For many SME owners, Law 25 first brings to mind paperwork, legal jargon and a vague sense of worry. Yet this Quebec law on the protection of personal information applies to any organization that collects personal information, regardless of its size. A simple contact form, a newsletter or an audience measurement tool is enough to fall within its scope.
To make things concrete, let’s follow a fictional business: a home decor shop in Montérégie that we’ll call Atelier Rivage. Its owner, Julie, runs a showcase website with an online store and a newsletter. Here is how she uses Connect Privacy, the compliance module of the Pratcom Connect suite, step by step, from her own client area.
The starting point: a shop collecting data without realizing it
Like many SMEs, Atelier Rivage built its website over time. An agency added an analytics tool, an advertising campaign required a pixel, and a consultant installed a tool to analyze visitor behaviour. The result: Julie no longer really knows which scripts are running on her site, or what data they collect.
However, Law 25 imposes clear obligations, including consent, transparency and the appointment of a person in charge of the protection of personal information. The stakes are not theoretical.
The penalties provided for by Law 25 can reach $25 million or 4% of worldwide turnover.
So Julie decides to activate Connect Privacy. Her goal: to put the key technical elements of compliance in place without becoming a legal expert.
Step 1: scan the site’s tracking tools
Julie’s first action is to launch the tracking tool scan. This feature detects the cookies and tracking scripts installed on the site, so nothing gets overlooked.
In Atelier Rivage’s case, the scan reveals several trackers she had almost forgotten about:
- Google Analytics 4, used to measure site traffic
- Meta Pixel, added during a social media advertising campaign
- Hotjar, installed to observe how visitors navigate the site
This overview is invaluable: Julie now knows exactly what is collecting data on her site. These detected tools can then be blocked until the visitor gives consent. This is the foundation on which all the following steps rest.
Step 2: configure the consent banner
Once the trackers are identified, Julie configures the cookie consent banner herself from her client area. Connect Privacy offers granular consent, which means visitors can make specific choices rather than accepting or rejecting everything at once.
The banner is customizable: Julie adjusts it to match Atelier Rivage’s branding while keeping it clear for her customers. Above all, it respects the visitor’s choice. If a customer declines advertising tracking cookies, the corresponding pixel does not fire for her.
What this changes for visitors
For the shop’s customers, the experience becomes more transparent. They understand that cookies are used to improve their experience, and they stay in control of their data. For Julie, it is also a way to build trust with her customers.
Step 3: generate the privacy policy
Until then, Atelier Rivage’s website displayed a generic privacy policy, copied several years ago. It mentioned neither the behavioural analysis tool nor the advertising pixel.
With Connect Privacy, Julie generates a clear, up-to-date policy tailored to her site’s actual data collection. Because the module is based on what is actually in use, the document reflects reality rather than an abstract template. She thus meets Law 25’s transparency requirement in a way that is consistent with her tools.
Step 4: rely on the consent log
Compliance doesn’t stop at displaying a banner. You also need to be able to prove it. That is the role of the consent log, which keeps a versioned record of every consent given by visitors.
For Julie, this means that if the Commission d'accès à l'information (CAI) makes a request, she has a history ready to present. She doesn’t have to piece together after the fact who agreed to what and when: the information is already recorded as it happens.
Day to day, this step requires virtually no effort on her part. The log is maintained automatically while she focuses on her orders, suppliers and customers.
Consistent compliance across the entire site
A few months later, Julie adds a chatbot and forms from the Pratcom Connect suite to her site. Good news: the consent managed by Connect Privacy applies across the whole suite, including Connect Chat and Connect Forms. She doesn’t have to start from scratch, and her compliance approach remains consistent from one page to the next.
Julie does, however, keep one important point in mind: Connect Privacy does not replace a lawyer. The module automates the technical aspects (consent, scanning, log, policy), but for legal questions specific to her situation, consulting a legal advisor is still recommended.
In short, Atelier Rivage’s approach comes down to four simple actions:
- Scan the site to identify all cookies and tracking scripts
- Configure a granular, customized consent banner
- Generate a privacy policy that accurately reflects actual data collection
- Let the log record every consent, ready for the CAI
Do you see yourself in Julie’s situation? Pratcom offers a free compliance check to see where your site stands with respect to Law 25. It’s a good starting point for moving from worry to well-managed compliance, with peace of mind.
