Quebec Law 25, PIPEDA reform, and global privacy standards have made cookie consent a real legal issue. We review or revise yours — flat-fee, Canadian-law focused.
Choose Review Only for a written memo of issues identified, or Review and Edit for a fully revised Cookie Policy with tracked changes.
Quebec's Law 25 has specific requirements for cookie consent. PIPEDA reform is on the horizon. We make sure your policy is ahead of the curve.
Drafts checked for Ontario jurisdiction, PIPEDA privacy compliance, Consumer Protection Act requirements, and enforceable limitation of liability.
Review Only in 2-3 business days. Review and Edit in 3-5 business days. Urgent options available.
Ready to skip the reading? Send us your draft now.
Cookie consent banners and Cookie Policies have moved from “nice to have” to a real Canadian legal issue. Quebec’s Law 25 imposes specific obligations. The federal PIPEDA reform proposals (Bill C-27 and its successors) would tighten requirements further. International users also bring GDPR exposure.
Most Cookie Policies on Canadian websites are either GDPR templates pasted in wholesale, or AI-generated boilerplate that does not address Canadian law specifically. Both leave gaps and create unnecessary complexity.
At Onley Law, we review Cookie Policies and consent banners against Canadian privacy law requirements — not GDPR-by-default. Two service tiers depending on how much help you need.
What it includes: A complete legal review of your existing Cookie Policy. We provide a written summary of issues identified, risks flagged, and specific recommendations for changes — delivered as a clear memo you can act on.
Best for: Businesses that have an internal team who can implement edits, and want a legal second opinion before going live.
Turnaround: Typically 2-3 business days. Flat-fee pricing provided after document review.
What it includes: Everything in the Review Only option, plus a fully revised version of your Cookie Policy returned as a Word document with tracked changes. Every edit is visible so you know exactly what changed and why.
Best for: Businesses that want a finished, lawyer-revised document ready to use — not just a list of issues to fix themselves.
Why tracked changes? Transparency. You should see every revision a lawyer makes to your document, with full ability to accept or reject any edit.
Turnaround: Typically 3-5 business days. Flat-fee pricing provided after document review.
Choose Review Only or Review and Edit — we will quote within one business day.
Cookie Inventory: A clear, current list of cookies and similar tracking technologies used on your site — including those set by third parties like analytics providers and ad networks.
Purpose Categorization: Cookies should be grouped by purpose (strictly necessary, performance/analytics, functional, advertising/targeting). This drives consent logic.
Consent Mechanism: How users grant or refuse consent. Under Quebec Law 25, consent must be specific and granular for non-essential cookies. Pre-checked boxes are not valid consent.
Third-Party Disclosures: Identify the third parties whose cookies are set on your site — Google Analytics, Meta Pixel, ad networks, customer support tools, etc.
Cookie Duration: Disclose how long each cookie persists (session vs. persistent, retention periods).
User Controls: How users can withdraw or change consent. Many policies fail this — the withdrawal mechanism must be as easy as the granting mechanism.
Cross-Border Data Transfers: If cookies result in data being processed outside Canada (Google Analytics, most ad networks), this must be disclosed.
Quebec Law 25 Specifics: Quebec users must be able to opt out of profiling and tracking. The Cookie Policy should reflect this.
Update Process: How and when the Cookie Policy is updated as your cookie inventory changes.
Any Business Using Analytics or Ad Tech: Google Analytics, Meta Pixel, LinkedIn Insight Tag, Microsoft Clarity, Hotjar — if you use any of these, you have cookie consent obligations.
Businesses with Quebec Users: Law 25 requires specific cookie consent practices that differ from federal PIPEDA. If you have Quebec users, your Cookie Policy needs Quebec-specific provisions.
E-Commerce Sites: Shopping cart cookies, recommendation engines, retargeting pixels, and conversion tracking all need disclosure and (often) consent.
SaaS Companies with Authenticated Apps: Authentication cookies, session management, in-app analytics, and feature flags all need to be addressed.
Anyone Running International Traffic: EU users trigger GDPR. UK users trigger UK GDPR. U.S. state laws (California, Virginia, Colorado, etc.) impose various requirements. A well-drafted Cookie Policy can address multiple regimes coherently.
Canadian cookie consent law is not a single statute — it is the intersection of PIPEDA, provincial privacy law (especially Quebec’s Law 25), and the federal Office of the Privacy Commissioner’s guidance. The regulatory direction is clearly toward more specific consent, more granular controls, and more transparent disclosures.
A Cookie Policy drafted three years ago — or generated by AI today — is likely behind the current Canadian regulatory expectations. A review brings it up to date.
Most businesses need both. The consent banner handles the just-in-time consent moment. The Cookie Policy provides the detailed disclosure of what cookies are used and why. They work together.
Usually not. Generic consent banners cover the basics but rarely match your actual cookie inventory. They also typically do not address Quebec Law 25 specifics or your third-party processor relationships.
Cookies trigger personal information collection, so your Cookie Policy and Privacy Policy must align. The Cookie Policy is a more detailed look at one specific data collection mechanism.
The current Canadian framework is more flexible than the EU on this — implied consent for analytics has historically been acceptable. But Quebec Law 25 and the direction of federal reform are pushing toward explicit consent for non-essential tracking. Best practice is to seek consent.
Yes. The Cookie Policy is part of a complete website legal package — we offer the same flat-fee review service for Privacy Policies, Terms & Conditions, Acceptable Use Policies, Master Services Agreements, and Data Processing Agreements.
Send us your draft Cookie Policy and (optionally) your consent banner setup using the form below. We will provide a flat-fee quote within one business day.
No retainer required. No billable-hour surprises.
Tell us about your draft below. We will reply within one business day with a flat-fee quote and instructions for sending us your document (if you have one ready). No retainer required. No billable-hour surprises.
The legal foundation of your website — governs user relationship, IP, liability
PIPEDA and Quebec Law 25 compliance for your privacy disclosures
Enforceable conduct rules and termination rights for your platform
B2B contract governing your most important commercial relationships
Privacy addendum required by enterprise customers and regulated industries
At Onley Law, we’re entrepreneurs like you, specializing in Business Law to address your unique challenges and get business done.
Contact us for a free, no-obligation consultation, and let’s navigate the legal landscape together, empowering your business to thrive.
With our office located in downtown Oshawa, we work in the heart of one of Ontario’s most historic, hardworking cities – powered by builders and doers.
Operating inside the Spark Centre, we operate and work alongside entrepreneurs inside Durham’s top business accelerator.
Find us at: 2 Simcoe Street South, Suite 300, Oshawa, Ontario, L1H 8C1.
© 2026 Onley Law Professional Corporation. All rights reserved.
Fractional GC | Contracts | M&A | IP & Trademarks | Contact
