Law 25 Consent Requirements: Clauses and Forms for Your Business
Obtain and document your clients' consent in a way that complies with Law 25.
The essentials
The consent required by Law 25 must be manifest, free and informed, given for specific purposes and requested for each of those purposes, in clear and simple language (s. 14, Act P-39.1).
When requested in writing, it must be presented separately from any other information: no consent buried in the terms of use, no pre-checked boxes.
For a minor under 14, consent is given by the parent or guardian. For sensitive information (health, finances, biometrics), consent must be express.
What the law says
Law 25 states that businesses must obtain free, informed and specific consent before collecting, using or communicating personal information, subject to the exceptions provided by law.
Consent must be:
- Clear and understandable (no legal jargon)
- Given for a specific use
- Revocable at any time
- Obtained separately for each purpose where required
Implied consent (e.g. "by continuing to use our site, you agree...") is limited and is not sufficient in many cases, especially when sensitive information is collected.
For a small business
Putting effective consent management in place allows you to:
- Ensure legal compliance
- Earn client trust
- Reduce legal risks in the event of a complaint
This can be done through:
- A paper form with a checkbox
- A digital option during an online sign-up
- A clear consent clause in a contract or confirmation email
Good to know
Pre-checked boxes do not constitute valid consent. The client must make an active gesture (check the box themselves, sign, click). In addition, consent for the newsletter must be separate from consent for the main service.
Concrete examples
Example 1: A gym has new members sign a registration form containing a separate section to consent to receiving promotions by email.
The member checks the box voluntarily and can withdraw their consent at any time by clicking the unsubscribe link in the emails.
Example 2: An e-commerce site presents two separate checkboxes during account creation:
- ☐ I accept the terms of use (required)
- ☐ I agree to receive promotional offers (optional)
The date and time of the consent are recorded in the database.
What this changes concretely on your website
Your cookie banner must offer a real choice: non-essential cookies (analytics, advertising) are only set after consent. Your forms must clearly state what the data will be used for, with a separate, unchecked box for each purpose that is not necessary for the requested service (a newsletter, for example).
Consent must also be revocable: an unsubscribe link in every newsletter and a simple procedure described in your privacy policy. The withdrawal is recorded, and the person stops being solicited.
Consent practices: valid or not
| Practice | Verdict | Why |
|---|---|---|
| Separate, unchecked checkbox for the newsletter | Valid | Active gesture, specific purpose, presented separately |
| Pre-checked box in a form | Invalid | Consent must be manifest: an active gesture is required |
| Blanket consent buried in the terms of use | Invalid | It must be presented separately from any other information |
| Cookie banner with a real choice to accept or refuse | Valid | Non-essential cookies wait for consent |
| Consent given by a 13-year-old minor | Invalid | Under 14: consent comes from the parent or guardian |
Mistakes to avoid
- Bundling several consents into one undetailed block
- Assuming consent is acquired indefinitely
- Not clearly explaining what each data collection is for
- Not documenting the date and method of consent
Step-by-step instructions
Checklist: Step 8 complete?
- I have identified every situation requiring consent
- My consent clauses are clear and specific
- Consent is obtained actively (checkbox, signature)
- I document the date and method of each consent
- My clients can easily withdraw their consent
- My forms are up to date with the legislation
Templates included in the Law 25 Kit
- Website Consent Clauses template
- Personal Information Collection Consent Form template
- Personal Information Collection Consent Withdrawal Form template
Your cookie banner shows the right text, but does it actually block scripts before consent? RayV configures and tests it for you, with proof to back it up. Flat rate of $495.
Get my banner implementedFrequently asked questions
Is a pre-checked box valid?
No. Consent must be manifest: it results from an active gesture by the person. A box that is already checked, consent presumed by default or buried in the terms of use does not satisfy the law.
How long is consent valid?
Only for the time necessary to achieve the purposes for which it was requested. If you want to use the data for a new purpose, you need new consent.
Can a 15-year-old minor consent on their own?
Yes. From age 14, a minor can give consent themselves (the parent or guardian can too). Under 14, only the holder of parental authority or the guardian can consent.
Is consent always necessary?
No. Collection necessary to deliver the requested service does not require separate consent, and the law provides specific exceptions. The practical rule: as soon as the use goes beyond what the person would naturally expect, ask for specific consent. The details are on the CAI's consent page.