Skip to content

WARNING - It is not legal advice — have counsel confirm the specific wording and workflow match your data practices.

Customer Consent Templates (Law 25 Compliant)

Note before using: Under Quebec’s Law 25, the type of consent required depends on the sensitivity of the information and the purpose. This template gives you ready-to-use clauses for common scenarios, plus a standalone written consent form for higher-sensitivity cases. Replace all bracketed placeholders. Have a lawyer confirm this matches your actual data practices before deploying.

Situation Consent type needed Format
Basic account creation, order processing Implied (contextual) Notice at point of collection
Email/SMS marketing Express, opt-in Checkbox (unchecked by default)
Non-essential cookies / tracking / analytics Express, opt-in Cookie banner
Sharing data with third parties for their own purposes Express, opt-in Separate checkbox, clearly worded
Sensitive information (health, financial details, biometrics, SIN, sexual orientation, etc.) Express, in writing, specific Signed consent form (Section 3)
Transfer of data outside Quebec Covered by your Privacy Policy + PIA, not a separate customer consent — but should be disclosed Notice
Minors under 14 Consent from parent/guardian, unless clearly for the minor’s benefit Signed form or verified parental consent

General rule: Never bundle unrelated consents into one checkbox (e.g., “I agree to the Terms and to receive marketing emails” as a single mandatory box). Keep them separable.

2. Ready-to-use clauses

Use this near any form that collects personal information (contact form, signup, checkout):

We collect the personal information above to [state specific purpose, e.g., “process your order and provide customer support”]. It will be kept for [retention period] and may be shared with [name categories of recipients, e.g., “our payment processor and shipping partner”] for that purpose only. See our Privacy Policy for details, including how to access, correct, or withdraw consent for your information. Questions? Contact [privacy@yourcompany.com].

2.2 Marketing email/SMS opt-in (must be unchecked by default)

☐ I would like to receive marketing emails from [Company Name] about [products/promotions/newsletters]. You can unsubscribe at any time via the link in each email or by contacting [privacy@yourcompany.com]. See our Privacy Policy.

We use cookies to run this site and, with your permission, to analyze traffic and personalize content. You can accept all, reject non-essential cookies, or customize your choices below. [Accept All] [Reject Non-Essential] [Customize] See our [Cookie Policy / Privacy Policy] for details.

2.4 Sharing with a third party for the third party’s own purposes

☐ I consent to [Company Name] sharing my [name, email, purchase history] with [Third Party Name] so that [Third Party Name] can [state their purpose, e.g., “offer me their extended warranty program”]. This is separate from providing your information to our own service providers. You may withdraw this consent at any time by contacting [privacy@yourcompany.com].

You can withdraw your consent at any time. This won’t affect the lawfulness of anything we did with your information before the withdrawal, and it may limit our ability to keep providing certain services. To withdraw consent, contact [privacy@yourcompany.com] or [link to preference center].

2.6 Minors (under 14)

This service is intended for use by adults. If you are under 14, a parent or legal guardian must provide consent on your behalf before you provide any personal information. Parent/guardian name: _ Signature: _ Date: ____

Use this standalone form when collecting sensitive personal information (health, financial account details, biometric data, government ID numbers, sexual orientation, union membership, etc.) or in any situation calling for explicit, documented consent.

CONSENT TO COLLECT, USE, AND DISCLOSE PERSONAL INFORMATION

[Company Legal Name] ("we," "us")

Customer name: _______________________________________________
Date: _____________________

1. INFORMATION TO BE COLLECTED
   We are asking you to provide the following personal information:
   [ List specific fields, e.g., "date of birth, health condition details, SIN" ]

2. PURPOSE
   This information will be used for:
   [ State specific purpose(s) — be precise, not generic ]

3. WHO WILL SEE THIS INFORMATION
   [ List internal roles and/or named third parties, e.g., "our claims processing team; 
     [Third Party], our insurance partner, for the sole purpose of processing your claim" ]

4. RETENTION
   This information will be kept for [retention period], after which it will be securely 
   destroyed or anonymized.

5. YOUR RIGHTS
   You have the right to access and correct this information, and to withdraw your consent 
   at any time by contacting [privacy@yourcompany.com]. Withdrawing consent may affect our 
   ability to [state consequence, e.g., "process your claim"].

6. CONSENT
   ☐ I have read and understood the above, and I consent to the collection, use, and 
      disclosure of my personal information as described.

   Signature: _______________________     Date: _____________________

   (If on behalf of a minor or dependent adult)
   Signature of parent/guardian: _______________________     Date: _____________________

4. Implementation checklist

  • [ ] Marketing/tracking consent checkboxes are unchecked by default (no pre-ticked boxes)
  • [ ] Each distinct purpose has its own consent mechanism — not bundled with Terms of Service acceptance
  • [ ] Consent language states the specific purpose, not a vague catch-all (“to improve our services” alone is too broad)
  • [ ] A visible, easy method exists to withdraw consent (settings page, unsubscribe link, email address)
  • [ ] Sensitive information collection uses the written form (Section 3), not a simple checkbox
  • [ ] Records of consent (who consented, when, to what) are logged and retrievable in case of an audit or access request
  • [ ] Staff handling these forms know where completed consent forms are stored and for how long

This template supports compliance with Quebec’s Act respecting the protection of personal information in the private sector (Law 25). It is not legal advice — have counsel confirm the specific wording and workflow match your data practices.