Rules
How to Run a Quebec Startup Acquisition Campaign that Passes Bill 64
A Quebec startup acquisition campaign faces two regulators: the CAI for privacy under Law 25 and the OQLF for French-language commercial publications.
What to take away
- Law 25, the Quebec statute that began as Bill 64, applies to any startup that collects personal information from people in Quebec, no matter where the company is registered.
- Two regulators matter: the Commission d'accès à l'information du Québec for privacy, and the Office québécois de la langue française for French-language commercial publications.
- A compliant disclosure names the purposes, the retention period, the rights of access and correction, and the person responsible for personal information.
- The consequence is administrative: the CAI can order collection stopped, and monetary penalties scale with worldwide turnover.
- Quebec alone requires a French version of commercial publications.
Quebec runs the strictest acquisition compliance regime in Canada, and it splits into two files that most founders treat as one.
Who has jurisdiction over a Quebec startup acquisition campaign
Law 25 applies to an enterprise that collects personal information while carrying on an activity in Quebec. Where the company is incorporated does not decide the question. A Halifax startup aiming a campaign at buyers in Montreal is inside the scope, and so is a foreign business with Quebec customers.
Federal privacy law still covers federally regulated sectors such as banking and air transport. For most startups the Quebec statute is the operative rule, and it is stricter on consent, breach notice and transfers outside the province. The federal PIPEDA overview sets out that baseline, which matters when you sell into several provinces.
The two regulators a campaign has to satisfy
The Commission d'accès à l'information du Québec enforces the privacy statute. The Office québécois de la langue française enforces the Charter of the French Language, as amended by Bill 96. A campaign can satisfy one and fail the other.
| Item | Quebec requirement | Supervising body |
|---|---|---|
| Consent | Manifest, free, informed and given for specific purposes, separately for each purpose | CAI |
| Privacy policy | Published in clear and simple language, available when information is collected | CAI |
| Serious breach | Notice to the CAI and to affected people where serious injury is possible | CAI |
| Commercial publication | French version required, with other languages permitted alongside | OQLF |
| Vendor contract | Written terms that limit use and require confidentiality | CAI |
Which rules bind you where is a mapping exercise before it is a legal one, and real market research treats that mapping as work that happens before interviews start.
What a compliant disclosure contains
The privacy notice carries most of the weight. It states each purpose of collection, the categories of information held, the retention period or the criteria that set it, and the rights of access, correction and portability. It also names the person responsible for the protection of personal information, who by default is the person with the highest authority in the enterprise.
A working checklist for a campaign landing page and its notice:
- A named person responsible, with a contact route that answers
- Purposes listed separately for each collection point
- Retention period, or the criteria used to fix it
- Access, correction and portability rights, with a route to use them
- A version date visible on the published notice
Consent has to be documented rather than assumed. The readiness checklists that precede a launch decision give you a place to record what is already in place before a form goes live.
Records a Quebec campaign must keep
- Consent logs showing who agreed, when, to which purpose and through which form.
- Versioned privacy notices with the date each version took effect.
- Privacy impact assessments for any transfer of personal information outside Quebec.
- A breach register holding the risk assessment and the notifications sent.
- Written vendor contracts that limit use and require confidentiality.
Retention is the part that catches people out. Consent evidence should outlive the campaign, and notice versions should be kept as long as the enterprise holds information collected under them. Build the log before the automation, in the order permission records describes, so the file can be reviewed without guesswork.
What happens if you do not comply
The CAI can order an enterprise to stop collecting or distributing personal information while a file is open. It can impose monetary penalties set as a percentage of worldwide turnover, and heavier fines again for a repeat offence. A person who suffers injury can also sue for damages.
A stop order is the risk that ends a campaign. Collection halts, paid channels keep billing, and the list you built sits unusable until the file closes.
Notifications carry the same weight as consent. A breach that risks serious injury must be reported to the CAI and to the people affected, and the reasoning behind that call should be written down at the time. The same trail feeds reporting, and attributed credit explains why a contact's source has to stay traceable once it reaches the pipeline.
Where the rules differ by place
Alberta and British Columbia have their own private-sector privacy statutes. Ontario's health statute covers health information. The remaining provinces fall under the federal law. None of them adds a language requirement, and that gap is what breaks one English template used across the country.
Email consent is federal. Canada's Anti-Spam Legislation requires express or implied consent for commercial electronic messages and a working unsubscribe, and it applies alongside the Quebec rules. Wikipedia's summary of Canada's Anti-Spam Legislation sets out the consent categories, which is the distinction most often missed when a Quebec list is built from contacts gathered under United States rules.
Common questions
Does Law 25 apply to a startup with no office in Quebec? Yes, if it collects personal information from people in Quebec while carrying on an activity there. Incorporation elsewhere does not remove the duty.
Can a landing page be English-only? Not as the only version. Commercial publications need a French version, and other languages may accompany it.
Who is responsible for personal information? By default, the person with the highest authority in the enterprise. The role can be delegated in writing, but a name still has to appear in the notice.
How long must consent records be kept? The statute sets no fixed term, so retention should match the period you disclose and the time limits for a complaint or a claim.
