Québec's Law 25
Law 25 modernised Québec's private-sector privacy law, with duties phased in between 2022 and 2024. It requires a designated person in charge of privacy, privacy impact assessments, incident reporting, consent that is clear and separate, and tracking technologies that are off by default.
In one line, for a 12-year-old
Law 25 is Québec's privacy law that makes companies protect your personal information and ask clearly before tracking you.
An example
A Québec online store must tell customers when a decision about them is made solely by an automated system and, on request, explain the main factors.
Why it matters to people
Law 25 is one of the strongest privacy laws in North America. Its rules on automated decisions and default privacy settings directly shape how AI can be used in Québec. The Commission d'accès à l'information enforces it.