Quebec Law 25 and Live Chat: Website Chat Checklist

Quebec Law 25 and live chat meet at a simple point: a visitor from Quebec types a message to your business, and the message contains personal information. Law 25, the Quebec act that modernised the province’s private-sector privacy rules, applies to enterprises that collect personal information from people in Quebec, even if the business is based elsewhere. A website chat is one of the places where that collection happens every day. This guide explains in plain language what the law asks, applies it to a chat widget and gives a checklist you can complete in an afternoon.

Talkmio is an AI live chat for websites. Its assistant, Mio, answers visitors from your content and hands the conversation to your team when needed. We explain the privacy side so you can document your own choices. This is practical information, not legal advice, and the law has details and exceptions, so ask a Quebec lawyer or your privacy officer to review anything that matters.

Quebec Law 25 and Live Chat: The Short Version

Law 25 changed Quebec’s private-sector privacy law in stages between 2022 and 2024. For a business with a website chat, the points that matter most are these:

someone in the organisation is responsible for privacy, and their title and contact details are published on your website;
you publish a privacy policy in clear and simple language that describes your practices;
you collect, use and share personal information on the basis of valid consent, unless the law provides an exception;
you assess privacy risks before certain projects and before sending information outside Quebec;
you keep a register of privacy incidents and report serious ones;
people can access their information, ask for corrections and, in some cases, ask you to stop using it;
you explain when decisions are made only by automated processing.

Quebec’s regulator is the Commission d’accès à l’information, and its official website publishes guidance in French and English. For the national picture, the Office of the Privacy Commissioner of Canada has a page on privacy laws in Canada, and our article on PIPEDA and live chat covers the federal law.

Does Law 25 Apply to Your Chat?

If you operate an enterprise in Quebec or collect personal information from people in Quebec in the course of business, assume that it can apply. Location of your servers or your head office does not decide it by itself. A shop in Lithuania that sells to Montreal customers is in a different position from a local blog with no commercial activity there, but the safest approach for a business that serves Quebec is to meet the standard.

The chat counts because it handles personal information: message text, an e-mail address or name if the visitor gives them, technical details such as the page, device and country, and anything else a visitor decides to type. It does not matter that the conversation is short or informal.

Quebec Law 25 and Live Chat: Checklist for a Website Chat

Requirement	What it means for your chat	What to do
Person in charge of privacy	Someone answers for how the chat handles data	Name the person and publish their title and contact details on your site
Privacy policy	Visitors can read what you do, in plain language	Add the chat: purposes, data, recipients, retention, how to ask questions
Consent	Valid consent where consent is the basis for processing	Do not hide consent in a long text; keep optional uses separate
Privacy impact assessment	Required for some projects and for transfers outside Quebec	Write a short assessment of the chat and its processors
Incident register	Keep a record of incidents, report serious ones	Include chat data in your incident procedure
Access and correction	People can ask what you hold	Know where chat data sits and who retrieves it
Automated decisions	Tell people when a decision is made only by automated processing	Keep Mio to answering from your content, and hand decisions to people
French	Commercial websites aimed at Quebec are expected to work in French	Offer French content, and test the chat in French

Treat the table as a starting list. Details such as deadlines, thresholds and the exact content of notices are in the law and in the regulator’s guidance.

The Privacy Officer and the Public Notice

Law 25 requires a person responsible for the protection of personal information. By default this is the person with the highest authority in the organisation, who may delegate the role in writing. Publish the title and the contact details on your website, so that anyone can reach the right person. Put the same details into the chat: a link in the welcome text or footer of the widget that leads to your privacy page is enough.

The privacy policy must be written in clear and simple language. Describe the chat by name, say what you collect, why, who sees it, how long you keep it and how to ask questions or exercise rights. Our guide to the live chat privacy policy gives wording you can adapt, and you should change it to match your own processing.

Consent and What Visitors Expect

When a visitor starts a chat to ask a question, many organisations treat the visitor’s action and the context as supporting the use of the message to reply. Still, Law 25 puts weight on clear, informed consent, requested for specific purposes, and separately from other information. Keep this simple:

use the chat messages to answer the visitor and to handle the request, and say so;
ask separately before you use the e-mail address for anything else, such as a newsletter;
do not use chat transcripts for marketing or training without a clear basis and notice;
keep the pre-chat form as short as possible. In Talkmio it can be none, optional or required, and the shortest form that works is the safest.

The law also says that technology with the ability to identify, locate or profile people should be off by default. A chat widget is not a profiling tool, but if you add tracking or advertising scripts around it, review that separately. Our guide to cookies and consent for chat widgets explains how to treat the widget in relation to your consent banner.

Privacy Impact Assessment and Transfers Outside Quebec

Law 25 asks for an assessment of privacy-related factors in certain situations, including before you communicate personal information outside Quebec. A chat provider and the AI model provider behind an assistant are likely to process data elsewhere. The assessment is a short document that records what is sent, where, to whom, the safeguards and the risks. Ask your provider for the facts and keep them with your records.

Here are the facts for Talkmio. Data is stored on servers in the EU (Germany). Only the conversation text and relevant knowledge base excerpts are sent to the AI model provider that produces the answer. You can export or delete your data at any time by writing to [email protected]. Mio answers only from your website, FAQ and uploaded documents. Use these facts as inputs and complete the assessment for your own business.

Incidents, Access Requests and Retention

Include the chat in your incident procedure. If a browser extension, an agent’s lost laptop or a misdirected e-mail exposes chat data, the incident register and notification rules apply. The Inbox is protected by roles: Agents handle conversations, Admins also manage websites, Mio and settings, and the Owner handles billing. Give each person the lowest role they need.

For access and correction requests, know how you will find a person’s conversations. Contacts in Talkmio keep everyone who wrote, with their conversation history, and search by name, e-mail or text helps. Our article on data subject access requests in live chat describes a simple routine. Decide how long you keep conversations, and delete on schedule, because keeping everything forever is hard to defend.

Questions to Ask Any Chat Provider

Whichever tool you use, your assessment depends on what the provider tells you. Ask these questions in writing and keep the answers with your records.

Where is chat data stored, and which countries can access it?
Which sub-processors receive conversation content, and for what purpose?
Is any conversation content used to train models, and can that be switched off?
How long is data kept, and can you delete a conversation or a contact on request?
How do you export data for an access request?
How are staff accounts protected, and can roles be limited?
How will you be told about an incident, and how quickly?

A provider that answers clearly and quickly is a good sign. A vague answer is a reason to look again. Do not accept “we are compliant” as an answer on its own; ask for the specific facts behind it, and note the date you received them, because practices change and your assessment should be reviewed when they do. For the wider question of how a processor agreement fits in, read our article on the data processing agreement for live chat.

French and Quebec Visitors

Quebec’s language rules expect businesses that sell to consumers there to serve them in French, and the Charter of the French Language has been strengthened in recent years. Check the current requirements for your situation. For a chat, the practical message is to be ready in French. Mio replies in the language the visitor writes in, including French, and the widget is translated, so a visitor can write in French and be answered from a page written in English or French. Put French versions of your privacy, delivery and returns pages in the knowledge base, and test with a native speaker. Our guide to the French market covers vocabulary and tone.

Steps You Can Complete This Week

Name the person responsible for privacy and publish their details.
Update the privacy policy with a clear paragraph on the chat.
Set the pre-chat form to the shortest option that works.
Write a one-page assessment covering the chat, its processors and the countries involved.
Add the chat to the incident and access request procedures.
Add French content and test Mio in French.
Choose a retention period and delete on schedule.

Frequently Asked Questions

Does Quebec Law 25 apply to a live chat on my website?

It can, if your business collects personal information from people in Quebec. A chat handles message text, contact details if given and technical data, so treat it as in scope. Where you are based does not settle the question by itself, so ask a Quebec lawyer if the details matter.

Do I need a privacy officer for a small business?

Law 25 requires someone to be responsible for protecting personal information. By default it is the person with the highest authority, who may delegate in writing, and the title and contact details must be published on your website. Check the exact rules with the regulator or a lawyer.

Do I need a consent banner for the chat?

Consent under privacy law and consent for cookies are separate questions. Check what the widget stores on the visitor’s device and when it loads, and publish a clear notice. Keep optional uses, such as newsletters, separate from the conversation and ask for consent for them specifically.

Is a privacy impact assessment required for a chat widget?

Law 25 requires assessments in some situations, including before communicating personal information outside Quebec. A chat provider and an AI model provider may process data elsewhere, so a short written assessment is a sensible step. Record what is sent, where, to whom and the safeguards.

Where does Talkmio store chat data?

On servers in the EU (Germany). Only the conversation text and relevant knowledge base excerpts go to the AI model provider that produces the answer. You can export or delete data at any time by writing to [email protected]. Use these facts in your own assessment and privacy notice.

Can the chat work in French for Quebec visitors?

Yes. Mio replies in the language the visitor writes in, including French, and the widget is translated. Add French versions of your key pages to the knowledge base, test with a native speaker and check the current French-language requirements for your business in Quebec.

The Bottom Line

Quebec Law 25 and live chat can be handled with a short list: a named privacy officer, a clear notice, careful consent, a written assessment, an incident routine and French content. None of it is exotic, and most of it is good practice anywhere. Review your setup once a year and whenever you change what the chat collects. Start free with Talkmio, set the pre-chat form to the minimum and test Mio in French with your own content.

Quebec Law 25 and Live Chat: A Checklist for Website Chat