Executive Summary

Quebec Law 25 (the operative name for what began as Bill 64) reached full force on September 22, 2024, when the data portability right turned on. All three phases now apply to any warranty operator handling Quebec consumer information.¹

The penalty stack is the most aggressive in Canada: administrative monetary penalties up to CAD 10 million or 2 percent of global turnover, penal fines up to CAD 25 million or 4 percent, and a private right of action with a CAD 1,000 statutory minimum per individual.²

Bill 96 (the Charter of the French Language as amended) requires adhesion warranty contracts to be presented in French first since June 1, 2023, with francization obligations expanded to firms with 25 or more Quebec employees on June 1, 2025.³

The CAI is now using its new powers. The Metro Inc. facial-recognition prohibition on February 18, 2025 and the September 2024 printing-company biometric order are the first AMP-era signals.⁴

All Shield supports partners who carry Quebec authority by providing a compliance-forward, bilingual, custom warranty platform behind their consumer-facing program.

Download the Quebec Law 25 Warranty Compliance Checklist (PDF)

A regulator that is no longer warming up

On February 18, 2025, the Commission d’accès à l’information du Québec (CAI) issued a decision against Metro Inc., the grocery and pharmacy operator, prohibiting a proposed facial recognition pilot for loss prevention. The CAI applied the strict “necessity and proportionality” test to biometric processing and refused to let the program proceed, citing Loi 25 garantie-style consumer protections under the modernized statute.⁴ Six months earlier, in September 2024, the same regulator ordered a printing company to halt employee facial recognition access controls.⁵

These are not theoretical exposures. They are post-amendment decisions from a regulator that now holds administrative monetary penalty authority up to CAD 10 million or 2 percent of global turnover, plus penal fines up to CAD 25 million or 4 percent of global turnover, plus a private right of action with a CAD 1,000 statutory minimum per affected individual.²

For a warranty program selling into Quebec, the Quebec Law 25 warranty question is no longer a planning exercise. It is an operating reality.

A direct disclosure on All Shield’s role in Quebec

Before going further, two facts that matter to every reader of this piece.

All Shield’s role in Quebec depends on the program structure. For vehicle service contracts, self-insurance in Quebec is permissible. For warranty programs, a bond and fund structure may be required. All Shield provides a custom warranty platform that licensed Quebec partners use to deliver compliance-forward, bilingual programs to Quebec consumers under their own authority. The compliance load described in this article is borne by those licensed partners. All Shield’s job is to make the underlying program design, document delivery, consent capture, and claims workflow easier for the partner to keep in line with both Law 25 and Bill 96. Every Quebec recommendation below assumes that partner model.

That distinction matters because Quebec exposure has two layers. The first is the data inside the warranty record. The second is the language of the warranty document itself. The partner carries the regulated relationship with the Quebec consumer. All Shield builds the operational machinery underneath it.

Who this article is for

This playbook is written for four operator profiles:

• Canadian warranty leaders whose programs already touch Quebec residents, and who need a clean 2026 view after the Phase 3 rollout
• Canadian and US brands selling extended service contracts, product protection plans, or service warranties into Quebec without a Quebec licensee on the cap table
• Compliance and legal counsel who own privacy obligations across PIPEDA, Law 25, and Bill 96 in parallel
• Product and CX leaders responsible for the consumer-facing warranty journey and the consent moments inside it

If your program is read by a Quebec resident, processed by a system that holds personal information about a Quebec resident, or sold under any French-language obligation, this article is for you.

The three-phase Law 25 timeline

Quebec modernized its private-sector privacy regime in three steps. Anchoring each phase to its effective date is the cleanest way to scope what already applies to a warranty program in 2026.

Phase 1, September 22, 2022. Mandatory designation of a privacy officer, mandatory disclosure of any biometric data system, confidentiality incident reporting to the CAI, and the requirement to maintain an incident register.⁶

Phase 2, September 22, 2023. The substantive obligations. Granular consent rules, transparency requirements, mandatory privacy impact assessments before high-risk processing, cross-border transfer rules, the automated decision-making notice obligation, the right to de-indexation, the right to rectification, and the full administrative monetary penalty regime.⁶

Phase 3, September 22, 2024. The right to data portability for computerized personal information. A consumer can demand a structured, commonly used technological export of the data a warranty operator holds about them.⁷

The three-year ramp is over. There is no “we are still getting ready” runway left in the statute.

Law 25 in plain English for warranty operators

Stripping out the section numbers, Law 25 turns on six operating duties.

Manifest consent. Consent for collecting personal information must be free, informed, given for specific purposes, and granular. A warranty enrollment form cannot bundle warranty administration consent with marketing consent or third-party data sharing consent. Each purpose is its own checkbox. Tracking technologies require express opt-in before activation.¹

Transparency. Every consumer must be told, at the moment of collection, what is being collected, why, who will receive it, how long it will be kept, and where it will be processed. The privacy officer’s name and contact information must be public.

Privacy impact assessments. Before any project involving the acquisition, development, or overhaul of an information system that handles personal information, the operator must run a privacy impact assessment. Warranty platform migrations, claims-system replacements, and new analytics products all sit inside this rule.

Cross-border transfers. Sending Quebec personal information outside the province, including elsewhere in Canada and to the United States, requires a documented assessment that the receiving jurisdiction provides adequate protection, plus a written agreement that memorializes the transfer. This is the single most overlooked obligation by US-headquartered warranty platforms.⁸

Automated decision-making. Under Section 12.1, if a decision is based exclusively on automated processing, the consumer must be informed at the time of the decision, given the principal factors and parameters used, and offered the right to submit observations to a human reviewer. AI-assisted claims adjudication is permitted but must be disclosed and contestable.⁹

Confidentiality incident notification. A confidentiality incident is any unauthorized access, use, communication, or loss of personal information. If it presents a risk of serious injury, the operator must notify the CAI and the affected individuals “with diligence,” which the practitioner standard treats as 72 hours or sooner. An incident register must be maintained for five years.¹⁰¹¹

Read together, these duties reshape the warranty enrollment screen, the claims portal, the data warehouse, the vendor stack, and the incident-response runbook. They are not bolt-on compliance items. They are program design choices.

The Bill 96 layer: where most Quebec warranty programs lose

Law 25 governs the data inside the warranty record. The Charter of the French Language, as amended by Bill 96 in 2022, governs the warranty document itself, the consumer interface, and the post-sale communications. This second axis is the most under-covered piece of the Quebec warranty conversation and the one operators most often miss. It is also the angle where licensed Quebec partners and a bilingual administration platform create the cleanest authority story.

The French-first rule for adhesion contracts. Since June 1, 2023, standard-form consumer contracts in Quebec, including warranty contracts, must be delivered to the consumer in French before any other language version can be agreed to. The consumer cannot be required to consult an English version before they have had the French version. They may then opt to proceed in English on their own choice, but the French version has primacy by default.³¹²

Product documentation and labels. Inscriptions on products, product labels, packaging, and accompanying documents sold in Quebec must be in French. A French translation of the warranty has to travel with the product. Online warranty sales pages and claim portals must offer a French version equivalent in quality and prominence to any other language.

The 25-employee threshold. On June 1, 2025, the francization obligation expanded to enterprises with 25 or more employees in Quebec, down from the previous 50-employee threshold. Expanded translation requirements for product packaging and documentation took effect at the same time.¹³¹⁴

OQLF penalty exposure. The Office québécois de la langue française can issue orders, refer matters for prosecution, and seek suspension of e-commerce activity, including for businesses located outside Quebec. Fines range from CAD 3,000 to CAD 30,000 per violation, doubled for repeat offenses, with each day of non-compliance counted as a separate offense.¹⁵

The stacking risk. A non-bilingual warranty journey that also collects personal information can trigger both an OQLF action under Bill 96 and a CAI proceeding under Law 25 for the same consumer event. One enrollment screen, two regulators. This is why a Quebec partner who already runs French-first workflows, backed by a platform built for bilingual delivery, is materially less expensive than retrofitting an English-only stack.

PIPEDA vs. Law 25 vs. Bill 96: a quick-compare table

A warranty operator selling into Quebec sits inside all three regimes at once. PIPEDA does not stop at the Quebec border; Law 25 governs the data; Bill 96 governs the language. Designing for any one of them in isolation is the most common operator mistake.

Warranty-specific implications: where each rule lands in the program

Each obligation maps to a specific moment in the warranty lifecycle.

At enrollment. Consent must be granular and unbundled. Warranty administration is one purpose; analytics is another; partner marketing is a third. Each gets its own opt-in. The French version of the enrollment screen must lead, with English available on consumer choice. The privacy notice has to state the purposes, the categories of personal information, the retention period, the cross-border transfer destinations, and the privacy officer’s contact information.

At claims intake. If any element of the decision flow is automated, including triage routing, eligibility scoring, or fraud-risk scoring, the Section 12.1 disclosure must appear at the time of the decision. The consumer needs to know the principal factors used and how to ask for human review. AI-assisted claims adjudication is permitted; silent AI claims adjudication is not.⁹

At cross-border processing. If warranty data is hosted, analyzed, or supported outside Quebec, including elsewhere in Canada and the United States, a documented privacy impact assessment must show the receiving jurisdiction provides adequate protection. A written agreement must memorialize the transfer. The PIA is not a one-time exercise; it travels with the vendor relationship.⁸

At a confidentiality incident. Once a confirmed incident presenting a risk of serious injury is identified, the operator must notify the CAI and the affected consumers “with diligence.” The practitioner standard treats that as 72 hours or sooner. The incident register must capture each incident and be retained for five years from awareness.¹¹

At a portability request. Since September 22, 2024, a Quebec consumer can request their warranty record in a structured, commonly used technological format. The export covers purchase data, coverage terms, claims history, and any computerized personal information held by the operator. The receiving system can be specified by the consumer.

At end-of-purpose. Personal information must be destroyed or anonymized once the purpose for which it was collected is achieved. Warranty registration data parked in a CRM forever, without a defined destruction trigger, is a Law 25 finding waiting to happen. The May 2024 anonymization regulation raised the bar for what counts as fully anonymized versus merely de-identified.¹⁶

At every consumer-facing asset. The warranty certificate, terms and conditions, claim forms, denial letters, status emails, and consumer-facing portal must be available in French and presented in French first under Bill 96. A claim portal that loads in English by default for a Quebec IP address is an OQLF exposure even before any Law 25 question is raised.

Recent CAI enforcement: the last 18 months

The CAI has shifted from guidance to action. Five developments deserve board attention.

February 18, 2025. Metro Inc. facial recognition prohibition. The CAI ordered the grocery and pharmacy chain to halt a proposed facial recognition pilot for loss prevention. The decision applied a strict necessity-and-proportionality test and is widely read as the first major signal of the post-AMP regulator.⁴

September 2024. Printing-company biometric order. The CAI ordered a printing operator to cease employee facial recognition access controls. The decision confirmed that biometric processing inside the workplace falls inside the modernized regime and that the regulator will read biometric provisions broadly.⁵

September 30, 2024. CAI 2023 to 2024 annual report. The CAI received 503 complaints regarding access and rectification requests and addressed 377 during the fiscal year. The volume signals an active complaints docket and a regulator with a workload that scales.¹⁷

May 27, 2025. CAI ends public incident list. The CAI stopped publishing its public list of organizations that reported confidentiality incidents. Reporting obligations are unchanged; only the public-list optics shift.¹⁸¹⁹

June 1, 2025. Bill 96 francization expanded. The francization obligation extended to enterprises with 25 or more Quebec employees, and translation requirements for product documentation broadened. The OQLF now reaches deeper into mid-market operators.¹³

The pattern is clear. The CAI is using its new authority. The OQLF perimeter is expanding. A warranty program that was acceptable in 2022 is now exposed on multiple axes.

Penalty exposure callout: board-ready CAD numbers

Quebec exposure stack for a non-compliant warranty program

• Law 25 administrative monetary penalty: up to CAD 10 million or 2 percent of preceding-year global turnover, whichever is greater
• Law 25 penal fine: up to CAD 25 million or 4 percent of preceding-year global turnover, whichever is greater, with a CAD 15,000 floor per violation
• Law 25 private right of action: CAD 1,000 statutory minimum damages per affected individual, available as a class action vehicle
• Bill 96 OQLF fines: CAD 3,000 to CAD 30,000 per violation, doubled for repeat offenses, with each day of non-compliance counted separately
• CAI prosecution window: five years from commission of the offence²¹⁵

For a mid-market warranty operator selling into Quebec, the AMP ceiling alone exceeds total annual program profit. That is the math that drives the partner-model conversation below.

The 2026 compliance checklist: a five-step operational playbook

A working program needs a runbook, not a memo. The five steps below are the minimum operational set for any warranty program with Quebec consumer exposure in 2026. Each step is durable, repeatable, and auditable.

Step 1. Map every place Quebec personal information enters, sits, and leaves your program. Identify every collection point (enrollment, claims, support, marketing), every storage location (CRM, claims system, data warehouse, archives), and every onward transfer (vendors, analytics, partners). Document where each system is hosted. The map is the foundation for every privacy impact assessment that follows. Allocate two weeks for a mid-market program.

Step 2. Designate a privacy officer and publish their contact information. The role can be internal or assigned to a licensed Quebec partner under written agreement. Either way, the name and contact information must be public on the consumer-facing site. Inside the program, the privacy officer owns the incident-response runbook, the PIA library, the access-and-rectification request workflow, and the regulator-correspondence channel.

Step 3. Rebuild the consent journey for granular, French-first delivery. Replace any bundled consent checkbox with per-purpose, per-category consent. Default the journey to French for Quebec consumers; offer English as an explicit consumer choice. Capture the consent record with timestamp, language version shown, and purposes selected. Refresh the consent capture for every material change to processing.

Step 4. Stand up a privacy impact assessment workflow for cross-border transfers and automated decision-making. Any flow of Quebec personal information outside Quebec needs a PIA with documented adequacy assessment and a written agreement with the receiving party. Any claims-decisioning system that uses automated processing needs a Section 12.1 notice, a documented description of the principal factors, and a human-review path. Both PIA libraries live with the privacy officer.

Step 5. Run the incident-response runbook end-to-end at least once a year. A confidentiality incident triggers a 72-hour notification clock to the CAI and to affected consumers when the incident presents a risk of serious injury. The runbook must specify the triage criteria, the legal-review checkpoint, the consumer-notice templates in French and English, the CAI submission process, and the incident-register entry. Tabletop the runbook with the licensed Quebec partner annually. Retain incident-register entries for five years from awareness.

A program that has all five steps operating is in materially better shape than the median Quebec-exposed warranty operator in May 2026.

How custom warranty programs and licensed partners absorb the compliance load

The Quebec exposure stack is heavy. The operator-side answer is rarely to build the entire compliance machine in-house. The partner model exists because the regulatory load and the language obligation are easier to carry inside a Quebec-licensed administrator with a bilingual platform behind them.

This is where All Shield’s role becomes specific. All Shield provides the underlying custom warranty platform that a licensed Quebec partner can use to deliver Law 25 and Bill 96-compliant programs. The partner carries the regulated relationship. All Shield carries the operational infrastructure.

Three elements of that infrastructure matter most for Quebec:

• Bilingual delivery by default. Warranty certificates, terms, claim forms, denial letters, status emails, and consumer portals are built to lead in French and offer English on consumer choice, with consent capture that records which language version was presented.
• Granular consent capture. The enrollment journey supports per-purpose, per-category consent with timestamped records, refreshable for material changes in processing.
• Auditable claims workflow. Claims-decisioning surfaces the Section 12.1 disclosure where it applies, captures the human-review pathway, and produces an auditable record for the partner’s privacy officer.

For a Canadian and US brand selling into Quebec, the partner model with a Canadian licensee is generally the only practical path that does not require the brand to build a Quebec-specific compliance organization from scratch. For a Canadian operator already licensed in Quebec, the platform layer is the difference between a manual compliance burden and a workflow that produces the right artifacts as a matter of course. All Shield is the layer underneath the licensee. The licensee is the layer that meets the consumer.

That is the All Shield Quebec answer in one paragraph. We are infrastructure for compliant partners, not a direct issuer in Quebec.

FAQ

1. Does Quebec Law 25 apply to US companies selling warranties into Quebec?

Yes. Law 25 governs the personal information of Quebec residents regardless of where the operator is located. A US warranty platform that collects, uses, or discloses personal information about a Quebec consumer falls inside the statute and inside the CAI’s jurisdiction.

2. What is the difference between Law 25 and PIPEDA for warranty administrators?

PIPEDA is the federal baseline and applies to commercial activity across most of Canada. Law 25 is the Quebec private-sector regime and is materially stricter on consent granularity, privacy impact assessments before cross-border transfer, automated decision-making notice, and the penalty stack. A Quebec-exposed warranty operator must satisfy both regimes.

3. Do warranty documents have to be in French in Quebec?

Yes. Under the Charter of the French Language as amended by Bill 96, consumer adhesion contracts including warranty contracts must be presented in French first since June 1, 2023. The consumer can then choose to proceed in English. Product labels, packaging, and accompanying documents sold in Quebec must also be in French.³

4. What are the maximum penalties under Quebec Law 25?

Administrative monetary penalties run up to CAD 10 million or 2 percent of preceding-year global turnover, whichever is greater. Penal fines run up to CAD 25 million or 4 percent of preceding-year global turnover, whichever is greater, with a CAD 15,000 floor per violation. A private right of action carries a CAD 1,000 statutory minimum per individual.²

5. How fast does a warranty operator have to notify the CAI of a data breach?

The statute requires notification “with diligence” once a confidentiality incident presenting a risk of serious injury is confirmed. The practitioner standard treats that as 72 hours or sooner. The incident register must be retained for five years from awareness.¹¹

6. Does Law 25 allow AI to decide warranty claims?

Yes, with conditions. Section 12.1 permits decisions based exclusively on automated processing if the consumer is informed at the time of the decision, told the principal factors and parameters used, and offered the right to submit observations to a human reviewer. Silent AI claims adjudication is not permitted.⁹

7. Can a US warranty platform host Quebec consumer data on US servers?

Yes, but only after a documented privacy impact assessment shows the receiving jurisdiction provides adequate protection and after a written agreement memorializes the transfer. Routine vendor onboarding without those artifacts is not sufficient under Section 17.⁸

8. What is the data portability right and how does it apply to a warranty record?

Since September 22, 2024, a Quebec consumer can request their computerized personal information in a structured, commonly used technological format. For a warranty operator, that covers purchase data, coverage terms, claims history, and any other computerized personal information about the consumer. The export can be directed to a system specified by the consumer.⁷

9. Is Bill 64 the same as Law 25?

Effectively yes. Bill 64 was the parliamentary name during passage. After royal assent on September 22, 2021, the statute is operatively referred to as Law 25 (or Loi 25 in French), shorthand for the chapter number SQ 2021, c 25.²⁰

10. Does All Shield operate VSC and warranty programs in Quebec directly?

All Shield’s role in Quebec depends on the program structure. For vehicle service contracts, self-insurance in Quebec is permissible. For warranty programs, a bond and fund structure may be required. All Shield provides the underlying custom warranty platform and bilingual workflows behind licensed partners’ consumer-facing programs.

11. What is the OQLF and how does it relate to Quebec warranty compliance?

The Office québécois de la langue française is the body that enforces the Charter of the French Language. It can issue orders, refer matters for prosecution, and seek suspension of e-commerce activity in Quebec. Bill 96 fines run CAD 3,000 to CAD 30,000 per violation, doubled for repeat offenses, with each day of non-compliance counted separately.¹⁵

12. What changed on June 1, 2025 for Quebec language compliance?

The francization obligation extended to enterprises with 25 or more Quebec employees, down from 50, and expanded translation requirements for product documentation took effect. Mid-market operators are now inside the perimeter.¹³

What to do next

If your program touches Quebec consumers in 2026, the practical next move is to pull the five-step checklist from this article into your own compliance plan and pressure-test it against your current vendor stack, claims workflow, and consumer-facing assets.

The gated download includes the five-step playbook in printable form, the PIPEDA versus Law 25 versus Bill 96 comparison table, and the cross-border transfer decision tree.

Download the Quebec Law 25 Warranty Compliance Checklist (PDF)

If you would rather talk through Quebec exposure with a person, book a 30-minute consult with the All Shield team. We will walk your current program against the 2026 obligations and identify where a licensed partner relationship is the cleanest path.

Book a Call with a Warranty Expert

Sources

1. Commission d’accès à l’information du Québec (CAI) — Principal changes under Law 25. https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/principaux-changements-loi-25
2. Osler — Law 25 enforcement scheme for Quebec private-sector privacy law. https://www.osler.com/en/insights/updates/law-25-a-new-enforcement-scheme-for-protection-of-personal-information-in-the-private-sector-in-que/
3. Gowling WLG — Bill 96 French-first rule. https://gowlingwlg.com/en/insights-resources/articles/2023/bill-96-s-french-first-rule-takes-effect
4. Osler — Quebec privacy regulator prohibits facial recognition for loss prevention. https://www.osler.com/en/insights/updates/quebecs-privacy-regulator-prohibits-retailers-use-of-facial-recognition-for-loss-prevention/
5. Torys — CAI decision on biometric information. https://www.torys.com/our-latest-thinking/publications/2025/04/cai-renseignements-biometriques
6. Barreau du Québec — Law 25 in force in its entirety. https://www.barreau.qc.ca/en/new/notices-to-members/loi-25-vigueur-entierete/
7. Outside GC — Quebec Law 25 overview. https://outsidegc.com/blog/quebecs-privacy-law-25-what-you-need-to-know/
8. BLG — Cross-border transfers of personal information outside Quebec. https://www.blg.com/en/insights/2022/12/cross-border-transfers-of-personal-information-outside-quebec
9. Augure AI — Law 25 AI compliance guide. https://augureai.ca/blog/law-25-ai-compliance-guide-quebec
10. Gowling WLG — Reporting a privacy breach under Law 25. https://gowlingwlg.com/en/insights-resources/articles/2022/the-abcs-of-reporting-a-privacy-breach-law-25
11. Blakes — Quebec breach reporting requirements. https://www.blakes.com/insights/new-breach-reporting-requirements-in-qc/
12. DLA Piper — Bill 96 key changes. https://www.dlapiper.com/en/insights/publications/2023/05/bill-96-five-things-you-need-to-know-before-june-1
13. TransPerfect — Quebec Bill 96 key 2025 changes. https://www.transperfect.com/blog/quebecs-bill-96-key-changes-2025
14. Stikeman Elliott — Quebec language legislation changes. https://stikeman.com/en-ca/kh/corporations-commercial-law/quebecs-language-legislation-be-ready-for-important-changes-impacting-commercial-contracts-trademark
15. Francoflex — Quebec Bill 96 penalties. https://francoflex.com/en/blog/resources/quebec-bill-96-penalties-what-businesses-face
16. Fasken — Data anonymization under Law 25. https://www.fasken.com/en/knowledge/2024/05/data-anonymization-under-law-25
17. Éloïse Gratton — CAI 2023–2024 annual activity and management report. https://www.eloisegratton.com/blog/2024/09/30/cai-2023-2024-annual-activity-and-management-report/
18. DLA Piper — Quebec privacy regulator ceases publishing breach list. https://www.dlapiper.com/en-hk/insights/publications/2025/05/quebec-privacy-regulator-ceases-publishing-list-of-organizations-reporting-data-breaches
19. Gowling WLG — Quebec stops publishing privacy reports. https://gowlingwlg.com/en/insights-resources/articles/2025/quebec-stop-publishing-privacy-reports
20. CanLII — SQ 2021, c 25. https://www.canlii.org/en/qc/laws/astat/sq-2021-c-25/latest/sq-2021-c-25.html
21. All Shield — Compliance page. https://allshield.co/compliance/

Disclosure

This report is provided for informational purposes only and does not constitute legal, insurance, regulatory, tax, or compliance advice. Service contract, warranty, and protection-plan requirements vary by province or state, product type, obligor structure, financial-security method, and sales channel. Readers should consult qualified counsel or regulatory advisors before launching, modifying, or expanding a service contract or warranty program.