Quebec Law 25 and advertising: how do you run the Meta pixel and Google Ads with consent?

The banner appears; the pixel waits for the answer. How to measure your sales while respecting each visitor’s choice.

6 min read

In Quebec, Law 25 requires tools that track or profile a visitor, such as the Meta pixel and the Google Ads tag, to stay off until the visitor consents. A Shopify store can follow that rule and still measure its sales: a consent banner, Shopify’s Customer Privacy API, Meta’s Conversions API and Google’s consent mode, set up together.

This article is for information only and is not legal advice. For your situation, consult a lawyer or Quebec’s Commission d’accès à l’information.

Many stores responded to Law 25 by adding a cookie banner. But a banner alone isn’t enough: the advertising tools also have to wait for the visitor’s answer. That’s often where everything is decided, for compliance and for campaign quality alike. If you run Meta ads or Google Ads, this concerns you directly.

What Law 25 says

The law requires technologies that can identify, locate or profile a person to be turned off by default, and the person to be informed. For a store, that mainly means:

  • the Meta pixel;
  • the Google Ads tag and Google Analytics;
  • other ad pixels and tracking tools installed by apps.

Consent must be manifest, free and informed. A pre-ticked box, or text saying “by browsing, you accept,” isn’t enough.

The problem: a banner that blocks nothing

The most common case: the banner appears, the visitor hasn’t chosen anything yet, and the pixel has already fired. The store thinks it’s compliant; it isn’t. The opposite mistake blocks everything, even after consent, and campaigns lose their data.

Both mistakes are costly: one in legal risk, the other in poorly optimized advertising.

The right setup, in four parts

Part Its role
Consent banner Ask for agreement, by category: essential, analytics, advertising
Shopify Customer Privacy API Pass that choice on to apps and pixels
Meta pixel and Conversions API Measure sales, only if advertising is accepted
Google consent mode Adapt the Google tag’s behaviour to the visitor’s choice

The banner

Shopify offers a built-in banner; other apps exist. What matters: Accept and Decline buttons of equal weight, a Customize option, and a link to your privacy policy.

Shopify’s Customer Privacy API

Apps and pixels that respect it wait for the visitor’s choice. Those that don’t fire anyway: check every installed app.

The Meta pixel and Conversions API

The Conversions API sends sales to Meta directly from Shopify, making measurement more reliable than the pixel alone. It still has to follow the same rule: nothing is sent without consent to the advertising category.

Google consent mode

It adjusts the Google tag to the visitor’s choice. In its basic version, nothing is sent without consent. An advanced version sends cookieless signals; check with your adviser whether it suits your situation under Law 25.

What you lose, and what you keep

Some visitors will decline. Your campaigns will see fewer conversions than before; that’s the price of honest measurement. But a clean setup keeps what matters: sales from visitors who accept, measured reliably, and ad platforms optimizing on real data rather than shaky estimates.

Checks to run

  • Open the store in a private window: no pixel should fire before the choice.
  • Decline: no ad pixel should fire afterwards.
  • Accept: the Meta pixel and Google tag should fire.
  • Check that every app respects Shopify’s Customer Privacy API.
  • Update the privacy policy with the tools actually used.
  • Add a “Cookie settings” link at the bottom of every page.

FAQ

Is the Meta pixel banned in Quebec? No. It simply has to stay off until the visitor consents.

Does the Conversions API get around Law 25? No. It runs through the server instead of the browser, but it’s still a tracking tool: it must respect the same consent.

Do visitors outside Quebec need a banner? Law 25 covers information collected in Quebec. Many Canadian stores apply the same banner to everyone, for simplicity.

What does a non-compliant store risk? The Commission d’accès à l’information can impose penalties of up to 10 million dollars or 2% of worldwide turnover.

A question about your project? Let’s talk it through. Write to us

Keep reading