A chatbot collects names, emails and sometimes phone numbers: that is personal information. In Quebec, Law 25 governs how it is collected, kept and shared. This guide sums up what Law 25 requires from a website chatbot, what changes for European visitors (GDPR), and how ChatDirect helps you meet those requirements.
- Quebec's Law 25 applies to the personal information a website chatbot collects, such as names, emails and phone numbers.
- Law 25 expects transparency, consent, minimization, security, limited retention, individual rights and a privacy impact assessment for transfers outside Quebec.
- ChatDirect hosts conversations, leads and documents in Canada, but message content is sent to the AI provider you choose to generate each answer.
- No tool makes a business compliant on its own: your privacy policy, your privacy officer and your processes remain your responsibility.
What Does Quebec's Law 25 Require From a Chatbot?
- Transparency — visitors know they are talking to an AI and who collects their information.
- Consent — obtained clearly, for specific purposes, before personal information is collected.
- Minimization — the chatbot only asks for what it needs.
- Security — data is protected according to its sensitivity.
- Limited retention — conversations are not kept forever.
- Individual rights — access, correction and deletion on request.
- Transfers outside Quebec — when information is shared outside Quebec (for example with an AI provider), a privacy impact assessment is expected.
Law 25 vs. GDPR at a Glance
| Aspect | Law 25 (Quebec) | GDPR (Europe) |
|---|---|---|
| In force | 2022–2024 (phased) | May 2018 |
| Scope | Businesses collecting information in Quebec | People located in the EU |
| Consent | Manifest, free and informed | Freely given, specific, informed and unambiguous |
| Accountability | Person in charge of the protection of personal information | DPO in some cases |
| Maximum penalties | $25M or 4% of worldwide turnover | €20M or 4% of worldwide turnover |
| Transfers abroad | Privacy impact assessment | Adequacy decision or appropriate safeguards |
If you also serve customers in Europe, read our guide on GDPR compliance for chatbots.
How ChatDirect Helps: 7 Built-In Protections
ChatDirect was built on the Privacy by Design principle. These settings are managed from your client portal:
- Consent — a customizable consent message can appear before the conversation, with a link to your privacy policy.
- No cookies by default — the widget session uses the browser’s sessionStorage, cleared when the tab closes.
- IP anonymization — four modes: none, partial, full or no storage.
- Configurable retention — 30, 60, 90 days or a custom period, with automatic deletion.
- Conditional Google Analytics — tracking only starts after the visitor consents.
- Export and deletion — extract or erase a visitor’s data on request.
- Hosting in Canada — servers in Beauharnois (Quebec) and a database in Montreal; secrets such as API keys are encrypted (AES-256) and connections use HTTPS.
Each client’s data is isolated: no client can ever see another client’s data.
The Point Not to Miss: Your AI Provider
Conversations, leads and documents stay hosted in Canada. However, to generate each answer, message content is sent to the AI provider you choose (Anthropic, OpenAI, Google or Mistral), whose processing may take place in the United States or Europe. Mention it in your privacy policy, include it in your privacy impact assessment, and avoid asking the chatbot for sensitive information it does not need. Details are in section 4 of our privacy policy.
Checklist for Your Chatbot
- Visitors are told they are talking to an AI (the widget shows an AI Agent label).
- Consent is obtained before personal information is collected.
- Your privacy policy mentions the chatbot, its purposes and the AI provider.
- Cookies are absent or subject to consent.
- IP anonymization is set to the level you need.
- A retention period is defined.
- You know how to export and delete a person’s data.
- A person in charge of personal information is designated.
- Your privacy impact assessment covers the AI provider.
- Portal access is limited to the people who need it.
Want a quick check? Run our free Law 25 compliance checker.
Frequently Asked Questions
Does a chatbot have to say it is an AI?
Yes. Transparency is expected in Quebec and in Europe: visitors should know they are talking to an AI agent and who is collecting their information. The ChatDirect widget shows an AI Agent label next to the bot's name.
Does my chatbot data leave Canada?
Conversations, leads and documents are hosted in Canada (servers in Beauharnois, database in Montreal). However, message content is sent to the AI provider you choose (Anthropic, OpenAI, Google or Mistral) to generate the answer, and that processing may happen outside Canada. Mention it in your privacy policy.
Does ChatDirect make my website Law 25 compliant?
No tool makes a business compliant on its own. ChatDirect is designed to help you meet Law 25 and GDPR requirements (consent, no cookies by default, IP anonymization, configurable retention, export and deletion), but your privacy policy, your privacy officer and your processes remain your responsibility.
How can I check my website quickly?
Use our free Law 25 checker: it reviews the key points of Law 25 for a website in a few minutes and tells you what to fix.
Conclusion
Law 25 does not ban chatbots: it asks for transparency, consent and restraint. ChatDirect, an AI chatbot and CRM, is designed to help you meet those requirements for both conversations and the leads in its CRM, with simple settings and data hosted in Canada. The rest — your policy, your privacy officer, your assessment — is yours, and our Law 25 checker helps you take stock.