Quebec's Law 25 and Website Chatbots and Forms: What to Check

Quebec's Law 25 and Website Chatbots and Forms: What to Check

Law 25 modernized Quebec's private-sector privacy law, with requirements phased in from 2022 to 2024. If your website chatbot, forms or automations collect personal information from people in Quebec, it is worth checking how they line up.

Last reviewed: November 2026. This is general information, not legal advice. Quebec's Commission d'accès à l'information (CAI) publishes official guidance; confirm your obligations with your adviser. For deeper compliance work, see Canada Compliance AI.

Questions to check

1. Who is responsible? Organizations covered by the law have a person in charge of protecting personal information, by default the highest-ranking person, and their title and contact details are generally published on the website.
2. Is the privacy policy clear? It should explain in plain language what you collect through the chatbot and forms, why and how it is used.
3. Is consent clear and specific? Consent requests should be separate from other terms and easy to understand.
4. Are tracking tools off by default? Technologies that identify, locate or profile people are generally expected to be off by default, which affects how cookie banners and analytics are set up.
5. Is data going outside Quebec? Transfers outside the province, for example to an AI or chatbot provider, can require an assessment before you proceed.
6. Are automated decisions disclosed? If a decision about someone is made only by automated processing, there are disclosure obligations.
7. Do you have a breach process? Confidentiality incidents need to be recorded and, where there is a risk of serious injury, reported.

Practical steps for chatbots and forms

• Collect the minimum.
• Show a short notice in the chat and on forms, linked to your privacy policy.
• Know which providers process conversation data and where.
• Offer the chat and forms in French for Quebec visitors.
• Set retention periods and delete on schedule.

How we help

We build chatbots and forms with consent wording, minimal collection and documented data flows, and flag questions for your adviser. See AI chatbots and bilingual customer service.