Quebec Law 25 and your Shopify store: the merchant’s eight obligations
Every order entrusts a name, an address, sometimes more. The merchant’s eight obligations, explained simply.
6 min read
A Shopify store that collects information from Quebec customers is covered by Law 25: designate a person in charge and publish their contact details, publish a clear privacy policy, turn off by default any cookies that identify or profile, and report serious incidents. Administrative penalties can reach 10 million dollars or 2% of worldwide turnover.
This article is for information only and is not legal advice. For your situation, consult a lawyer or Quebec’s Commission d’accès à l’information (CAI).
Law 25 came into force in three stages, in September 2022, 2023 and 2024. It applies to every private business, whatever its size. A store collects personal information with every order; plan for it when designing a Shopify store built for Quebec.
The eight obligations
What Shopify does for you, and what it doesn’t
Shopify offers a cookie banner in its privacy settings, an API that holds apps and pixels back until consent, a policy generator and customer data export or erasure. But the generated policy doesn’t know your apps, suppliers or privacy officer: it’s a starting point. And every installed app must respect consent; check them one by one.
Penalties
Up to 10 million dollars or 2% of worldwide turnover in administrative penalties, and up to 25 million dollars or 4% in penal fines. People affected can also claim damages.
The most common oversights
A policy copied from elsewhere. Pixels firing before consent. No privacy officer published. Apps added without checking. No assessment of transfers outside Quebec.
FAQ
Does a small store fall under the law? Yes. It applies to every private business, whatever its size.
Is a cookie banner mandatory? The law requires turning off by default anything that identifies, locates or profiles; a banner is the usual way to do it.
What should I do after a breach? Record the incident, limit the damage, assess the risk, and notify the CAI and the people affected if it’s serious.
A question about your project? Let’s talk it through. Write to us