Lately, I’ve been working on a number of mandates that, to my great delight, include the management of personal information, especially since the adoption of Bill 25.

The new law on personal information is motivating companies to take matters into their own hands. One of the issues at stake is the management of websites, cookies, event logs and access to them.

Cookies : Bill 25 and privacy explained

Cookies – Photo by charlesdeluvio on Unsplash

Cookie management is an “unpleasant” issue for webmasters.

The aim of the law is to guarantee transparent and secure management of users’ personal information, which of course includes the information collected by cookies.

Coming into force in September 2022, this law aims to protect the personal information of Quebec citizens. It applies to any organization that collects, uses or communicates personal information, including cookies.

Quebec’s Act respecting the protection of personal information in the private sector regulates the collection, use and disclosure of personal data by companies operating in Quebec. With regard to cookie management, this law requires that users be informed and consent to the collection of their data, including the use of non-essential cookies.

Types of cookies and their role

Cookies are small text files that websites place on your computer or mobile device when you visit them. They store information about your browsing habits, preferences and interactions with the site. They can have different functions, and it’s crucial to understand their different types to ensure you comply with current legislation. Here are the main types of cookies:

  • Functional cookies: Used to improve the functionality of a website by remembering choices you have made. Example: remembering your personalization settings on a site.
  • Session cookies: Stored temporarily on your device and deleted when you close your browser. Used to maintain the state of a user’s session while browsing a website. Example: to keep a shopping cart active while browsing an e-commerce site.
  • Persistent cookies: Stored longer on your device, sometimes for months or years. Used to record information such as user preferences and enable long-term tracking. Example: to remember your language preferences on the site.
  • Performance cookies: Collect information on how users interact with a website. Used to analyze site performance and improve the user experience. Example: tracking the number of visitors to a site.
  • Targeting cookies: Used to track user behavior and display targeted advertising. Often associated with third parties to display personalized ads based on users’ interests.

Quebec law and the RGPD

Quebec law, like Europe’s RGPD (General Data Protection Regulation), emphasizes the importance of clearly informing users about the cookies used and collecting their explicit consent.

How to manage cookies on your website

Display an informative banner as soon as the user arrives on your website. This banner should :

  • Clearly indicate that the site uses cookies.
  • Explain the purpose of the cookies used.
  • Request user consent before setting non-essential cookies.

The banner can offer the user several options:

  • Accept all cookies
  • Reject all non-essential cookies.
  • Personalize your choices according to the type of cookie.

Don’t forget that the banner must be clear enough to enable visitors to give free, informed and specific consent.

2. Provide clear and transparent information

Draw up a privacy policy explaining the use of cookies. It should be accessible and understandable. This policy must :

  • Detail the types of cookies used on your website.
  • Explain the purpose of each type of cookie.
  • Indicate how long cookies are kept.
  • Provide information about third parties who have access to cookies.
  • Explain how users can manage their cookie preferences.
  • Update your cookie policy regularly to reflect any changes.

3. Allow users to manage their preferences

Propose a cookie management tool that allows users to :

  • Display the list of cookies deposited on their device.
  • Enable or disable cookies by type or category.
  • Delete cookies they do not wish to keep.

Make the cookie management tool easy to use and accessible.

4. Secure cookies

  • Store cookies securely (Optional – Encrypted with HttpOnly tag, Secure, SameSite, and appropriate expiration)
  • Restrict access to cookies to those who need them for business reasons.

5. Respect the principles of personal data protection

  • Collect data fairly and lawfully.
  • Process data transparently and securely.
  • Respect users’ rights (access, rectification, deletion, processing limitation, opposition, portability).

Tasks of the website manager

As a website manager, you must :

  1. Inform and gather consent: Have a clear consent banner for non-essential cookies and a well-detailed privacy policy that explains their purpose.
  2. Minimize data collection: Apply the principle of data minimization, collecting only the information needed to achieve a specific objective.
  3. Document and assess risks: Implement control measures to protect personal information, such as risk assessment of cookies and logs.
  4. Keep a register of processing activities: Maintain documentation specifying the types of cookies used, the logs created, the entities that have access to the data, and the security measures in place.
  5. Privacy policy: make sure it clearly explains the needs and uses of cookies!

Being in charge of a website means guaranteeing that users’ privacy is respected and that practices comply with the various laws in force.

Summary of popular cookie management solutions :

Byscuit – https://www.byscuit.com/en/

  • Managed by entreprise du Quebec.
  • Simplified banner management

Cookiebot CMP – https://www.cookiebot.com/

  • Automatic scanner to detect cookies and tracers.
  • Block cookies before consent.
  • Customizable banners and consent documentation.

TrustArc – https://trustarc.com/

  • RGPD/CCPA compliance.
  • Third-party cookie analysis and advanced consent management.

OneTrust – https://www.onetrust.com/

  • Complete platform for banner personalization, consent management and compliance.

Cookie Script – https://cookie-script.com/

  • Simple, intuitive solution.
  • Automatic cookie updates and international compliance.

Axeptio – https://www.axept.io/

  • Focused on user experience and RGPD compliance.
  • Easy to integrate.

CookieHub – https://www.cookiehub.com/

  • Automatic scanning, cookie declaration, and advanced personalization options via Google Tag Manager.

Integrated solutions (e.g. GoDaddy, Cloudflare, WordPress)

  • Integrated management with banner customization and third-party tracking tools.

Picking a banner tool does not settle the rest: inventory, policies, privacy officer, incidents. If that is where you are, see Bill 25 compliance support.