Start a project

Menu

Start a project

Free tool · Quebec Law 25 and Bill 96

Loi 25 website checker

Paste your website’s address and get a pass, check or problem list in about 15 seconds. The checker reads your home page the way a first-time visitor’s browser receives it and looks for 4 visible signals: trackers that load before consent, a cookie banner, a privacy policy that names the person in charge of personal information, and a French version. It’s free and needs no sign-up.

This checks what can be seen from outside your site. It is not legal advice and not a compliance certificate. Updated

Your home page works best. Any platform: Shopify, WordPress, Wix, Squarespace and more.

Want these fixed?

Spicy Design sets up consent banners that hold tracking back, privacy policies that name the person in charge, and full French versions, on Shopify and beyond. Montréal studio, Shopify Partner since 2009.

Ask us to fix it

Four signals, each tied to a rule in Quebec law. The checker reads the HTML your server sends on the first visit, then opens the privacy policy it links to and, if needed, tries /fr.

Trackers before consent

What we look for

Analytics and ad scripts (Google Analytics 4, Google Ads, Google Tag Manager, Meta Pixel, TikTok, Pinterest, Snap, LinkedIn, Microsoft Clarity and UET, Hotjar, Klaviyo and about 15 more) that start in the page’s first HTML without waiting for consent: not marked type="text/plain", not tied to a consent tool, and not checking Shopify’s Customer Privacy API first. Shopify customer-event pixels are counted separately, because Shopify holds them until consent where a banner asks for it.

Why it matters

Section 8.1 of Quebec’s private-sector privacy act says that before you use technology that can identify, locate or profile a visitor, you must tell them and explain how to turn it on. The Commission d’accès à l’information reads this as: those functions must be off by default. Ad pixels and session recorders profile visitors.

How to fix it

Load every analytics and ad tag through your consent banner or through Shopify customer events, so nothing starts before a visitor says yes. Then test in a private window: no requests to Google, Meta or TikTok until you accept.

Official sources

Cookie consent banner

What we look for

Shopify’s own cookie banner, and about 25 consent tools: OneTrust, Cookiebot, Didomi, Axeptio, Usercentrics, CookieYes, Termly, iubenda, Osano, Pandectes, Consentmo, Enzuzo, TrustArc, Complianz and others. We also notice when a speed script delays the banner.

Why it matters

A banner is how a visitor is told about trackers and how they switch them on, which section 8.1 requires. The law doesn’t name a banner, but it’s the usual way to do it on a website.

How to fix it

On Shopify, turn on the cookie banner in Settings › Customer privacy and set its region visibility to include Quebec. Write its text in plain French and English, with Accept and Decline equally easy to click.

Official sources

Privacy policy and person in charge

What we look for

A link to a privacy policy on the page (or Shopify’s /policies/privacy-policy), that the policy opens, and that it names the person in charge of the protection of personal information, with an email address or phone number near that title.

Why it matters

Section 8.2 requires a privacy policy in clear and simple terms on your website when you collect personal information online. Section 3.1 makes the person with the highest authority in the business the person in charge by default, and requires their title and contact details on the website.

How to fix it

Add a section titled “Person in charge of the protection of personal information” with their title and a direct email address, and link the policy from your footer. Say which cookies and trackers you use and why.

Official sources

French version

What we look for

A page in French (lang="fr" or fr-CA), French alternates announced with hreflang, a link to a French version, or a French page that answers at /fr or /fr-ca.

Why it matters

Under the Charter of the French language, as amended by Bill 96, commercial publications of a business active in Quebec must be in French, and the Office québécois de la langue française says this includes websites. Another language is allowed if the French version is at least equivalent and as easy to reach.

How to fix it

Publish a complete French version: product pages, checkout, emails and policies, not only the menu. On Shopify, add French in Settings › Languages, translate with Translate & Adapt or a translator, and keep the language switcher visible.

Official sources

What this check can’t tell you

  • It isn’t legal advice and it isn’t a compliance certificate. A clean result means these 4 signals look right from outside, nothing more.
  • It reads the first HTML only. Scripts added later by a tag manager, and what happens after a visitor clicks Accept or Decline, aren’t tested.
  • It can’t see your banner’s region settings, how you store or share data, your consent records, your privacy impact assessments or your contracts.
  • It checks your home page (or the page you enter). Other pages, checkout and emails can differ.
  • Pattern matching can miss a tool or misread one. If a result looks wrong, tell us and we’ll look.

What is Loi 25 (Law 25)?

Law 25 is the Quebec law, passed in 2021, that modernized the province’s privacy rules for businesses. Its obligations came in three steps: September 22, 2022 (a person in charge of personal information), September 22, 2023 (privacy policy, rules on tracking technologies, privacy by default, penalties) and September 22, 2024 (data portability). It amends the Act respecting the protection of personal information in the private sector.

Do I need a cookie banner under Law 25?

If your site uses technology that can identify, locate or profile visitors, such as ad pixels or session recording, section 8.1 says you must inform visitors first and let them turn it on. The Commission d’accès à l’information says those functions can’t be on by default. A consent banner that holds trackers back until a visitor agrees is the usual way to meet that on a website.

Who is the person in charge of the protection of personal information?

By default it’s the person with the highest authority in the business, such as the owner or CEO. They can delegate the role in writing, in whole or in part, but stay accountable. The title and contact details of the person in charge must be published on your website.

Does Bill 96 require a French website?

For a business active in Quebec, the Office québécois de la langue française says consumers are entitled to a complete French version of its website. You can also offer English or other languages, as long as the French version is at least equivalent and as easy to reach.

What are the penalties under Law 25?

Administrative monetary penalties can reach $10 million or 2% of worldwide turnover for the previous year, whichever is higher. Penal fines can reach $25 million or 4% of worldwide turnover, and double for a repeat offence. For individuals, the amounts are lower.

Does a clean result mean my site is compliant?

No. The checker only sees 4 signals from outside your site. Law 25 also covers consent records, privacy impact assessments, incident registers, retention and contracts with suppliers, none of which a website check can see.

What does the checker keep about my site?

The address you enter is fetched by our server, not your browser. We log the site’s host name and the 4 statuses for abuse protection, and keep the report in a cache for 10 minutes so a repeat check is fast. Nothing else is stored unless you send us the report with the form.

Does it work for sites that aren’t on Shopify?

Yes. All 4 checks work on any public website. Some details are Shopify-only: customer-event pixels, Shopify’s own banner and the /policies/privacy-policy address.

Official sources

Sources last checked .