Quebec’s Law 25 and cookie consent on Shopify: what to set up in 2026

What changed, and when

Law 25 amended Quebec’s Act respecting the protection of personal information in the private sector in three stages. The dates below come from the Act and the Commission d’accès à l’information (CAI), Quebec’s privacy regulator.

Does it apply to a store outside Quebec?

The CAI says an organization located outside Quebec is subject to the private-sector Act when it handles personal information in the course of business activities in Quebec. A store in Ontario or British Columbia that sells and ships to Quebec customers should plan on that basis.

Federal law applies too. PIPEDA governs personal information that crosses provincial borders, and Quebec’s exemption from it covers only collection, use and disclosure within Quebec. Its consent standard asks whether people would understand the nature, purpose and consequences of what they agree to.

Federal reform isn’t law yet. Bill C-27 died when Parliament was prorogued on January 6, 2025. Its successor, Bill C-36, was introduced on June 15, 2026 and is at second reading, so PIPEDA continues to apply.

Name the person in charge

Every business needs a person in charge of protecting personal information. By default it is the person with the highest authority, usually the owner or chief executive, who can delegate the role in writing.

Publish that person’s title and contact details on your website. The Act asks for the title and contact information rather than a name, so a role and a dedicated address such as privacy@ work well and survive staff changes. Nothing has to be filed with the CAI.

A privacy policy people can read

When you collect personal information through technological means, as every online store does, you must publish a confidentiality policy in clear and simple terms and give notice when it changes. The CAI expects it to explain what you collect and why, which third parties receive it, how it is protected, how cookies are used, what rights people have and whether information may leave Quebec. Its own example of a third party worth naming is an ordering platform, which is the role Shopify plays.

Shopify can produce a starting point. Settings > Customer privacy > Privacy policy offers an automated policy in 32 languages, and Settings > Policies offers an English template. Shopify’s documented regional variations cover the United States and the EEA, UK and Switzerland, not Canada or Quebec, so add the Quebec-specific parts yourself: the person in charge, the services that receive data and how visitors control tracking.

Tracking that profiles stays off until it is turned on

Section 8.1 of the Act covers technology that can identify, locate or profile a person, where profiling means assessing their preferences, interests or behaviour. Before using it, you must inform the person and tell them how to activate those functions.

The CAI reads this as off by default: the visitor must take a positive step to turn profiling on. Its guidance gives the example of a website whose cookies infer readers’ interests, which shows an overlay on the first visit and explains how to activate them. Ad pixels, retargeting and personalised recommendations fit that description.

Refusing must be as easy as accepting, and the CAI warns that visually favouring the accept option can make consent invalid. In findings published in September 2025, the CAI concluded that TikTok had breached the Act, in part because profiling was not off by default and a pop-up linking to its privacy policy did not properly inform users.

Analytics is a grey zone. The CAI hasn’t said whether plain analytics counts as profiling, and its guidance doesn’t have the force of law. Holding analytics until consent is the cautious choice; expect lower reported traffic from Quebec as a result.

Set Shopify’s cookie banner for Quebec

Shopify’s customer privacy settings, introduced in January 2024, include a built-in cookie banner. With automated settings, it appears in the UK and the EEA where you have active markets. Since May 21, 2025, you can also choose individual Canadian provinces, so Quebec has to be added by hand. Until it is, Shopify treats Quebec like any region with no consent requirement and allows tracking by default.

• Publish a privacy policy first; the banner requires one.
• Go to Settings > Customer privacy > Cookie banner and edit the regions.
• Select Quebec, confirm with Done, then save.
• Check that accept and decline carry equal weight, and edit the wording into plain language.
• Keep the Cookie preferences link in your footer so visitors can change their choice later.
• Test from a Quebec location, or with a VPN, before relying on it.

What the banner doesn’t cover

Shopify’s banner governs Shopify’s own cookies and pixels. Scripts added to your theme, or tags loaded outside Shopify’s pixel system, need their own consent handling: a consent app that works with Shopify’s Customer Privacy API, or code that checks the visitor’s choice before loading anything.

Google Consent Mode passes the visitor’s choice to Google’s tags; it relays consent rather than collecting it. Configure Shopify’s customer privacy settings first so the choice reaches Google, and add the consent code by hand to any custom pixel that loads Google tags.

Data that leaves Quebec

Before you communicate personal information outside Quebec, or have someone outside Quebec collect or keep it for you, section 17 requires a privacy impact assessment, adequate protection and a written agreement. The CAI applies this to other provinces as well, and its assessment guide gives cloud storage outside Quebec as an example.

Shopify stores customer data across several Google Cloud regions; the customer data hosting location setting in your admin shows the current position. Whether section 17 applies to your setup, and what an assessment must cover, is a question for counsel. If it applies, include Shopify, your email platform and every app that stores customer data.

Incidents and penalties

If personal information is lost, stolen or accessed without authorization, take steps to limit the harm. Where there is a risk of serious injury, notify the CAI and the people affected promptly, and record every incident in a register you keep for at least five years. Under PIPEDA, breaches that pose a real risk of significant harm are also reported to the Privacy Commissioner of Canada.

Administrative monetary penalties reach the greater of $10 million or 2% of worldwide turnover, and penal fines the greater of $25 million or 4%, doubled for a repeat offence. Courts can also award punitive damages of at least $1,000 for an intentional breach or gross fault.

Enforcement so far has focused on large companies, including an order on Metro’s biometric database in February 2025 and the TikTok and OpenAI findings. We found no published monetary penalty against a named business. In its five-year report of June 2026, the CAI asked for wider penalty powers, a ban on dark patterns and recognition of browser-level consent signals.

This article is general information, not legal advice. For your own obligations, especially transfers outside Quebec and how you treat analytics, ask a privacy lawyer.

A checklist for stores selling into Quebec

• Publish the title and contact details of your person in charge of personal information.
• Rewrite your privacy policy in plain language: what you collect, why, who receives it, cookies, rights and transfers outside Quebec.
• Add Quebec to Shopify’s cookie banner regions, with accept and decline equally easy.
• List every tag on your store and record which consent category controls it.
• Move theme scripts behind the Customer Privacy API or a consent app that uses it.
• Ask counsel whether your vendors need a privacy impact assessment under section 17.
• Set up an incident register and a response plan before you need them.