By Marc Alexander

Quebec's Law 25 made the province's rules on tracking some of the strictest in North America. Tracking that can identify, locate or profile visitors has to stay off until they turn it on, which is closer to European consent than to the opt-out model in the rest of Canada and the US.

What the law says.

Law 25 updated Quebec's private-sector privacy law in stages between 2022 and 2024. The part that matters most for analytics, section 8.1, has applied since September 2023.

It says that a business collecting personal information with technology that can identify, locate or profile someone must tell them first, and tell them how to turn those functions on. In practice, that means the functions start switched off.

Profiling, in the law's terms, means using personal information to assess things such as a person's behaviour, interests or preferences. That describes most advertising pixels and audience building, and GA4 when its advertising features are on.

The regulator is Quebec's access to information commission, the Commission d'accès à l'information.

What it means for GA4 and ad tags.

  • Advertising tags wait. Meta, Google Ads remarketing, TikTok and similar pixels shouldn't fire for Quebec visitors until they agree.
  • GA4 waits too, in most setups. GA4 uses cookies and identifiers to recognise returning visitors, and with Google signals or ad personalisation on, it feeds advertising. The cautious choice is to treat it the same way.
  • The banner needs a real choice. Accepting and refusing should be equally easy, with clear categories, not a notice that tracking has already started.
  • French is expected. The banner and the privacy notice should be available in French for Quebec visitors.

Setting it up in Google Tag Manager.

  1. Set Consent Mode defaults by region. Consent Mode accepts province codes, so Quebec can default to denied with region: ["CA-QC"] while the rest of Canada follows its own rules.
  2. Match the banner to the default. Quebec visitors see an opt-in banner. Most consent platforms can switch version by region.
  3. Check every tag's consent setting, including tags added by agencies and apps, not only the GA4 tag.
  4. Decide what happens when location is unclear. Location by IP address is approximate. Many Canadian businesses use the Quebec rules for the whole country, which removes the guesswork.

The same approach works for European visitors. See consent by region in one GTM container.

What to check.

  1. Visit your site from Quebec, or with a Quebec location in a testing tool, in a fresh browser.
  2. Before choosing anything, check the network requests. No advertising pixel should load, and GA4 should send nothing, or only cookieless pings if you use advanced Consent Mode.
  3. Refuse, reload and browse a few pages. Nothing should start.
  4. Accept, and check that tags start and Consent Mode updates to granted.
  5. Repeat in French.

The guide to testing Consent Mode v2 has the step-by-step checks.

This article explains how tracking works, not legal advice. Marc Alexander, a GTM consultant, sets up consent by region for Canadian businesses, and the GA4 mini audit checks what your tags do before and after each choice.