Québec Law 25 Privacy Auditor — Loi 25 Website Compliance Check

Check in seconds whether a website meets the visible requirements of Québec's privacy law (Law 25 / Loi 25).

Paste one or hundreds of website URLs. For each site, the Actor finds and reads the privacy policy, looks for the published contact of the person in charge of personal information, detects tracking pixels and cookie consent tools, and checks forms that collect personal data. You get a 0–100 score, a verdict and a precise list of issues.

🇫🇷 En bref : collez des adresses de sites web. Pour chaque site, l'Actor vérifie la politique de confidentialité, la publication du responsable de la protection des renseignements personnels, les outils de suivi (Google Analytics, pixel Meta…) sans outil de consentement, et les formulaires sans mention de confidentialité. Score sur 100 et liste claire des problèmes, en français ou en anglais.

Who is it for?

• Web agencies & freelancers: audit client sites, sell Law 25 compliance updates, or check sites before delivery.
• Privacy, legal and compliance consultants: run a fast first-pass audit on many websites before a detailed review.
• Businesses operating in Québec: monitor your own websites (and franchisees') on a schedule.

What it checks

Check	Why it matters under Law 25
Privacy policy published	Businesses collecting personal information through technological means must publish a privacy policy on their website.
Privacy policy reachable	Detects privacy links leading to a missing page (404).
Policy language & content	Policy in French, and covering purposes, cookies, retention, access/correction rights, disclosure to third parties.
Privacy officer published	The title and contact details of the person in charge of the protection of personal information must be published on the website.
Trackers vs consent tool	Detects Google Analytics, Google Tag Manager, Google Ads, Meta Pixel, TikTok, LinkedIn, Hotjar, Clarity, Pinterest, Snapchat, X and Bing, and 19 cookie consent tools (Cookiebot, OneTrust, Axeptio, Didomi, CookieYes, Complianz, Google Consent Mode…). Tracking technologies must be off by default.
Forms without privacy notice	Forms collecting emails or phone numbers without any privacy notice or link.

Output example

{
  "domain": "example.ca",
  "score": 50,
  "verdict": "likely_non_compliant",
  "verdictLabel": "Non conforme (probable)",
  "summary": "Le titre et les coordonnées du responsable de la protection des renseignements personnels ne sont pas publiés sur le site. Outils de suivi détectés (Google Analytics, Meta Pixel) sans outil de consentement aux témoins : ils doivent être désactivés par défaut.",
  "pagesAudited": 10,
  "privacyPolicyUrl": "https://example.ca/politique-de-confidentialite",
  "privacyPolicyLanguage": "fr",
  "privacyPolicyMissingTopics": ["durée de conservation"],
  "privacyOfficerPublished": false,
  "trackersDetected": ["Google Analytics", "Meta Pixel"],
  "consentToolDetected": [],
  "formsWithoutPrivacyNotice": 0,
  "issues": [
    { "severity": "high", "code": "NO_PRIVACY_OFFICER", "message": "..." },
    { "severity": "high", "code": "TRACKERS_WITHOUT_CONSENT_TOOL", "message": "..." },
    { "severity": "low", "code": "PRIVACY_POLICY_INCOMPLETE", "message": "..." }
  ],
  "auditedAt": "2026-10-22T12:00:00.000Z"
}

Verdicts: likely_compliant (score ≥ 85), needs_review (60–84), likely_non_compliant (< 60), unreachable.

How to use

1. Add the websites to audit in Websites to audit (homepage URLs; example.ca without https:// also works).
2. Choose how many pages to crawl per site (10 is a good default). Privacy and contact pages are always visited first.
3. Pick the report language (Français / English).
4. Run, then export results as JSON, CSV, Excel or via API.

💡 Tip — combine with Bill 96: audit the same list with the Québec Bill 96 Website Auditor to cover both French-language and privacy compliance.

💡 Tip — monitoring: create a Schedule (e.g. monthly) and connect an integration (email, Slack, Google Sheets, Make, Zapier).

Pricing

Pay only for what you use: you are charged per website successfully audited. Unreachable or bot-protected websites are not charged.

How it works

• Fast HTTP crawler (no browser) that reads the public HTML of each site, prioritizing privacy and contact pages.
• Trackers and consent tools are detected from the page source (scripts and tags).
• The privacy policy is analysed for language and key topics.

Limitations

• This is an automated indicator, not legal advice. It does not replace a review by a privacy professional or the Commission d'accès à l'information du Québec.
• It analyses the public HTML: tools injected later by JavaScript (for example through Google Tag Manager) may not all be listed, and it does not verify that trackers actually wait for consent.
• It cannot check internal obligations (privacy impact assessments, incident register, governance policies).
• Websites that block bots (HTTP 403) are not bypassed: they are reported as not audited and are not charged.

Responsible use

• Only public pages are read; the Actor does not submit forms and does not store personal data, only compliance indicators.
• Anti-spam laws: if you use these reports for prospecting, you are responsible for complying with Canada's Anti-Spam Legislation (CASL / LCAP). Do not send unsolicited commercial emails without the required consent.
• Do not present results as an official or legal certification, and do not imply any endorsement by the Commission d'accès à l'information.