--- title: "Law 25, September 2023 Stage: Consent and Advertising Tags" description: "Since September 22, 2023, the second stage of Québec's Law 25 applies to businesses across the province. If your site runs tags for Google Ads, the Meta pixel, or Google Analytics, this stage changes how those tools have to be presented to visitors before any information is collected. Here is what actually changed, and how ... Read more" canonical: "https://socialinfluencebuilder.com/en/blog/law-25-consent-advertising-tags/" lastmod: "2023-09-28T15:47:00+00:00" lang: "en-CA" format: "markdown" --- HTML version: # Law 25, September 2023 Stage: Consent and Advertising Tags Since September 22, 2023, the second stage of Québec's Law 25 applies to businesses across the province. If your site runs tags for Google Ads, the Meta pixel, or Google Analytics, this stage changes how those tools have to be presented to visitors before any information is collected. Here is what actually changed, and how we reconfigure advertising tags on client sites. ## What changed on September 22, 2023? September 22, 2023 marks the second of three stages under Law 25, the law that modernized private-sector privacy rules in Québec. The first stage, in force since September 2022, required businesses to name a privacy officer and keep an incident register. The third stage, due in September 2024, will cover data portability. This second stage tightens the rules around consent. Consent now has to be requested separately from other terms of use, written in plain language, and tied to a specific purpose. A pre-checked box, or consent buried inside a long privacy policy, is no longer good enough. It also adds a less familiar obligation that applies directly to websites: visitors have to be told, before any collection happens, when a technology identifies, locates, or profiles them, along with the means to turn that technology off. ## Who does this stage of the law apply to? Law 25 applies to any private business that collects personal information in Québec, with no exemption based on size or revenue. A single-page site that installs the Meta pixel for remarketing is covered the same way a large company is. Company size changes how much work compliance takes, not whether the obligation applies. ## Which advertising tags does this cover? Any tag that reads a cookie or a device identifier to identify, locate, or profile a visitor falls under this rule. On most Québec small-business sites, that includes the Google Ads remarketing tag, the Meta pixel, the LinkedIn Insight tag, Google Analytics, and heatmap or session-recording tools. Cookies that are strictly necessary for the site to function, such as the ones that keep a shopping cart active or protect a form from bots, are not the same problem: they are not used to identify, locate, or profile a visitor for advertising purposes. A contact form that sends a submission straight to an inbox, with no third-party cookie involved, is not covered the same way. The line is drawn by the technology used, not by the site's intent. ## What does the law expect from banner wording? Consent has to be clear, freely given, and tied to a specific purpose, which rules out generic lines like "this site uses cookies to improve your experience." A compliant banner names the categories of collection, explains what each one is for, and separates what is necessary from what is not. We also avoid designs that make the decline button smaller or harder to notice than the accept button. Nothing in the law bans a particular design, but that kind of visual imbalance works against the idea of consent given freely. A line like "by continuing to browse this site, you accept our use of cookies" does not meet the standard either, since browsing is not an affirmative choice and the sentence does not separate the categories being collected. The visitor still needs a clear action to take, and a clear way to say no. ## How do you get valid consent before tags load? Consent has to come before collection. In our reading of the consent and privacy-by-default provisions (sections 8.1 and 9.1 of Quebec's private sector privacy law), that means advertising and measurement tags should not fire before the visitor makes a choice. A banner with an "Accept" button while Google Analytics is already running in the background does not meet that requirement, even if the button looks clear. In our practice, valid consent means all of the following: tags are blocked by default when the page loads; categories are shown separately (necessary, audience measurement, advertising) instead of bundled into one button; declining is as easy as accepting; and the visitor's choice is logged with a date, so it can be shown if it is ever questioned. ## What about tags already running on an existing site? Start with an audit, not a blind reconfiguration. A tag manager such as Google Tag Manager shows the full list of what actually loads on a site, and that list is usually longer than an owner expects: a tool left over from a previous vendor, a WordPress plugin that ships its own analytics, or a test tag nobody ever removed. Once that list exists, each tag gets sorted into a category and tied to the matching consent state in the tag manager. Anything still unsorted stays blocked by default until it gets reviewed. The site's privacy policy then needs an update naming the categories in use and how to turn each one off, in plain language. After that setup goes live, we check the browser's developer tools to confirm that no request to Google Analytics, Meta, or Google Ads goes out before the visitor clicks anything. That is the only way to confirm the blocking actually works, rather than trusting what the tag manager's interface shows. ## How do we set this up on client sites? We use three categories on the sites we configure: necessary (the site's basic functions, never optional), audience measurement (Google Analytics and similar tools), and advertising (the Google Ads tag, the Meta pixel, LinkedIn). Visitors can accept or decline each category on its own, and the choice stays editable at any time through a link in the footer. For [our call and conversion tracking service](/en/services/call-conversion-tracking/), this adds a step: the tag that records a conversion now has to wait for consent before it activates. Call and form tracking is set up to work correctly whether a visitor consents or declines, without breaking the rest of the site. We also test what happens when a visitor comes back to the site after making a choice. A banner that reappears on every visit, or that resets itself after a browser update, creates confusion and extra clicks that were never necessary in the first place. The consent record should hold until the visitor changes it. ## What stays measurable after this change? Visitors who decline the measurement and advertising categories stop generating data in those tools, which shrinks the amount of raw data available. That is not a small detail: on a lower-traffic site, a high decline rate can make some reports unreliable. What stays countable, in our experience, is call and form tracking set up directly on the site instead of through a third-party tag. Those records stay countable because they are the business's own records, and they still have to be covered by the privacy policy and the consent categories where a cookie or identifier is used, for instance when number swapping attributes a call to its ad source. That is one reason we favour tracking a [conversion](/en/glossary/#conversion) at the source rather than relying only on an ad platform to count it. New tags added later, by a marketing team testing a different ad platform or a plugin update that ships its own tracker, need the same sorting before they go live. A quick recurring check of the tag manager keeps a compliant setup from turning into next year's audit. If your site is still loading advertising tags before a visitor makes a choice, the correction starts inside the tag manager. We can take a look if you want a second opinion on your current setup. This is a description of a general setup practice, not legal advice: the exact obligations Law 25 places on your organization should be confirmed by a privacy law professional before you put any of this in place. *Drafted with AI assistance, checked and published by [Marven Salgado](/en/about/marven-salgado/).* ## Go further - **Service:** [Call and Conversion Tracking for Grand Montreal SMBs](https://socialinfluencebuilder.com/en/services/call-conversion-tracking/) - **Case study:** [Dre Dina Farag, DF Médico-Esthétique](https://socialinfluencebuilder.com/en/case-studies/dre-dina-farag/) - **Glossary:** [Digital marketing glossary: Conversion](https://socialinfluencebuilder.com/en/glossary/#conversion)