Rules
Quebec privacy law vs US platforms compliance compared
Quebec privacy law social media compliance sets GDPR-like duties on platforms serving residents, with fines in CAD under Law 25, plus mandatory breach reports.
What to take away
- Quebec's Law 25 applies to any platform that offers services to Quebec residents, regardless of where the company sits.
- US platforms answer to a narrower set of federal rules, chiefly sector-specific ones, plus state laws such as California's.
- Penalties under Law 25 are administrative and are issued in CAD by the Commission d'accès à l'information.
- The gap is not privacy philosophy. It is enforcement posture and who carries the burden of proof.
- A platform can meet US expectations and still fail Quebec's notice, consent and portability duties.
Quebec's Law 25, in force in stages since 2022, treats privacy as a default setting rather than a setting a user has to find. A US platform that ships one global consent flow usually discovers the difference at the point of a complaint, not at launch. The comparison below sets the two regimes side by side on criteria a compliance lead can actually apply.
The criteria that matter
Four criteria separate the regimes in practice: who is covered, what consent means, what rights a resident can exercise, and what happens when something goes wrong. A fifth criterion, data portability, is where the two diverge most sharply and where most US platforms have no product answer at all.
| Criterion | Quebec Law 25 | Typical US federal position |
|---|---|---|
| Scope | Any platform serving Quebec residents | Sector rules, no general federal privacy statute |
| Consent | Explicit, purpose-specific, plain language | Notice and choice, often opt-out |
| Access and deletion | Rights enforceable on request | Varies by state and sector |
| Portability | Computer-readable format required | No general federal right |
| Regulator | Commission d'accès à l'information | FTC and state attorneys general |
| Penalty currency | CAD, administrative fines | USD, civil penalties and consent orders |
The US side is not empty. The FTC has acted on privacy for years, including a $5 billion penalty and new restrictions on Facebook in 2019, documented in the FTC settlement announcement. That case followed the Cambridge Analytica data scandal, which shaped how US regulators think about consent. What the US lacks is a single statute that applies to every platform touching a resident's data.
Option by option
Option one: run one global flow built for the US market. This is the default for most platforms. It relies on notice and opt-out, and it treats deletion requests as a support ticket. It works where the only exposure is US federal and state law. It fails in Quebec the moment a resident asks for their data in a portable format, because there is no queue for that request.
Option two: extend an EU GDPR programme to Quebec. Teams that already run GDPR compliance often assume Quebec is a copy. The Quebec data protection comparison shows the overlap is real but not total: thresholds, breach notification timing and regulator contact points differ. Reusing GDPR paperwork without checking those points leaves gaps that a complaint will find.
Option three: build a Quebec-specific layer. This means a separate consent record, a named privacy officer, and a documented process for access, correction and portability requests. It costs more up front. It also produces the evidence a regulator asks for first.
- Map every data flow that touches a Quebec resident.
- Rewrite consent language for purpose-specific, plain French and English notice.
- Stand up a request queue with a tracked response clock.
- Name the privacy officer and publish the contact route.
- Test portability export before a resident asks for one.
Where each one wins
Option one is right for a platform with no Quebec users and no plan to acquire them. Option two is right for a firm with a mature GDPR programme and a small Quebec user base, provided someone checks the divergences. Option three is right for any platform where Quebec residents are a real share of traffic, because the cost of the layer is smaller than the cost of an administrative penalty and the remediation order that follows it.
A short checklist helps decide which applies.
- Do we know how many Quebec residents use the service monthly?
- Can we produce a portable export on request today?
- Is a privacy officer named and reachable?
- Does our consent record show purpose, not just agreement?
What none of them solve
No option settles the question of how a small platform proves it is not serving Quebec residents when its content is public and indexable. Law 25 turns on offering services to residents, and an open web page offers itself. That is the shared limit: all three approaches assume a boundary that the open web does not draw. The same problem appears in moderation debates, where platforms argue over reach and responsibility, as covered in what did Section 230 protect.
A second shared limit is enforcement capacity. The Commission d'accès à l'information publishes guidance, but investigations follow complaints. A platform that waits for a complaint is already behind. Reading how a comparable US settlement unfolded, traced in Facebook FTC settlement history, shows how quickly a narrow complaint becomes a broad audit.
A compliance programme built for one jurisdiction rarely survives contact with a second one unmodified.
Example: a mid-size platform with 40,000 Quebec users
A platform with a US-first consent flow and 40,000 monthly Quebec users runs the checklist above and finds two failures: no portability export and no named officer. The fix is not a rebuild. It is a request queue, a published contact, and an export script. The remaining work is documentation, which is what a regulator reads first.
Common questions
Does Law 25 apply to a US company with no Quebec office? Yes, if it offers services to Quebec residents or profiles them. Location of the company is not the test.
Are the penalties the same as GDPR? No. They are administrative fines issued in CAD by Quebec's regulator, with amounts set under provincial law rather than the EU framework.
Can a platform rely on US federal compliance alone? Not for Quebec residents. US federal privacy law is sector-specific, and no general statute covers every platform.
What should we fix first? Name a privacy officer and build a request queue. Those two items produce the records an investigation asks for.
