Quebec’s Law 25 and your ad tracking: what the media buyer needs to know

If you sell to anyone in Quebec, your ad tracking is now governed by one of the strictest privacy laws in North America, and most of the advice about it is written by law firms for compliance officers. This is the version for the person who runs the Google Ads and Meta accounts.

What Law 25 actually requires of your tracking

Quebec’s privacy law, usually called Law 25, took full effect in stages between 2022 and 2024. The part that matters for paid media is this: any technology that can identify, locate or profile a visitor must be off by default and switched on only after the person agrees. Cookies, pixels, GA4 identifiers, Meta’s browser ID, all of it. Opt-out banners, the kind with a single “OK” button and tracking already running underneath, don’t meet the standard. The regulator can fine up to $25 million or 4% of worldwide turnover, and while enforcement against small advertisers has been light so far, the law applies to anyone collecting data from Quebec residents, not just companies based there.

In practice, Law 25 means a Quebec visitor who hasn’t clicked “accept” is invisible to your pixel. Nearly a quarter of Canada’s population lives in Quebec, so on a national account that’s a real share of your data, gone unless you’ve planned for it.

The three mistakes I see on Canadian accounts

One banner for the whole country. The easy route is to apply Quebec’s opt-in standard everywhere, and for most businesses that’s the right call: one setup, one legal basis, no geofencing to maintain. The wrong route is the opposite: a loose opt-out banner nationwide and a hope that Quebec visitors don’t notice. If you do want different behaviour by province, the banner needs geolocation, and your consent logic needs to handle Quebec traffic that arrives through a VPN or a Toronto IP.

Consent mode set to basic. With Quebec on opt-in, a meaningful share of visitors will decline. In Google’s basic consent mode, every one of them vanishes from Google Ads conversion data. Advanced consent mode sends cookieless pings that let Google model the conversions it can’t observe. I’ve written about why the green badge in Tag Manager isn’t enough; on a Canadian account it’s the difference between losing a fifth of your signal and losing a few percent.

Meta forgotten. Consent mode is Google’s framework. The Meta pixel and the Conversions API need their own consent handling, and most banner plugins handle Google properly and fire Meta regardless. Check it with the Meta Pixel Helper on a declined session; if the pixel still fires, you’re non-compliant in Quebec and you didn’t know.

What a compliant setup looks like

A consent management platform with opt-in by default, in French for Quebec visitors (the law also expects that). Google consent mode v2 in advanced mode, so declined visitors still contribute modeled conversions. Meta CAPI routed through a server container that respects the consent state, so nothing leaves the server for a declined visitor. And a privacy policy that says, in plain language, what you collect and who you send it to. Law 25 also requires a privacy impact assessment before sending personal data outside Quebec, which, for most ad platforms, you are.

What it costs, and what it saves

A proper setup is a few days of work and a consent platform subscription. Against that, the alternative is conversion data that silently overstates your Ontario performance and understates Quebec, which means budget drifting away from a quarter of the country for no reason the dashboard will ever show you. That’s the real cost of getting consent wrong: not the fine, which may never come, but the quiet mis-allocation of every month’s spend.