Quebec's Law 25 and Your Marketing: A Plain-Language Guide

If you email, text, or run ads to customers in Québec, Law 25 changed the rules you operate under. It governs how a business collects, uses, stores, and shares personal information — and marketing is one of the places it bites hardest, because marketing runs on exactly the customer data the law protects.

What Law 25 actually requires for marketing

Law 25 — formally the modernization of Québec’s private-sector privacy legislation — requires that you collect personal information for a clear purpose, get informed consent for that purpose, and use the data only for what the person agreed to. For marketing, that means you can’t quietly harvest an email address given for one reason (booking a job, downloading a guide) and repurpose it for a newsletter the customer never opted into.

The practical test is simple: could the customer have reasonably known, at the moment they gave you their details, that you’d use them this way? If not, you don’t have valid consent.

Consent isn’t a pre-checked box

Valid consent under Law 25 has to be clear, free, and informed — and given for specific purposes. A pre-checked “yes, send me offers” box, or burying marketing consent inside a wall of terms, doesn’t meet that bar. The stronger approach is an explicit, separate opt-in that names what the person is agreeing to.

Good marketing consent looks like:

• A clearly labelled checkbox (unchecked by default) to receive emails or texts.
• Plain language about what you’ll send and how often.
• Separation of purposes — signing up for a quote is not the same as signing up for promotions.
• An easy, always-available way to withdraw consent later.

This is the same discipline that makes a lead system trustworthy in the first place. When you build CRM automation basics around a single intake point, it becomes far easier to record what each contact consented to and when — which is exactly what Law 25 expects you to be able to show.

Email and SMS: what every message needs

Every commercial email and text you send to a Québec customer should carry three things: a clear identification of who’s sending it, a purpose the customer agreed to, and a working, one-click way to opt out. Honour unsubscribe requests promptly — a customer who opts out and keeps getting messages is both a compliance problem and a reputation problem.

Automation makes this easier, not harder, when it’s set up right. An AI-powered lead response system can capture consent at the point of contact, tag the source and purpose, and stop messaging anyone who withdraws — automatically, without someone manually scrubbing a list. The alternative, chasing consent records across spreadsheets and inboxes, is where most small businesses get exposed.

Data handling: keep only what you need, protect what you keep

Law 25 also governs what happens to data after you collect it. Two principles matter most for marketing: collect only what you actually need, and keep it only as long as you need it. A furnace-repair company doesn’t need a customer’s date of birth to send a maintenance reminder. Every extra field you store is extra risk if there’s ever a breach.

You’re also expected to protect that data with reasonable security, and to have someone responsible for privacy in your business. If personal information is compromised in a way that poses a risk of serious harm, Law 25 requires you to report it. Holding a tidy, well-organized contact database — the foundation of good long-term lead retention — is both better marketing and lower risk.

Cookies, tracking, and your website

If your website uses analytics, ad pixels, or other tracking that collects personal information, visitors should be told, in plain language, what’s being collected and why. For non-essential tracking, the safer posture is to obtain consent before it runs. A clear privacy notice and an honest cookie banner aren’t just legal hygiene — they’re the first thing a cautious customer sees, and getting them right signals that you handle data carefully.

Why compliance is a growth advantage, not a tax

The businesses that treat Law 25 as pure overhead miss the point. Clear consent and honest data handling produce cleaner lists, more engaged subscribers, and fewer complaints. People who know exactly what they signed up for open more and unsubscribe less. In a bilingual market where customers are increasingly privacy-aware, “we only contact you the way you agreed to” is a genuine differentiator — one that quietly compounds trust with every message you send.

Getting your consent, data handling, and follow-up systems right is exactly the kind of operational foundation our Growth Score™ engine looks at — the same infrastructure that powers compliant, effective lead automation is what keeps your marketing both legal and performing.