Quebec Law 25 vs US Platform Privacy Practices

What to take away

Two different starting points

The easiest way to compare the two systems is to ask who has to act first.

Under Quebec's Law 25, the burden sits with the organization. The CAI describes a regime where consent must be manifest, free, informed and given for specific purposes, requested in plain terms for each purpose, and where a written request must be presented separately from other information. Express consent is required before sensitive information is used for a new purpose.

In the US, the FTC's main tool is Section 5 of the FTC Act, which prohibits unfair and deceptive acts. The FTC applies it mainly to companies that break their own privacy promises, and the Children's Online Privacy Protection Act (COPPA) covers children under 13. Neither sets default settings for adult users. Detailed user rights come from state laws such as California's.

California's Consumer Privacy Act (CCPA) is the best-known state model. The California Attorney General describes rights to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information. Consumers opt out: a business that sells or shares personal information must offer a "Do Not Sell or Share My Personal Information" link, and after an opt-out it cannot sell or share the data unless the consumer later authorizes it. Opt-in is required only for minors: authorization for under-16s, with a parent or guardian opting in for under 13. The law covers businesses that meet a threshold, such as over $25 million in annual gross revenue or handling the information of 100,000 or more California residents or households.

So the same app can ask a user to act in one place and act first in another. Our comparison of California's design code and COPPA covers the US teen rules in more detail.

Privacy by default: the biggest practical difference

Three Quebec rules stand out for people who use social platforms.

Highest confidentiality by default. According to the CAI, products or services offered to the public that have privacy settings must provide the highest level of confidentiality without user action. The exception is cookie settings. In practice, a new profile on a covered service should start with the most private option and let the user loosen it, instead of starting open.

Profiling is off until activated. Organizations must disclose technology that includes profiling functions in advance. Those functions cannot be enabled by default, and the person must activate them. The CAI page does not give a date for this item in its summary.

Automated decisions are explained. People must be told when a decision is based solely on automated processing, no later than when they are informed of the decision, and must be able to submit observations to a staff member who can review it.

In California the default is reversed for most settings: the data practice is allowed unless the user objects. The CCPA does say that an opt-out preference signal such as the Global Privacy Control, if the user enables it, must be honored by covered businesses as a valid request. That gives a US user one switch, but the user still has to turn it on.

Consent, children and sensitive data

Law 25 asks for more at the moment of collection. At collection, organizations must tell people the purposes, the means, their access and correction rights, and their right to withdraw consent. They must also disclose any possible transfer outside Quebec.

For children, the CAI says personal information about a child under 14 cannot be collected from the child without the consent of a parent or guardian, unless the collection clearly benefits the child. That sets the age at 14 for Quebec, against 13 under COPPA and the under-16 opt-in rule in the CCPA's sale provisions.

Biometric databases must be disclosed to the Commission at least 60 days before they are put into service. For users of face-filter or photo-matching features, that is a notice duty with no direct counterpart in the CCPA material above.

Rights users can exercise

A user in Quebec can ask a business to:

The CAI also requires businesses to publish their governance policies and the title and contact details of the person in charge of personal information protection on their website. Users who want to exercise a right should look there first.

California gives rights to know, delete and correct. Its Attorney General page does not mention a right to portability, so a Quebec user may have a stronger claim to a structured export than a Californian does.

Do these rules reach US platforms?

The CAI says a business based outside Quebec is subject to the Act if it collects, holds, uses or communicates personal information as part of its business activities in Quebec. The highest-ranking person in the business is responsible for compliance. Before sending personal information outside Quebec, a business must complete a privacy impact assessment and have a written agreement for the transfer.

This is separate from the federal rules on platforms and news that we cover in Canada's news link rules and in what Bill C-11 means for creators. Those laws deal with broadcasting and news. Law 25 deals with personal information, and it applies through the province.

Penalties compared

The CAI says administrative monetary penalties can reach 2% of worldwide turnover or $10 million. A penal prosecution, which the CAI can start within five years of an offence, can lead to fines of $5,000 to $100,000 for individuals and $15,000 up to the greater of $25 million or 4% of worldwide turnover for companies, with fines doubled for repeat offences.

In the US, the FTC's authority rests on unfair and deceptive practices and COPPA, and California enforces the CCPA. The two systems differ in structure, so a direct comparison of headline fines misleads. The important point for users is that Quebec's penalty provisions attach to the default and consent duties described above.

What this means for a US user

Official sources