AI marketing in Montreal: what Quebec law lets the tools do

Short answer: AI marketing is allowed in Quebec. Three things decide the setup. Where personal information goes: an assessment and a written agreement before it leaves Quebec. What is switched on by default: profiling stays off until the person turns it on. And French that can stand as the equal of the English. Law 25 penalties reach C$25 million or 4 percent of worldwide turnover.

Montreal is an AI research city. Mila, the Quebec AI institute, sits in Mile-Ex. You would expect a business owner here to ask which model is best. In practice the question is almost never about models.

It is about what happens to a customer’s name, phone number and enquiry once a tool touches it, and whether the French the tool writes would embarrass the business.

We think that is good news. Most of the work is a short list of setup decisions made once, not a legal department. This piece covers the list, and it sits under our wider guide to AI marketing for Canadian small businesses. It is general information, not legal advice, and a Quebec lawyer should check your specific setup.

The question is where the data goes, not which model

Take two tasks. In the first, you ask an AI tool to draft a blog post or a set of ad variations, and nothing in the prompt identifies a customer. In the second, you paste in last month’s enquiries and ask it to sort them.

In our reading, the first raises no Law 25 question at all. Law 25 is about the personal information of people, and an ad headline contains none. The second is different, because a customer list, an enquiry email or a CRM export is exactly the information the law is about.

So the useful sorting is not “which tools are safe”. It is “which tools ever see customer information”. Copywriting and image tools usually do not, if you keep the prompts clean. Your CRM, email platform, booking system and any chatbot do, by design. Draw that line on one page before you buy anything.

The CAI, the Commission d’accès à l’information, is the Quebec regulator. Its guidance is published in French, which is worth knowing if your team reads the English summaries only.

Law 25 in the five places an AI marketing setup touches it

“Law 25” is the common name for the 2021 Quebec law that modernised the Act respecting the protection of personal information in the private sector. Five of its requirements show up in almost every AI marketing setup.

Where it touches you	What it asks
Who is in charge	Whoever operates the business is responsible for the personal information it holds. By default that is the head of the business, and the role can be delegated in writing. The person’s title and contact details must be published on your website. There is no size threshold in the CAI’s page.
The privacy policy	A business that collects personal information by technological means must publish a plain-language privacy policy on its website and tell people when it changes.
Consent	Consent is requested for each purpose, and express consent is needed before using sensitive information for another purpose. Commercial prospecting must identify you, tell people they can withdraw consent, and stop once they do.
Data leaving Quebec	Before personal information is communicated outside Quebec, a privacy impact assessment comes first, and a written agreement covers the transfer.
Automated decisions	When a decision rests only on automated processing, the person must be told, and can ask for the reasons and have a staff member review it.

The first two are admin you do once and keep current. A chatbot or booking widget makes the privacy policy a live document, so it has to describe what the tools actually do.

The consent row hides a trap for outreach. The CAI also says commercial prospecting is not treated as a use compatible with the purpose the information was originally collected for. The federal anti-spam law still governs commercial emails across Canada, and our guide to CASL compliance for email marketing covers that side. PIPEDA is the federal baseline, and Law 25 sits on top of it for Quebec residents’ information.

The next three sections go deeper on data leaving Quebec, default settings and automated decisions, because those are where AI tools differ from ordinary software.

Sending customer details to a US-hosted AI tool

Here is the rule that surprises people. “Outside Quebec” includes another Canadian province as well as another country. A tool hosted in Ontario counts. So does one hosted in the United States.

Before a business communicates personal information outside Quebec, it must carry out a privacy impact assessment. The same applies before entrusting a person or organisation outside Quebec with collecting, using, communicating or keeping the information for you, which is what most software vendors do.

The communication can go ahead if the assessment shows the information would receive adequate protection, notably in light of generally recognised privacy principles. The scale of the assessment is proportionate to how sensitive the information is. A communication outside Quebec must always be covered by a written agreement, and you stay responsible for the information. The same CAI page lists informing the people concerned and obtaining their consent among the obligations that apply, so the privacy policy has to say that information may leave Quebec.

When a provider works for you, the written mandate or contract has to set out three measures: how the provider keeps the information confidential, that it uses it only for the contract, and that it does not keep it after the contract ends. That is a checklist you can hold a vendor to.

In our view, the practical version looks like this:

• Keep customer data out of general-purpose prompts. Pasting a customer list into ChatGPT or any other US-hosted tool is a communication outside Quebec, and that is a bad habit to build.
• Where a tool must hold customer data (the CRM, the chatbot, the email platform), do the assessment once per tool, sized to the sensitivity of what it holds.
• Get the written agreement signed, and file it with the assessment.
• List the tool in the privacy policy so the policy matches reality.

Where a given tool stores data is the vendor’s to state in writing. Asking for it in writing is the point.

Personalisation and tracking start switched off

Personalisation is the most attractive thing AI offers a marketer, and the part Quebec treats most carefully.

A business that collects personal information with technology that can identify, locate or profile a person must tell the person beforehand that it uses the technology and how to activate those functions. The CAI’s page says these technologies cannot be activated by default. The person turns them on if they wish.

Profiling has a specific meaning in the law: collecting and using personal information to assess characteristics of a person, such as economic situation, health, personal preferences, interests or behaviour. Read that list again. “Interests” and “behaviour” describe most of what a recommendation engine or a behavioural audience tool does.

There is a separate rule that people often mix up with this one. A technological product or service offered to the public must have its privacy settings at the highest level of confidentiality by default. The CAI notes this particular rule does not cover the privacy settings of a cookie. That does not make cookies a free-for-all, because the identify, locate and profile rule is a different rule and still applies.

So the setup decision is simple to state. Any feature that profiles a visitor ships off, tells the visitor it exists, and waits for them to opt in. Build that in from day one.

When the machine decides, the customer gets a person

This is the part of Law 25 that reaches AI most directly. When a decision is based exclusively on automated processing of personal information, with no human involved, the business must inform the person no later than when it tells them the decision.

On request, it must tell the person what personal information was used, the reasons and the main factors and parameters that led to the decision, and that they have the right to have the information corrected. The person must also be given the chance to present observations to a member of staff who can review the decision.

The word that matters is “exclusively”. Where a person genuinely takes part in the decision, this rule does not apply.

In our reading, that draws a clean line through marketing uses. A lead score that only orders a callback list, with a person making the call, is not an exclusively automated decision. An automated rejection of an applicant, or an automated price shown to one customer and not another, is. Our guide to AI lead scoring for Canadian small business goes through which signals a score can safely use.

Failing to inform people of a fully automated decision, or to give them the chance to present observations, is among the failures that can attract an administrative monetary penalty of up to C$10 million or 2 percent of worldwide turnover. Those are statutory maximums, not a forecast for a small business. The cheap fix is design, not paperwork: keep a person in the loop on anything that approves, rejects or prices.

French that a Quebec reader would not flag

Under the Charter of the French Language, websites and social media count as commercial publications. Commercial content aimed at Quebec customers must be available in French. Another language may appear too, provided the French version is accessible on terms at least as favourable. On public signs and commercial advertising, French must be markedly predominant. Our Montreal cost guide lists what changed in 2025 and what bilingual production costs, so this section stays on the AI side.

Éducaloi’s plain-language summary adds three points. A business with at least 5 employees must be able to serve customers in French. If a customer posts in French on social media, the reply must be in French. And e-commerce businesses with no physical address in Quebec must respect these rules too, which matters for any out-of-province seller.

Fines for a company run from C$3,000 to C$30,000 per offence, double for a second offence and triple after that, and each day an offence continues counts separately.

Now the AI part. Machine output tends toward international French, and Quebec usage differs. Quebec shoppers say “magasiner”, and the OQLF, the Quebec French language office, recommends “courriel” for email. A reader here notices the difference at once, and so does a competitor. A Quebec French reader should review templates and published copy before it ships.

A chatbot raises a fair question. We found no OQLF guidance written specifically about chatbots, so this is our reading of the general rule: a website chatbot that answers Quebec customers’ purchase questions should work in French. The practical build is a bilingual bot that greets in French or offers an obvious language switch, with its scripted replies approved by a French speaker.

The review does not need to be heavy. One Quebec French writer approves the templates, bot scripts and ad variations once, then checks changes.

A Laval physiotherapy clinic, set up in order

This is a hypothetical, to show the order of the work. Picture a two-location physiotherapy clinic in Laval that wants online booking, a chatbot and faster follow-up with enquiries. No figures belong in this example, only sequence.

First, the owner is named on the website as the person in charge of personal information, with a title and contact details. Second, the privacy policy is updated to describe the booking system, the chatbot and the email platform in plain language.

Third, the chatbot goes in bilingual. Before any profiling, such as suggesting services based on what a visitor describes, it tells the visitor and asks. Profiling is off until the visitor switches it on.

Fourth, patient details stay out of the copywriting tool. Newsletter drafts and service-page text are written with no patient information in the prompt.

Fifth, the booking and email platform is hosted outside Quebec, so the clinic does one assessment and gets one written agreement for it. Health information is sensitive, so under the proportionality principle this is not a one-page job. The agreement covers confidentiality, use only for the contract and no retention afterwards.

Sixth, a Quebec French speaker approves the booking confirmations, reminder emails and chatbot scripts.

Seventh, a receptionist decides which enquiries get a call. The system can order the list, and a person makes the decision.

All of that fits in a few weeks. None of it depends on which AI model sits underneath.

Who should hold off

In our view, three kinds of business should wait.

A business with no French capability and no reviewer. If nobody can read what the tool writes, you cannot publish it to Quebec customers. Find a reviewer first, or do not point the tool at Quebec.

A business that wants to feed purchased or scraped lists into AI outreach. The CAI does not treat commercial prospecting as a compatible use of information collected for another purpose, and the federal anti-spam rules apply on top. AI makes a bad list faster, not better.

A business whose plan depends on automated rejections or automated pricing with no person in the loop. That is the exact case the automated-decision rule was written for. Redesign it so a person decides, or get legal advice before you build.

Waiting is not failing. For the other kinds of business, the common mistakes are less dramatic, and we cover them in AI marketing mistakes Canadian businesses make.

What to ask before anyone builds it

Put these to any agency, freelancer or vendor, including us. A good answer is short and specific.

1. Where does each tool store customer information, and in which province or country?
2. Who signs the written agreement for each tool, and do we receive a copy?
3. Has a privacy impact assessment been done for each tool that holds customer data, sized to how sensitive that data is?
4. Which functions identify, locate or profile people, and are they off until the person turns them on?
5. Is any decision fully automated, and where does a person step in?
6. Who reads the French before it publishes, and are they a Quebec French speaker?
7. Who is the named person in charge, and are their title and contact details on the website?
8. What happens when someone withdraws consent to marketing, and how fast does it stop?

If the answers are vague, treat that as the answer. If you want help with the build, our AI automation service is where we would start, and a free audit will show where your current setup stands against them.

Frequently asked questions

Is AI marketing legal in Quebec? Yes. Quebec does not ban AI in marketing, and no rule stops a business using AI to write copy, answer enquiries or order leads. The rules attach to personal information and to language: where customer details go, what profiling runs by default, how automated decisions are explained, and whether French is available on equal terms.

Can a Montreal business put customer data into ChatGPT or another US AI tool? Not casually. In our reading, sending customer details to a tool outside Quebec, including a US tool such as ChatGPT, is a communication outside Quebec. Before it happens the business must carry out a privacy impact assessment, and the transfer must be covered by a written agreement. Drafting copy with no customer data in the prompt raises no such question, so the simplest habit is keeping customer details out of general prompts.

Does Law 25 apply to a small business, or only to large companies? It applies to a small business. The CAI’s guidance on who is responsible for personal information draws no size threshold, and anyone who operates a business is responsible for what it holds. A sole operator with a website and a contact form still has to publish who is in charge. Size changes how heavy the paperwork is, not whether it exists.

Does an AI chatbot on a Quebec website have to answer in French? In our reading, yes, if it answers Quebec customers’ purchase questions. Websites count as commercial publications under the Charter of the French Language, so commercial content aimed at Quebec customers must be available in French. We found no OQLF guidance written specifically about chatbots, so this is our reading of the general rule. A bilingual chatbot that opens in French or offers a clear switch is the safe build.

Do I have to tell a customer when AI made a decision about them? Sometimes. If a decision rests exclusively on automated processing, with no human involved, the business must tell the person no later than when it tells them the decision. On request it must explain what information was used, the reasons and the main factors, and give a chance to present observations to a staff member who can review it. If a person genuinely takes part in the decision, the rule does not apply.

What are the penalties under Law 25? Administrative monetary penalties for a business can reach C$10 million or 2 percent of worldwide turnover. Penal fines run from C$15,000 up to C$25 million or 4 percent of worldwide turnover for the preceding fiscal year, whichever is greater, and double for a repeat offence. Those are statutory maximums, not a prediction of what a small business would face.

---

Want to see where your own setup stands? Run the free audit.