Noibu blog

Quebec Law 25 and Session Replay: What to Check Before Installing a Tool

Megan Glover

October 22, 2026

Blogs

Before installing a session replay or AI tool on a store that serves Quebec shoppers, check four things under Law 25: whether consent is collected before tracking starts, whether a privacy impact assessment is documented, where personal information is stored and processed, and how personal data is masked. Get answers from the vendor in writing.

Privacy review is now one of the most common reasons an analytics or AI tool purchase stalls. The questions are predictable: where does the data live, what gets masked, and who has signed off. This checklist is vendor-neutral. It covers Quebec's Law 25 and applies in spirit to GDPR and other regional rules. It is general information, not legal advice.

TL;DR

Law 25's most significant provisions have applied since September 22, 2023, according to compliance summaries.
Law firm summaries describe privacy impact assessments for new systems and for transfers of personal information outside Quebec.
Penalties can reach CAD 10 million or 2% of worldwide turnover (administrative) and CAD 25 million or 4% (offences), per Clyde & Co's summary.
Ask every vendor the same written questions on consent, location, masking and retention.

Why does Law 25 matter for session replay and AI tools?

Session replay and AI analytics tools process information about identifiable shoppers, and Law 25 treats that as personal information. Clyde & Co's summary of the law's second wave of amendments says organizations must run privacy impact assessments for projects involving information systems that handle personal information, and that a similar assessment is required when personal information is transferred outside Quebec.

The same summary says organizations using identification, localization or profiling technology must inform individuals of that use, and gives penalty ranges of up to CAD 10 million or 2% of prior-year worldwide turnover for administrative penalties, and up to CAD 25 million or 4% for offences on prosecution.

What should you ask a replay or AI vendor?

Vendor questions for a Law 25 review

Question	What a good answer looks like	Why it matters
Where is personal information stored and processed?	A named region, in writing, for every sub-processor	Transfers outside Quebec trigger an assessment.
How is personal data masked before it leaves the browser?	Documented default masking for form fields and text, with how to extend it	Less personal data collected means less to assess.
How is consent handled?	Works with your consent tool and does not start recording before opt-in where required	Consent must be clear and specific for each purpose.
How long is data kept, and can it be deleted?	A stated retention period and a deletion process	Supports access and deletion requests.
Is there a data processing agreement?	A signed agreement listing sub-processors	Each vendor processing shopper data needs one.
Who at the vendor answers privacy questions?	A named contact and a security review pack	Speeds up your internal sign-off.

Do not accept verbal answers. Ask for the hosting location, masking behavior and retention in documents you can attach to your assessment. For AI tools that connect to store data, the AI security questionnaire guide and the MCP security guide for ecommerce buyers list what InfoSec teams usually ask.

What is the order of work for getting a tool approved?

From privacy questions to approval

Map the data

List what the tool would collect and where it would be stored.

Send the questions

Send the same written questions to every vendor you are comparing.

Document the assessment

Record the privacy impact assessment and the reasoning for any transfer outside Quebec.

Set up consent

Confirm the tool respects your consent banner settings.

Review after launch

Re-check masking and retention after the first month of data.

Teams often find the process faster when the vendor already has a security pack. Is it safe to give an AI tool access to your store data? covers what to expect.

How does this apply to Noibu?

Ask Noibu the same questions you ask anyone else, and get the answers in writing from Noibu's security documentation or your account team before you decide. Noibu's agents hand results back for your approval and nothing ships until you say so, but approval of changes is separate from the privacy review of data handling, and both need to pass.

Noibu is AI for ecommerce operations, the always-on optimization system that keeps online stores running at their best. A team of supervised AI agents finds what's broken, slow, or leaking revenue, does the work, and hands results back for human approval. Trusted by retailers like Free People, Guess, Liquid I.V., and Ariat.

Frequently asked questions

When did Quebec's Law 25 take effect?

Compliance summaries say Law 25 rolled out in phases beginning in September 2022, with the most significant provisions applying since September 22, 2023 and data portability following in September 2024.

Does Law 25 apply to session replay tools?

Session replay tools process information about identifiable shoppers, which is personal information. Law firm summaries describe privacy impact assessments for new systems and for transfers outside Quebec, so replay tools belong in your review.

What are the penalties under Law 25?

Clyde & Co's summary lists administrative penalties of up to CAD 10 million or 2% of prior-year worldwide turnover, and penalties on prosecution of up to CAD 25 million or 4% of worldwide turnover for other entities, whichever is greater.

Should I ask vendors about data location in writing?

Yes. Transfers of personal information outside Quebec call for an assessment, so ask for the storage and processing region of the vendor and its sub-processors in a document you can attach to your records.

Is this legal advice?

No. This is general information from public summaries. Check your obligations with your privacy officer or legal counsel before approving any tool.