Five sets of rules get cited whenever someone talks about whether a Quebec website is legal. For most small businesses, two apply almost certainly, a third only if you sell online, a fourth only if you send commercial email, and the fifth, accessibility, probably isn't your law at all.
That sorting rarely happens, because most of what gets written on this subject comes from someone selling the fix. Translation vendors explain the Charter. Compliance firms explain Law 25. Accessibility tool vendors explain accessibility. Each is accurate about its slice. Nobody sorts the whole pile. We sell a compliance diagnostic ourselves, so keep that in mind as you read. The official sources are linked in each section and were checked on September 1, 2026.
Five sets of rules, and which ones reach you
| Rule | Who it reaches | A typical brochure site |
|---|---|---|
| Charter of the French Language, as amended by Bill 96 | Any business carrying on activities in Quebec that makes commercial documents available to the public, website included | Covered |
| Law 25, personal information | Any business collecting personal information | Covered as soon as there is a form |
| Consumer Protection Office rules on distance contracts | Merchants concluding contracts at a distance | Only if you sell online |
| Canada's Anti-Spam Legislation (CASL) | Any business sending commercial email | Only if you run a newsletter or email marketing |
| Standard on Web Accessibility (SGQRI 008) | Public bodies | Not covered |
The first two rows have no threshold. No minimum headcount, no revenue floor, no exemption for a five-page site a nephew put together. If you offer something to Quebec consumers and your site collects so much as an email address, you are in scope.
The third depends on one question: does a transaction close on your site? The fourth depends on another: do you send commercial email? The fifth depends on your sector, and for most businesses here the answer comes as a surprise.
French, the widest obligation
If you run an English-language business in Montreal, this is the rule most likely to catch you, and the one least likely to appear in whatever you were sent when your site was built.
Section 52 of the Charter of the French Language requires catalogues, brochures, folders, order forms and any similar document available to the public to be drawn up in French, "regardless of the medium used". The Office québécois de la langue française reads that as a consumer's right to a complete French version of a company's website.
The word website appears nowhere in the section. The words "regardless of the medium used" are what catch it. Owners go looking for a website law, fail to find one, and conclude the rule does not reach them.
On a brochure site, the obligation covers the whole site, home page included. The places it breaks down in practice are consistent:
- ◆Service pages, with their descriptions and pricing tables
- ◆Forms: field labels, error messages, the confirmation message
- ◆Automated emails sent after a quote request
- ◆Embedded third-party tools such as booking widgets or live chat
- ◆PDFs linked from the site, routinely missed because they live elsewhere
The practical test
An English version is allowed. The law requires the French version to be complete and available on terms at least as favourable. A site that runs entirely in English with a translated home page does not meet the standard, because the content and functions are not equivalent. A language toggle in the top corner solves nothing if it leads to a stripped-down French version.
The path of a file is well documented. It starts with a complaint, from a customer who cannot find the French version or a competitor who notices a unilingual site. The Office contacts the business and explains the corrections. If the business refuses, the Office orders it to comply, then refers the file to the Director of Criminal and Penal Prosecutions. Ignoring the order is the offence, and the fine for a business runs from $3,000 to $30,000, doubled on a first repeat and tripled after that.
The examples are recent. Between February and March 2026, five businesses were each fined $3,000 for web content offered only in English after ignoring an order: Vision CTC, Planches LaCroix, Comac Corporation, Pizza Alfy's and URBN Canada (Anthropologie). The Office publishes the list of convictions.
Separate obligations stack on top based on headcount in Quebec, starting at five employees, and those concern the workplace. The full breakdown sits in our guide on what the law requires of an online store.
Personal information, even without a store
Law 25 came into force in stages, and the sequence matters when you are working out how long you have been offside. Designating a person responsible for the protection of personal information has applied since September 22, 2022. Consent and transparency rules arrived on September 22, 2023. Data portability followed on September 22, 2024.
A brochure site collects more than its owner assumes. The contact form counts. Analytics count. Add live chat, appointment booking, and whatever measurement tags the previous agency installed and never removed.
What the law asks for comes down to five things: a responsible person, who by default is whoever holds the highest authority in the business; governance policies and practices set internally, with detailed information about them published on the site (section 3.2); a confidentiality policy in clear and simple language as soon as you collect information by technological means, a form for example (section 8.2); transparency at the moment of collection about what you take and why; and a plan for responding to a confidentiality incident.
On cookies, a correction is needed, because the error is widespread, agencies included. Section 8.1 covers technologies that identify, locate or profile a person. When your site uses them, those functions must be off by default, the person must be informed in advance, and the person is the one who chooses to turn them on. The Commission d'accès à l'information says so in plain terms. In practice, a banner that loads analytics or advertising cookies before the click does not meet the rule.
Penalties run on two tracks. The Commission d'accès à l'information can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover without going through a court. The penal route reaches $25 million or 4%. Those ceilings are designed for large organizations. In a small business, a complaint is what opens a file, and the first intervention is usually a request to correct.
Our Law 25 compliance guide covers it in full, cookies included.
If you send commercial email
Once your site feeds a newsletter, a follow-up sequence or an email campaign, Canada's Anti-Spam Legislation applies. It asks three things of every commercial message: consent, express or implied, obtained before sending; identification of the sender with contact details; and a free unsubscribe mechanism that stays valid for 60 days and takes effect within 10 business days.
Express consent comes from a deliberate action, a box the person ticks themselves. A pre-ticked box counts for nothing. A customer who bought from you within the last two years gives implied consent. The details are on the Government of Canada site.
Accessibility: what the law requires, and of whom
The Standard on Web Accessibility, SGQRI 008, is regularly presented as a general obligation in Quebec. It applies to public bodies as defined by the Act respecting the governance and management of information resources: government departments, budget-funded bodies, school service centres, CEGEPs, universities and the health network. Municipalities are not on the list. Version 3.0 has been in force since April 29, 2024. A private clinic, a construction contractor or a law firm is not subject to it.
Federally, the Accessible Canada Act covers federally regulated organizations: banking, telecommunications, interprovincial transportation, broadcasting and postal services, from ten employees up. It does not apply to provincially regulated businesses, which excludes the large majority of Quebec small businesses. A regulation registered on December 5, 2025 adds digital accessibility requirements, based on the CAN/ASC-EN 301 549 standard, with deadlines in December 2027 and December 2028. It covers federally regulated organizations with 100 employees or more. Businesses under 100 employees are excluded.
For a small business here, no general legal obligation to make the site accessible exists. Two situations change that, and both are worth checking: your business operates in a federally regulated sector, or you bid on public contracts, where the requirement comes from the tender itself.
An unusable site is still a bad site. A real share of your customers navigate by keyboard alone, with a screen reader, or with reduced vision. The baseline fixes, meaning sufficient contrast, working keyboard navigation and alt text on images, also serve general readability and search visibility. For you, accessibility is a business decision.
What gets added if you sell online
The moment a transaction closes on your site, the Consumer Protection Office enters with its rules on distance contracts. You then have to disclose a specific list of information before payment, send a copy of the contract within 15 days, honour cancellation rights, and strip out prohibited clauses such as mandatory arbitration or a forum outside Quebec.
The distance-contract rules do not apply to a brochure site. Other parts of the Consumer Protection Act follow you everywhere, including the rule on advertised prices: a merchant cannot charge more than the price displayed, "by any means whatever", website included. For a store the picture changes completely, and the full list is in what the law requires of an online store in Quebec.
Where to start
This order settles the most in the least time.
- ◆Open your site in French and walk through a complete path, from a service page to the confirmation email after a request. Note every string still in English, including inside forms and third-party tools.
- ◆Confirm your privacy policy exists, is reachable from every page, and is written in plain language.
- ◆Name the person responsible for the protection of personal information and publish their contact details on the site.
- ◆Inventory every tool collecting data on your site, and remove the ones nobody uses anymore.
- ◆If you send email, check that every message carries your contact details and an unsubscribe link, and that the list holds only people who consented.
- ◆If you sell online, work through the Consumer Protection Office list next.
On a new site, these get handled during the build and cost close to nothing. That is the default on every business website we deliver. If your site already exists and you want to know where you stand before committing to anything, our free 48-hour Law 25 diagnostic covers the points that can be verified on a website and comes back as a checklist, with no commitment attached.
This guide is a starting point and does not replace legal advice. Official sources were checked on September 1, 2026. For a specific situation, the Office québécois de la langue française on French, the Commission d'accès à l'information on personal information, and the Consumer Protection Office on sales rules remain the official references.
Ready to start your project?
Get a free, detailed quote in under 60 seconds. No commitment required.
Get a free quote in 60 seconds ↗Frequently asked questions
01Does my website have to be in French if my business is in Quebec?
Yes. Section 52 of the Charter of the French Language requires commercial documents available to the public to be in French, regardless of the medium, and the Office québécois de la langue française reads that as a right to a complete French version of the website. The word website appears nowhere in the section, which is exactly why so many owners never find it. An English version is allowed, provided the French version is complete and available on terms at least as favourable.
02Do I need a privacy policy on a simple brochure site?
If your site collects personal information, yes. A contact form is enough to trigger the obligation, and most brochure sites have one. Law 25 asks for two things that get confused: governance policies set internally, with detailed information about them published, and a confidentiality policy in clear and simple language as soon as collection happens by technological means. Add a designated person responsible for the protection of personal information and transparency at the moment of collection. A site that genuinely collects no personal information by technological means may not trigger this obligation. That site is rare, because server logs and analytics count too.
03Does my site have to be accessible to people with disabilities?
For the average Quebec small business, there is no general legal requirement. The Standard on Web Accessibility (SGQRI 008) applies to public bodies: government departments, budget-funded bodies, school service centres, CEGEPs, universities and the health network. Municipalities are not on the list. The Accessible Canada Act covers federally regulated organizations such as banks, telecommunications and interprovincial transportation. Two situations change the answer: your business operates in a federally regulated sector, or you bid on public contracts, where the requirement comes from the tender itself.
04Do these rules apply if my business is outside Quebec?
For the language obligation, the answer depends on the facts. The Charter reaches businesses carrying on activities in Quebec, and that can include a business based elsewhere, depending on its activities and its ties to the province. An outside business that actively sells to Quebecers should assume the rules can apply and have its situation checked. For Law 25, what matters is the collection of personal information in the course of a business carried on in Quebec. A borderline situation deserves professional advice.
05What is the actual risk?
On the language side, the offence is ignoring an order from the Office. The fine then runs from $3,000 to $30,000 for a business, doubling on a first repeat offence and tripling after that. Five businesses were fined $3,000 each between February and March 2026 over English-only websites. On the personal information side, the Commission d'accès à l'information can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and the penal route reaches $25 million or 4%. Those ceilings are built for large organizations. In a small business, what opens a file is almost always a complaint, and the first step from the regulator is usually an order to correct within a set time.
Related articles