Why Quebec gets its own detection
The engine tests country and region together, and CA + QC is one of only two country-plus-region pairs it recognises (the other is US + CA). The reason is substantive. Law 25 brought in obligations that the federal PIPEDA regime does not impose, on a phased schedule running from September 2022 through September 2024.
The provision that matters for a website is the privacy-by-default rule that came into force in September 2023: where a technology allows a person to be identified, located or profiled, the enterprise must inform them of the use of that technology and of the means available to deactivate it, and the functions allowing identification, location or profiling must be deactivated by default.
That is an opt-in requirement written for exactly the technologies a consent platform manages. Law 25 also requires consent to be manifest, free and enlightened, given for specific purposes, and requested separately from other information.
What each region profile resolves to
| Region profile | Resolved model | What the visitor sees |
|---|---|---|
| Regional defaults | opt-in | Nothing optional loads until a choice is made |
| Global strict | opt-in | Nothing optional loads until a choice is made, everywhere |
| Global balanced | opt-in | Nothing optional loads until a choice is made |
| EU and UK opt-in | none | No banner |
A Quebec visitor is stricter than the rest of Canada by design
Both CA-QC and the rest of Canada resolve to opt-in in the engine, and they are recorded as different locations: `CA-QC` against a bare `CA`. If you later decide to run implied consent federally and express consent in Quebec, the distinction is already visible in the records and in the region rule you would add.
Configuring for Quebec
- Serve French. Quebec’s language legislation is a separate obligation from Law 25, and a French banner is the practical baseline; add fr or fr-CA to the property translations.
- Name the technologies. The duty is to inform about the use of identifying, locating or profiling technology, which is easier to meet with a published cookie declaration generated from a verified scan than with prose.
- Keep deactivation obvious. Provide an easy-to-find route back to the preference centre after the first decision, not only at it.
- Record the location. A Quebec decision is stored as `CA-QC` and an Ontario one as `CA-ON`, so the two are distinguishable after the fact without re-running any geolocation.
Penalties are severe on paper: administrative monetary penalties up to CAD $10 million or 2% of worldwide turnover, and penal fines up to CAD $25 million or 4%, whichever is greater. Law 25 also created a private right of action; the statutory minimum of CAD $1,000 applies where the infringement is intentional or results from gross fault, not to every unlawful infringement automatically.
This is a product reference, not legal advice
It describes how StrongPrivacy behaves and summarises published law so you can configure the product deliberately. Whether a particular configuration satisfies your obligations is a question for your own counsel, who knows your data flows and your risk position.
Common questions
Does Law 25 apply to a business outside Quebec?
It can. Application depends on whether the enterprise and processing have the required connection to Quebec; server location alone is not the test. Marketing to Quebec residents is a reason to perform a scope analysis, not a conclusive jurisdiction test by itself.
Is a cookie banner enough to satisfy the privacy-by-default rule?
Only if the technologies are genuinely deactivated until the visitor activates them. A banner that presents choices while the pixels have already fired is the failure mode the rule was written against. An opt-in model in the engine means no loader is created before the category is granted, which is the behaviour the rule describes.
How is Quebec different from the rest of Canada here?
PIPEDA works on meaningful consent that may be implied for non-sensitive purposes; Law 25 adds an explicit default-off duty for identification, location and profiling technology, plus separate transparency and de-indexing rights. The engine detects them as QC_LAW25 and PIPEDA respectively.
Sources and verification
Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.
Checked
See what your own site is loading
A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.