What Law 25 requires
- Obtain clear, free and informed consent for each specific purpose, and express consent for sensitive information.
- Tell people before using technology that can identify, locate or profile them, and keep those functions off until they turn them on.
- Set the privacy settings of technological products and services offered to the public to the highest level of confidentiality by default. This rule does not cover cookie settings.
- Tell people when a decision about them is made only by automated processing, and let them submit observations to a staff member who can review it.
- Name a person in charge of protecting personal information, and publish their title and contact details on your website.
- Report confidentiality incidents that present a risk of serious injury to the Commission and the people affected, and keep a register of all incidents.
- Carry out a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service that handles personal information, and before sending personal information outside Quebec.
What the banner does here
The same opt-in mode as in the EU and UK: non-essential cookies are blocked until the visitor chooses, with Reject all beside Accept all at the same size, and no pre-ticked boxes.
How GrantCookie covers it
- Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
- Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
- Withdrawing consent. A re-open control stays on every page, so visitors can withdraw or change their choice at any time.
This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.