--- title: "Social Influence: Ad Settings for Quebec’s Privacy Law" description: "Social Influence lists the Google Ads and Meta settings to check under Quebec's Loi 25, from data retention to consent banners and lead forms." canonical: "https://socialinfluencebuilder.com/blog/paid-ad-settings-quebec-privacy-law/" lastmod: "2026-10-12T20:31:33+00:00" lang: "en-CA" format: "markdown" --- [Web version of this page](https://socialinfluencebuilder.com/blog/paid-ad-settings-quebec-privacy-law/) HTML version: [French Markdown version](https://socialinfluencebuilder.com/fr/blogue/reglages-publicitaires-loi-25-quebec.md) [English Markdown version](https://socialinfluencebuilder.com/blog/paid-ad-settings-quebec-privacy-law.md) # Social Influence: Ad Settings for Quebec’s Privacy Law Social Influence checks paid ad accounts for small businesses in Mascouche and Greater Montréal, and under Quebec's privacy law the settings that cause the most trouble are the defaults nobody chose. I'm Marven Salgado, the founder. Most owners never open the default settings in Google Ads or Meta, yet those defaults decide what gets collected, shared and stored before a visitor has clicked "accept" on anything. ## Social Influence: why default paid ad settings deserve a second look under Quebec's privacy law Google Ads and Meta set their defaults for a different privacy standard than Loi 25, so an untouched account can collect, share or keep personal information the business never decided to handle. Defaults feel safe, and you have a business to run, so I understand why so many accounts still look the way the platform set them up. Loi 25 amended Quebec's Act respecting the protection of personal information in the private sector, and it applies to any business that collects personal information, whatever its size or ad budget. It expects you to tell people what you collect and why when you collect it, and to get their consent before you use it for something else or pass it to someone else. Ad accounts make that hard to see. A default can keep data longer than you need it, or send it to the platform without clear consent, and no dashboard warns you. When I go through an account, I start with the data retention windows, the conversion tracking setup and the audience-sharing permissions. None of it is complicated once you know where each setting lives. ## Google Ads automation and data sharing settings a Québec business should review Google Ads can change your account and send data on your behalf in more places than most owners expect: automated recommendations, generated ad assets, conversion tags and remarketing lists. Conversion tags report when someone fills in a form or books online. Enhanced conversions go further: the tag takes details from the form, such as an email address, hashes them and sends them to Google so the conversion can be matched to a signed-in user. Someone at the business should know whether that's switched on, and the privacy policy should mention it. Remarketing lists have a membership duration that sets how long a visitor stays on the list, so set it to what your campaigns need. ### Automatically applied recommendations and AI-generated assets Auto-apply recommendations let Google add keywords, adjust bids or edit ad copy on its own, so I switch auto-apply off on the Recommendations page and approve each change by hand. Some of those changes pull in data or generate text in ways nobody chose. Decide who at the business approves changes to the account. Automatically created assets work the same way. Google can write headlines and descriptions from your landing pages, your website and your existing ads, and in some campaigns it can generate images too. Those assets come from your own content rather than your customers' personal information, so the risk is ads going live that nobody at the business approved. I go through each automated asset option in the campaign settings and leave on only the ones someone at the business has agreed to review. ## Meta pixel, conversion data and audience settings The Meta pixel reports what visitors do on your site back to Meta, so the questions are which events it sends, what personal details go with them and whether the visitor agreed first. A pixel that loads with the page sends a page view for every visitor. Automatic advanced matching adds more: it picks up details someone types into a form on your site, such as an email address or phone number, hashes them and sends them to Meta to match the visit to a profile. That data feeds your conversion reporting and the website audiences you can target later. When I set up [Meta ads](/systems/meta-ads/) for a business, I check which events are active, whether advanced matching is on, how long website audiences keep people, and whether the consent banner holds the pixel back until the visitor chooses. ### Instant lead forms and the moment of collection An instant form collects personal information the moment someone taps submit, inside Facebook or Instagram, so the notice has to sit in the form itself. The person never reaches your website, and Meta pre-fills their name, email and phone number from their profile, so you lose the usual chance to show a privacy notice on your own page. Before any lead campaign goes live, I go through four parts of the form. The privacy policy link has to point to the business's own policy (Meta asks for one), and it should be easy to find. The custom disclaimer is where you say, in plain words, why you're collecting the information and what happens next; the default text says very little. If you can say how long you keep leads, put that in the intro or the disclaimer, since people trust a form more when they know. Last come the pre-filled fields: keep only the ones you need, and check that the person can see and correct what Meta filled in. ## Consent banners, tags and what actually fires before a choice A consent banner does its job only when it stops ad and analytics tags from loading until the visitor chooses, and testing it is the only way to know. Most owners install a banner plugin and move on. Loi 25 expects technology that can identify, locate or profile someone to stay off until that person turns it on, and building audiences from site visits is what ad pixels are for. I open the browser's network tab and load the site before clicking anything on the banner. If pixels fire before that first click, the banner isn't blocking them, however compliant it looks. I check: - which tags load as soon as the page opens - whether "accept all" is the only easy button - whether refusing still lets analytics or ad pixels through - whether the banner blocks scripts or only covers the page - how the visitor's choice gets passed to the Google and Meta tags GA4 belongs behind the same banner as your Google Ads and Meta tags, and your privacy policy should name all of them. ## Customer lists, call tracking and the privacy policy that has to match Uploading a customer list to Google or Meta shares those emails and phone numbers with an ad platform, so you need the customers' consent for that use before the file leaves your computer. Once a list is uploaded, it's part of your privacy obligations whether anyone planned for that or not. Before I upload anything for a business, I look at how those contacts were collected and what they were told at the time. If consent to use them for advertising isn't clear, I skip the upload. Call tracking needs the same attention. If you use [call tracking](/services/call-conversion-tracking/) numbers that record calls, callers should hear that the call may be recorded, the website should say so, and the privacy policy should mention it too. Account access belongs in this review as well. Every agency, freelancer or former employee with access to your Google Ads account, your Meta assets or your tag manager can see or move this data. Your business stays responsible for that personal information even when a provider handles it, which is why the arrangement needs a written contract. Remove anyone who no longer needs access. Then compare the privacy policy, the banner and the tools running on the site. All three should describe the same thing, and a mismatch is the first problem to fix. Read your policy the way a customer would. For comparison, the Social Influence [privacy policy](/privacy-policy/) is public. ## A quarterly privacy review checklist for paid ads Every three months I run the same privacy check on each active ad account, and you can run it on your own without hiring anyone. 1. Open the data settings in each platform and confirm that auto-apply, automatically created assets, enhanced conversions, advanced matching and audience durations are still set the way you decided. 2. Look through uploaded customer lists and remove any old file with unclear consent. 3. Review who has access to the ad accounts and the tag manager. 4. Test the consent banner in a private browser window to confirm it still blocks tracking scripts until someone agrees. 5. Reread the privacy policy and check that it still matches what the ads and forms collect. 6. Call your tracking numbers and confirm the recording notice still plays. The routine catches problems while they're still small. Bring in a lawyer, or the person in charge of protecting personal information at your business, before you use customer data for a new purpose, when you're not sure a list has consent, or when something has already gone wrong. Under Loi 25 that person is, by default, whoever holds the highest authority in the business (often the owner), and their title and contact details belong on your website. None of this is legal advice: it's the review I run in ad accounts, and a lawyer can tell you how Loi 25 applies to your business. ## Go further - **Service:** [Meta ads for Facebook and Instagram, the system behind every campaign](https://socialinfluencebuilder.com/systems/meta-ads/)