Law 25 checklist for WordPress

Verify point by point that your WordPress site meets the obligations of Quebec's Law 25: cookie banner, privacy policy, designated privacy officer, incident register. The content is freely available here — the full PDF is sent by email.

Download the PDF View the content

What this resource contains

The checklist covers the compliance points most often overlooked on a WordPress site:

  • Privacy policy compliant with section 9 of Law 25
  • Designation of the person in charge of the protection of personal information
  • Inventory of the personal information collected
  • Consent mechanism for non-essential cookies
  • Service provider register
  • Procedure for access and correction requests
  • Notification procedure in the event of a confidentiality incident
  • Staff training on Law 25
  • Reminder of the dates the provisions came into force

The cookie banner: what Law 25 requires

Law 25 requires clear consent before setting any non-essential cookie — analytics, advertising, social media pixels. Concretely, your cookie banner must: block these cookies until the visitor has consented, make refusing as easy as accepting, allow consent to be withdrawn at any time, and keep a record of the consents given.

Many banners installed on Quebec WordPress sites display a message but block nothing: the cookies fire before the click even happens. It's a frequent, easy-to-verify non-compliance — our checklist shows you how to test yours in two minutes.

Who this resource is for

This resource is for SMB general managers, IT directors and communications managers who want to make sure their WordPress site doesn't expose them to a risk of non-compliance.

It's also useful for nonprofits and public bodies that handle personal information and must demonstrate their diligence.

Why this resource exists

We've been guiding Quebec SMBs on Law 25 compliance since it came into force — from Drummondville, for organizations across Quebec. Rather than keeping that knowledge to ourselves, we share it: an informed organization makes better decisions, whether it works with us or not.

Compliance intersects with several of our services: our maintenance monitors the technical points continuously, ourCanadian hosting simplifies the data transfer question, and our free analysis includes compliance checks.

Download the checklist as a PDF

Leave your email and the document downloads immediately.

Need help with Law 25 compliance?

We can audit your site and put in place what's missing, on the maintenance side as much as the hosting side.

Let's talk about your project
See the maintenance service

Questions fréquentes

Is my WordPress site covered by Law 25?

Yes, as soon as it collects any personal information: a contact form, a newsletter, Google Analytics or an advertising pixel is enough. The law applies to any business operating in Quebec, regardless of size.

Is a cookie banner enough to be compliant?

No. The banner covers consent to cookies, but the law also requires an up-to-date privacy policy, a designated privacy officer, an incident register and access and withdrawal procedures. The checklist covers all of it.

What are the risks of non-compliance?

The Commission d'accès à l'information (Quebec's privacy regulator) can impose administrative sanctions and, in serious cases, significant fines. In practice, the most immediate risk for an SMB remains a complaint from a client or competitor — and the loss of trust that comes with it.

Where must my data be hosted?

The law doesn't prohibit hosting outside Quebec, but any transfer outside the province requires a privacy impact assessment (PIA). Canadian hosting, like what we offer, considerably simplifies the process.