Law 25 · Free check
Have your website tested for free
Most Quebec websites set trackers before the visitor has clicked anything. The cookie banner shows up, it looks fine — and Google Analytics has already fired. You can't see it with the naked eye, or even in the website's code: you have to open the page in a real browser and watch the network traffic. I built a tool that does exactly that, and I'm offering you the test.
What I found on 27 websites in the region
In September 2026, I screened 27 websites of SMBs and organizations in Vaudreuil-Soulanges. Here is the result, without rounding:
- 17 let trackers fire before any consent — Google Analytics, Tag Manager, Facebook pixel, sometimes TikTok.
- All 27 had a cookie banner. It simply blocked nothing.
- And on several, I clicked “Refuse”, waited for the banner to disappear — so the choice had been recorded — then came back to the website. The trackers fired anyway. The refuse button was decorative.
Four websites out of 27 were clean. It's possible. It's just rare.
What the test checks
Each website is opened in a fresh browser, with no history or prior consent — otherwise the measurement is worthless. Six checks:
- Which trackers load before consent, and which ones perform profiling within the meaning of the law (ss. 8.1 and 14 of the Act respecting the protection of personal information in the private sector).
- Which third-party cookies are set before any visitor interaction.
- Whether the “Refuse” button actually works. We click it, check that it was recorded, then come back to the website.
- Whether refusing is as easy as accepting: button colour, font size, number of clicks (Commission d'accès à l'information, guidelines 2023-1, guideline 41).
- Whether a privacy policy is published and accessible (s. 8.2).
- Whether the person in charge of the protection of personal information is identified, with their contact details (s. 3.1, para. 3).
You receive a table, website by website, with the section that applies to each finding. Not a score, not a mark out of 100: verifiable facts.
What the test doesn't check — and why I say so
This test measures what is visible from the outside. Law 25 also requires an incident register kept for five years, a policy whose content meets specific requirements, written agreements with your subcontractors, defined retention periods, and a privacy impact assessment for certain projects.
None of that can be seen from a browser. It requires getting inside the website and your ways of doing things — that's an engagement, and it's billed.
The external test, on the other hand, is free, and truly free. No credit card, no forced sales call. You receive the table, and you do what you want with it.
You're an SMB
You don't manage your website yourself? Good, that's normal.
The report is written to be passed on. It contains the technical details and the sections of the law the person who manages your website will need. You have nothing to understand or translate: you just forward it.
If you'd rather I speak to them directly about the technical side, tell me and give me their name.
You build websites
Do you manage websites for clients? Add as many as you like, one address per line.
You'll receive a complete table of your portfolio: which ones are clean, which ones have a problem, exactly which one, and the section that applies.
What you do with it is up to you. You fix things yourself — very doable once you know what to look for. Or you hand me part of it: I regularly work as a subcontractor, under your brand, without ever appearing in front of your client.
I'm not after your clients. I'm looking for designers to work with when compliance becomes an issue.
Request the test
Reply within 24 business hours. Often the same day.
What I do with your information
I collect your websites' addresses and your email for one purpose only: to send you the report and discuss it if you wish. Your name is optional.
I don't share them with anyone and I don't use them for any other purpose. They are kept in my customer relationship management system as long as the exchange remains active, then destroyed after 24 months without contact. You can ask for them to be deleted at any time, by simple email.
No tracker on this page. No Google Analytics, no advertising pixel, no reCAPTCHA. The form is protected by an invisible honeypot field, with no third-party service. It would be awkward otherwise.
Person in charge of the protection of personal information:
Jonathan Prévost, president, Solution Prévost TI
jonathan.prevost@solutionprevostti.com
49 place Larrivée, Vaudreuil-Dorion (Quebec) J7V 8P5
This report is a technical finding, not a legal opinion. I am not a lawyer. For a legal opinion, consult a member of the Barreau du Québec.