Free compliance risk scan
Is your website a Law 25 liability?
Law 25 applies to any business in Quebec that collects personal information, and a contact form counts. The scan reads up to 10 pages of your site and lists the gaps it can see, in plain language, each one linked to its legal source. Free, about a minute.
What the scan checks
Seven things it looks for
Each check maps to a specific obligation. When one comes up in your report, it links to the source, so you can read the law yourself instead of taking our word for it.
01
Trackers that start before consent
The scan loads your homepage without clicking anything and watches for analytics and ad trackers (Google Analytics, Meta Pixel, LinkedIn, Hotjar, Clarity and a few others) setting identifying cookies before the visitor agrees. Law 25 requires tools that can identify, locate or profile someone to be off by default, and the CAI's position is that turning them on takes a positive act by the visitor. A properly configured Google Consent Mode setup doesn't get flagged. This is the check the scan rates highest under Law 25.
02
A privacy policy, and a way to find it
A business that collects personal information through its website has to publish a privacy policy there, in simple and clear terms. The scan looks for one in your links and at the usual addresses (/privacy, /confidentialite and a couple of others). It flags a policy that's missing, one that's too short to cover what the law asks for, and one that exists but that nothing on the site links to.
03
The tools your policy names
If the scan finds a tracker or a chat widget running on your site (HubSpot, Intercom, Tawk.to and the like), it checks whether your policy mentions it. The policy has to say who the information goes to and whether it leaves Quebec.
04
Consent wording on your forms
Every form that collects a name or an email has to tell the person, at that moment, why you're collecting it and that they can withdraw their consent. The scan reads each form it can see for that wording.
05
A named person in charge of privacy
By default it's whoever has the highest authority in the business, which in a small business is probably you. That person's title and contact details have to be on the website. The scan looks for them.
06
A secure connection
The scan checks that your site uses HTTPS and doesn't load parts of the page over plain HTTP. Failing to take the security measures Law 25 requires (s. 10) is one of the failures that can lead to an administrative penalty, and an unencrypted site is missing the most basic one.
07
A French version
This one comes from the Charter of the French Language, not Law 25, and the report says so. A site that promotes or offers products or services in Quebec has to be in French, and if it's also in another language, the French version has to be available on terms at least as favourable.
How it works
01
Enter your site
Your web address, your business name and an email for your copy of the report. Nothing to install.
02
The scan reads it
It fetches up to 10 public pages, including your privacy policy and contact pages when it can find them, and loads your homepage in a browser to see what sets cookies before consent. It usually takes under a minute.
03
You get a risk list
Each risk comes with a severity, a plain explanation and its source. The list shows on the page, a copy goes to your email, and you can save it as a PDF for whoever looks after your site.
What the scan can't see
Most checks read the HTML your server sends. A form that a script builds after the page loads can slip past them, and we know because it happened: the scan once reported a site's forms as fine when it couldn't see them at all. We fixed the report so it says exactly what it read.
It also can't see anything behind your website: where the data goes, how long you keep it, your contracts with vendors, what your staff do with it, or whether you've done the privacy impact assessment Law 25 requires before certain projects. A short list of risks is a good sign. It isn't proof that you comply, and no automated tool can give you that.
If the scan finds something
Compliance Sprint, $447 one time
Several of the risks the scan can flag come back to the privacy policy: there isn't one, nobody can find it, or it doesn't name the tools your site runs. The Sprint fixes that. We scan your site, compare what we find with your answers to a short intake form, and write a policy that matches what's actually running on it.
No lawyer reviews it, and the agreement says so plainly: it isn't legal advice. If your practices change later, an update is a flat $149.
Trackers that start before consent, form wording and a missing French version are fixes to the site itself, not the policy. If you'd like us to handle those too, say so when you get in touch.
Who runs this
Studio Signal is a small studio in Montreal (that's me, Seb). We build and run websites for businesses and nonprofits.
Every risk the scan can report traces back to a section of a statute or a regulator's guidance (the CAI, the OQLF), kept in a source file for each law. When one of those sources changes, we get an alert, and any change to the report wording is reviewed before it goes live.
Common questions
Yes. It applies to anyone carrying on an enterprise that collects, holds, uses or communicates personal information, with no minimum size, revenue or traffic. One person with a contact form is covered.
If your site runs tools that can identify, locate or profile visitors (analytics and ad pixels are the usual ones), you need a way for visitors to turn them on, and they have to stay off until they do. The CAI names a cookie settings window as a recognized way to do that. Cookies the site strictly needs to work don't require consent.
For a business, administrative penalties go up to $10 million or 2% of worldwide turnover, whichever is greater, and penal fines up to $25 million or 4%. Those are ceilings. Before imposing an administrative penalty, the CAI has to send a notice of non-compliance and give you a chance to respond, and an undertaking you honour can head one off. The CAI can also open an inquiry on a complaint, including an anonymous one.
By default, the person with the highest authority in the business. You can delegate the role in writing, to an employee or to someone outside the business, but the title and contact details of whoever holds it have to be published on your website.
No, it's the Charter of the French Language. A site that promotes or offers products or services in Quebec has to be in French, and if it's also in another language, the French version has to be available on terms at least as favourable. The scan checks it on this page because it's a Quebec obligation, and the report cites the Charter as the source.
No. It's an automated check of what's visible on your public pages, and it doesn't establish that your site complies or doesn't. For advice on your situation, talk to a lawyer.