of our template. Prepare my request
Check that the contract includes it
What is not written is not promised. The 12 contract clauses
Ask for proof at delivery
Have the 5-minute check redone in front of you, in a private window, before the last payment.
Method and limits
Sample: Québec businesses with a website in OpenStreetMap (shops, restaurants and cafés, professional offices, health, lodging, crafts), read on October 9, 2026: 7,265 places. We removed chains (brand tagged, or the same domain for 3 places or more), public bodies and social-network pages: 5,422 possible sites, put in a random, reproducible order. We visited them in that order until we had 200 small-business sites we could evaluate. Of 299 sites visited, the others were unreachable, in error, for sale, nearly empty or redirected to another business, or were not small businesses: 28 chains, large companies, nonprofits or directories, removed when at least 2 of 3 independent classifications judged them so.
Visit: on October 9, 2026, from a computer in Montréal (Canadian connection), in French, as a new visitor who clicks nothing. We wait 8 seconds after loading, save a screenshot and the cookies present, then take a second reading after a mouse movement and a scroll, without accepting anything: some sites load their tools or notice only then. A notice seen at either moment counts. Finally, if there is one, we read the privacy policy linked from the home page (web page or PDF).
Advertising cookies: only known advertising cookies (Meta, Google Ads, TikTok, Microsoft Ads, LinkedIn, Pinterest…) set for the site’s own domain, i.e. by a tool the site installed. Those that may come from an embedded video or widget (YouTube, Facebook button) are excluded from this figure. Session recording (Hotjar, Clarity), marketing tools (HubSpot…) and analytics (Google Analytics…) are counted separately. Platform cookies (Shopify, Wix…) and technical cookies are not counted: our figures are minimums.
Checks: a sample of 15 sites was measured again independently, with screenshots; the buttons of notices with no refusal detected were read one by one, and screenshots were checked by eye. Of the 200 sites, 11 did not answer in time during the detailed reading: the figures cover 189 sites. The margin of error is about ± 7 points, and larger when the base is smaller (shown under each bar).
Limits: a sample of businesses listed in OpenStreetMap, denser in cities, not a portrait of all Québec small businesses; one page and one moment, on a computer; the person in charge may be published elsewhere than the home page or the policy; some notices depend on the region; a site can change overnight. The small-business classification was done before computing the results, from the sites’ names and titles only.
OpenStreetMap data © OpenStreetMap contributors, under the ODbL licence. openstreetmap.org/copyright
Frequently asked questions
Does Law 25 apply to a small business’s website?
Yes. The law applies to anyone operating a business in Québec, whatever its size. The obligations must however be proportionate to the nature and scale of the activities (s. 3.2). This is not legal advice.
Do I need a cookie notice if my site only has Google Analytics?
The law targets technologies that can identify, locate or profile. Depending on its settings, an analytics tool can be one of them. The safest is to put it under the same choice as advertising tools. This is not legal advice.
Who must be the person in charge of personal information?
By default, the person with the highest authority in the business. They may delegate the function in writing. Their title and contact details are published on the site (s. 3.1).
Is my web agency responsible for my site’s compliance?
The law makes the business responsible for the information it holds (s. 3.1). So put Law 25 in writing in the quote: notice, blocking before consent, policy. It is one of the 12 points of our request-for-quote template.
Why don’t you name the sites checked?
The goal is to show the general picture, not to point at businesses. A technical observation (a cookie present before a click) is not a legal verdict, and a site can change overnight.
How can I check my own site?
Use the 5-minute check on this page, in a private browsing window. It runs in your browser: nothing is sent.
Sources
- Act respecting the protection of personal information in the private sector, ss. 3.1, 8.1, 8.2, 14, 90.12 and 91
- CAI, Guidelines 2023-1 – Consent: validity criteria (October 31, 2023)
- CAI, Writing a privacy policy – Explanatory guide for businesses (December 2023)
- OpenStreetMap (ODbL licence)
Texts read and measures made on October 9, 2026. This guide gives general information, not legal advice.
What now?
Guide written by the AgencyVerity team, Montréal. Updated October 9, 2026. Back to contents · All our guides