Quebec's Law 25: what your website must show, and how to check it

Per the CAI, publishing a privacy policy is mandatory if you collect personal information using a technology, whichever it is. An online form that asks for a name and an email address is one.

The policy must be published on your website and written in simple, clear terms. If your site uses cookies, the policy must say so.

The person with the highest authority in the business is, by default, in charge of protecting personal information. They can delegate that role in writing, in whole or in part.

The CAI asks that this person's title and contact details be published on the business's website.

At the time of collection, the CAI asks you to tell the person:

• athe purposes for which the information is collected;
• bthe means by which it is collected;
• ctheir rights of access and correction;
• dtheir right to withdraw consent to the communication or use of the information.

When a technology can identify a person, locate them or profile them, the CAI says the person must be told from the start, along with the means offered to turn those functions on. They cannot be on by default: the person must be able to turn them on themselves, voluntarily.

The CAI also asks that default privacy settings give the highest level of confidentiality, and specifies that a cookie's privacy settings are not covered by that requirement.

These pages do not list which tools are covered. Our practice, to confirm with your legal advisor: treat any analytics or advertising tool that follows a visitor as covered, and load it only after a choice where refusing is as easy as accepting.

Our free checker, Website Passport, lists the known tools your site starts on load, before the visitor makes any choice.

For the rest, open your site in a private browsing window, as a new visitor would, and look for:

• awhether you are offered a choice before any analytics or advertising tool starts, and whether refusing takes as many clicks as accepting;
• bwhether a link to the privacy policy is visible on every page, usually in the footer;
• cwhether the title and contact details of the person in charge appear there;
• dwhether each form says what the requested information will be used for;
• ewhether the policy mentions the cookies and tools the site really uses.