Know where your site stands on Bill 25 and OQLF within 5 minutes.
Get a clear, plain-language compliance readout — no signup, no install.
// The scan reads what is publicly visible on your site. It is a starting point for review — not a legal opinion or a certification of compliance.
Two Québec laws touch your website.
Most operators have heard the names and never seen the requirements written plainly. These are the obligations that apply to a public-facing site — no legalese, no size exemptions.
// Law 25 (Bill 64) · In force
Québec privacy law
Governs how you collect, store and use customer information. It applies to every business handling the personal data of a Québec resident — there is no small-business exemption.
A published privacy policy
Publicly accessible, naming what you collect, why, how long you keep it, and who to contact. Missing or unreachable policies are the most common finding.
Consent before you collect
Every form that takes a name, email or phone number needs explicit consent and a stated purpose — including reservation, catering and contact forms.
Consent before you track
Analytics, pixels and marketing tags must not fire until the visitor agrees. A banner with no real reject option doesn't meet the bar.
A named privacy officer
A real person accountable for privacy, identified on the site with contact details — by default the highest-ranking person in the business.
Access, correction and deletion
Customers can ask what you hold, fix it, or have it deleted — and you must have a workable way to answer. Portability applies too.
Data kept secure and in-province
Reasonable safeguards, plus a documented assessment before customer data leaves Québec. Breaches carry mandatory reporting duties.
// Bill 96 · Charter of the French language
OQLF language requirements
Governs the language your business communicates in. Since June 1, 2025, websites, catalogues and social media of any business selling to Québec must be available in French.
A French version, equal in every way
Not a partial translation — the French side must carry the same offers, prices, hours and information, and be just as easy to reach.
French first, by default
For a Québec audience the expectation is that visitors are greeted in French, with English one click away — not the reverse.
No leftover English fragments
Buttons, headings, alt text, footer links and screen-reader instructions all count. Half-translated pages are the most frequent OQLF finding.
Menus, catalogues and job postings
These are commercial publications under the Charter and must exist in French — including careers pages and downloadable menus.
Social media content
Since June 2025 commercial posts count as publications. A French-only-on-the-website approach no longer covers you.
Francization at 25 employees
Businesses with 25+ staff (down from 50) must register with the OQLF and show French is the normal language of work.
The numbers, from the statutes and the regulators themselves.
Every figure below comes from the law that sets it or from the regulator's own record, and links to its source — check us in one click.
Up to $25,000,000
Penal fines for serious violations
For serious offences the courts can go much further — up to $25 million or 4% of worldwide turnover, whichever is greater. Fines for corporations start at $15,000 and double for a repeat offence.
Source: Osler — Law 25's new enforcement schemeUp to $10,000,000
Administrative monetary penalties
Quebec's privacy regulator (the Commission d'accès à l'information) can impose administrative penalties directly — no court needed — for collecting or using personal information in breach of the law, failing to report a breach, or failing to protect the data it holds. The ceiling is $10 million or 2% of worldwide turnover, whichever is greater.
Source: Osler — Law 25's new enforcement scheme$1,000 minimum, per person
Customers can sue directly
Law 25 gives individuals a private right of action with minimum damages of $1,000 per person when their privacy rights are violated — and class actions multiply that across every affected customer.
Source: Clym — Quebec Law 25 overview$3,000 – $30,000 per offence, per day
Fines under the Charter of the French Language
Since Bill 96, a business that breaks the Charter faces fines of $3,000 to $30,000 per offence — doubled for a second offence and tripled after that. Every day a violation continues can count as a separate offence, so an English-only website isn't one fine, it's a meter running.
Source: Éducaloi — Language laws and doing business in Quebec≈10 businesses fined in 2023
Websites are a standing target — not an afterthought
Around ten enterprises were fined in 2023 alone following complaints that their website content wasn't available in French; retailers including URBN Canada and Waterco drew fines of about $3,000 each for English-only online content. Prosecutions over web content go back a decade.
Source: Weglot — Bill 96 explained (OQLF enforcement data)6,900 complaints in one year
Enforcement is complaint-driven — anyone can report you
The OQLF received nearly 6,900 complaints in a single year (2022–23), more than one in ten about websites. A single unhappy customer, competitor, or passer-by filing a form is all it takes to open a file on your business.
Source: Weglot — Bill 96 explained (OQLF complaint statistics)444 incident reports in one year
The regulator is actively watching
In a single year (2023–2024) the Commission d'accès à l'information received 444 confidentiality-incident reports and tracked hundreds of related files. The enforcement machinery is new, the investigations are real, and the CAI publishes its decisions.
Source: Alation — Quebec Law 25 compliance guide4 convictions in 2021 alone
Documented convictions — websites and catalogues
The OQLF publishes the businesses convicted each year, and websites are regular entries. In 2021 alone: Le Marché Fooderie and Cible Jeu ($1,500 each, commercial publications including their sites), real-estate firm Qiang Zhong Inc. ($1,500, English-only website), and Diebold Nixdorf Canada ($1,500). Those amounts were under the OLD regime — Bill 96 has since raised the floor to $3,000 per offence, per day.
Source: MTL Blog — companies fined in 2021, per the OQLF's published listOrdered: destroy it all in 90 days
Documented case — biometric data collected without consent
Quebec's regulator, jointly with federal and provincial counterparts, found a facial-recognition company's mass collection of images without consent unlawful and ordered it to destroy every image and biometric profile collected from Quebecers within 90 days.
Source: Office of the Privacy Commissioner of Canada — Clearview AI order// Statutory maximums and documented cases, not predictions about any business. What a regulator or court actually imposes depends on the facts. Nothing here is legal advice.
Scan, rebuild, approve, stay compliant.
Compliance isn't a one-time fix — the law follows every content change you make. Nestor handles the first pass and then keeps it from drifting.
// 01 · Scan
We read your public site
Every page, form, tracker and both language versions. You get a plain-language readout of what's in place, what's missing, and what a scan can't confirm on its own.
// 02 · Rebuild
Fixes go into real code
Consent flows, privacy policy, French parity and the technical foundations are built into the site itself — never a bolt-on widget layered over the top.
// 03 · Approve
Nothing ships without you
Every change is staged and previewed. You approve by SMS or in the panel — one tap to publish, one tap to send it back.
// 04 · Maintain
It stays closed
Add a menu item in English and the French side updates with it. Ongoing audits catch drift before a complaint does.
A compliant site and a fast site are the same build.
The work that satisfies Law 25 and the OQLF — clean markup, real code instead of widgets, a properly built French version — is the same work that makes a site fast and stable.
Core Web Vitals
Green
We build to pass Google's LCP, INP and CLS thresholds — the page-experience signals that feed ranking.
Target load time
< 2.5s
Largest Contentful Paint on a standard mobile connection, measured on your real pages after launch.
Indexed languages
2
French and English both indexed and correctly linked, so each version can rank in its own searches.
Third-party widgets
0
No overlay scripts injected at load — the single most common cause of slow, unstable pages.
What makes it fast
// Technical foundations
In-region hosting
Servers in Québec mean shorter round trips for the customers who actually visit you — compliance and latency solved by the same decision.
Modern image delivery
Compressed, correctly sized, lazy-loaded formats. Menu photography is usually the single heaviest thing on a restaurant site.
No script bloat
Consent gating means trackers don't fire until they're allowed to — which keeps them off the critical rendering path.
Mobile-first rendering
Most restaurant traffic is a phone deciding where to eat in the next twenty minutes. That's the case we build for.
What makes it correct
// Structural foundations
Bilingual structure, done properly
Real French pages with correct language declarations — not a translation widget layered on an English site. What the OQLF expects.
Local & restaurant structured data
Hours, address, menu and location marked up in a standard machine-readable format, so any system reading your site gets it right.
Semantic, accessible markup
Real headings, labelled forms, descriptive alt text. The structure a screen reader depends on is the WCAG work, not a cosmetic layer.
Rebuilt, not patched
Migrated into the Sovereign Vault and rebuilt on clean foundations — faster and better-looking. Audit findings resolved in the build.
Why we don't use compliance overlays
The quickest way to claim compliance is a third-party script that layers a banner and a widget over your existing site. It's also the quickest way to slow the site down, and overlays have a poor record of actually satisfying regulators or the people they're meant to help. Nestor changes the underlying code instead — slower to deploy, but it's the version that holds up when someone looks closely.
// We build the technical foundations that search engines reward — speed, structure, correct bilingual indexing and clean markup. No one controls search rankings, and we don't promise a position. Performance targets are measured on your real pages after launch and shared with you.
Your customer data stays in Québec.
Hosting, encryption keys and operators inside the province — so the residency question is answered before anyone asks it.
// Handled for you
Requests, done
When a customer asks what data you hold — or wants it deleted — the request is logged, actioned and recorded on schedule. Retention clears itself without anyone remembering to.
// Stays put
Hosted in Québec
Servers, keys and operators in-province, with immutable audit logs showing where data has been the whole time. No cross-border assessment to write.
// One snippet
Nothing to migrate
No re-platforming and no IT project. Nestor takes over the build, keeps your existing tools in place, and runs the compliance layer underneath.
Want to be compliant?
Book a 30-minute founder-led demo — we'll show you Nestor Logic working on your actual platforms and your real compliance data.
Book a Demo