Privacy rules, applied on your website.
Quebec's Law 25 and Europe's GDPR ask for things a website has to do, not only say: no tracking before consent, a refusal that is respected, notices where personal information is collected. Many consent banners only look like they work. We check what your site really loads, and make it behave the way your privacy policy says it does.
What you get
A tracker and cookie audit
Every cookie, pixel, script and third-party service your site loads, listed with what it does and whether it runs before the visitor has agreed.
A banner that really blocks
A consent banner that keeps analytics and advertising trackers off until the visitor accepts, and remembers a refusal instead of asking again on every page.
Consent on forms
Consent checkboxes and short notices on your contact, quote and newsletter forms, saying what the information is used for.
The privacy policy, linked
Your privacy policy linked from every page footer, the banner and every form that collects personal information.
The person in charge
Law 25 requires publishing the title and contact details of the person in charge of protecting personal information. We add them where visitors can find them, with a way to reach that person.
A short report
What the site loaded before, what was changed, and what is left for you or your lawyer to decide.
What this is not
- This is the technical implementation on your website. It is not legal advice.
- The text of your privacy policy should be reviewed by a lawyer. We can put in place a draft you provide, or one your lawyer writes.
- We do not guarantee that your business is compliant. Compliance also depends on how you handle personal information outside the website.
How it works
- Step 1
The audit
We load your site as a new visitor, in Quebec and in Europe, and list everything it sets and sends before and after consent.
- Step 2
The plan
You receive the list with what we propose to change, including trackers you may not need at all. Nothing changes until you agree.
- Step 3
The changes
We set up the banner, block trackers until consent, add form notices and links, and publish the contact details of the person in charge.
- Step 4
Check and report
We run the audit again to confirm the trackers wait for consent, and send you the short report. About 3 days in total.
What it costs
From
$300
A fixed price for one website on a common platform, such as WordPress, Webflow, Shopify or a site we built. Several sites, or a web app with user accounts, are quoted after a first look.
See all pricesBilled to you directly
- A consent management tool's subscription, only if your site's traffic or platform calls for a paid one. Free options cover most small sites.
- Your lawyer's fees for reviewing the privacy policy.
What is not included
- Legal advice, or writing the privacy policy as a legal document
- A privacy impact assessment, a register of processing, or a data processing agreement
- Your internal procedures, such as handling access requests or reporting incidents
- Ongoing monitoring when new trackers are added later, which the monthly care plan can cover
Who this is for
- Businesses with customers in Quebec, where Law 25 applies to how they collect personal information
- Businesses with visitors in the European Union, under the GDPR
- Sites with analytics, an advertising pixel or a chat widget, added over the years by different people
Questions, answered
Will this make my business compliant with Law 25 or the GDPR?
It covers the website's technical side. Compliance also involves your policies, your contracts with suppliers and how you handle personal information day to day, which a lawyer or privacy adviser should look at. We cannot promise compliance, and we say so in the report.
Can we keep our analytics?
Yes, as long as it waits for consent where consent is required. Another option is a cookie-free analytics tool, which can count visits without tracking individuals. We can set one up if you prefer, and the report notes what each option means.
Who is the person in charge of personal information?
Under Law 25, by default it is the person with the highest authority in the business, who can delegate the role in writing. You choose who it is. We publish that person's title and how to contact them.
Do you write the privacy policy?
No. We can put your existing policy, or a draft you or your lawyer provide, in the right places on the site, and point out where it does not match what the site actually does. The text itself should be reviewed by a lawyer.
Related services
Website audit
A wider check of performance, SEO, accessibility and security.
Security
A one-off pass that closes the common doors into your site.
Monthly care plan
Keeps the site updated and watched, including the consent setup.
Not sure what your site loads before consent?
Send us your site's address. We will look at what it loads for a new visitor before we talk.