Guide · Quebec privacy
Quebec Law 25 on Shopify: what a compliant consent banner actually requires
Most Shopify stores selling to Quebec run a generic cookie banner that quietly fails Law 25 — pixels fire before anyone clicks, consent is implied rather than express, and it's English-only. Law 25 holds a different, stricter bar than the GDPR-style banners most apps ship. Here's what it actually requires, how to check your store, and how to close the gap. (This is a compliance aid, not legal advice.)
What Law 25 requires of a Shopify store
Four requirements do most of the work, and generic banners miss the first two:
- Confidentiality by default. Non-essential tracking technologies (analytics, ad pixels) must not activate until the visitor expressly consents. A banner that lets Meta or GA fire on page load is non-compliant, no matter what it says.
- Express, granular consent. Consent must be a clear opt-in — not implied by continued browsing — and separable by purpose (analytics vs. marketing vs. functional).
- A consent record. You should be able to show who consented, when, and to what — the evidence a regulator (the CAI) expects if they ask.
- French, at least equal. For Quebec visitors the banner must be available in French and no less prominent than English (the Bill 96 overlap).
How a typical Shopify setup falls short
- Pixels fire on load. Most stores add Meta Pixel / GA4 directly or via an app, and they run before any consent — the single most common Law 25 gap.
- The banner is opt-out or implied. Generic GDPR banners often default to "accept," or treat scrolling as consent — neither is express opt-in.
- No consent log. If asked to prove consent, there's nothing to export.
- English-only. A common oversight that's both a consent and a language-law problem in Quebec.
How to check your store
- Open your storefront in a private window with the browser network tab recording. Before you touch the banner, look for requests to facebook.com, google-analytics, googletagmanager, TikTok, etc. If they fire, tracking is running without consent.
- Check the banner itself: is it opt-in (nothing tracked until "accept"), and can a visitor refuse as easily as accept?
- Confirm a French version shows for Quebec visitors, at least equal to English.
- Ask whether you could produce a consent record if the CAI requested one.
Getting it right without a privacy project
Compliance here isn't a policy document — it's a banner that actually blocks tracking until consent, in the right language, with a record you can export. That's a technical setup, and it's what a purpose-built Quebec consent app handles.
That's what MapleConsent does. It shows a geo-targeted, express opt-in banner (strict for Quebec and the EU), holds non-essential pixels until the visitor consents via Consent Mode v2, renders bilingual French/English first-class, and keeps a consent record you can export for a CAI inquiry. It's built specifically for Law 25 and PIPEDA — not a global cookie banner with Canada bolted on.
Frequently asked questions
Does Quebec Law 25 apply to my Shopify store?
If you collect personal information from people in Quebec — which includes almost any store that ships there or runs analytics/ad pixels on Quebec visitors — Law 25 applies, regardless of where your business is based. It's tied to whose data you handle, not where you're located.
What's the difference between Law 25 consent and a GDPR-style cookie banner?
The key difference is 'confidentiality by default' and express consent. Under Law 25, non-essential tracking technologies must not activate until the visitor expressly opts in — an opt-out or implied-consent banner (common on Shopify) doesn't meet the bar. Many generic banners still let pixels fire on page load, which is exactly what Law 25 prohibits.
Do I need a French consent banner for Quebec visitors?
Yes. Quebec's language rules (Bill 96 / the Charter of the French Language) require French to be available and at least equal for Quebec-facing commercial experiences — the consent banner included. An English-only banner is both a language-law and a meaningful-consent problem for Quebec residents.
What are the penalties under Law 25?
Law 25 carries administrative monetary penalties and penal fines that scale with company size — the penal maximum reaches $25 million or 4% of worldwide turnover, whichever is higher — and it grants individuals a private right of action. The practical exposure for a typical SMB is smaller, but the regime is modelled on GDPR-level seriousness. (This is general information, not legal advice.)