Fines aren’t on the menu.

For serious offences the courts can go much further — up to $25 million or 4% of worldwide turnover, whichever is greater. Fines for corporations start at $15,000 and double for a repeat offence.

Quebec's privacy regulator (the Commission d'accès à l'information) can impose administrative penalties directly — no court needed — for collecting or using personal information in breach of the law, failing to report a breach, or failing to protect the data it holds. The ceiling is $10 million or 2% of worldwide turnover, whichever is greater.

Law 25 gives individuals a private right of action with minimum damages of $1,000 per person when their privacy rights are violated — and class actions multiply that across every affected customer.

Since Bill 96, a business that breaks the Charter faces fines of $3,000 to $30,000 per offence — doubled for a second offence and tripled after that. Every day a violation continues can count as a separate offence, so an English-only website isn't one fine, it's a meter running.

Around ten enterprises were fined in 2023 alone following complaints that their website content wasn't available in French; retailers including URBN Canada and Waterco drew fines of about $3,000 each for English-only online content. Prosecutions over web content go back a decade.

The OQLF received nearly 6,900 complaints in a single year (2022–23), more than one in ten about websites. A single unhappy customer, competitor, or passer-by filing a form is all it takes to open a file on your business.

In a single year (2023–2024) the Commission d'accès à l'information received 444 confidentiality-incident reports and tracked hundreds of related files. The enforcement machinery is new, the investigations are real, and the CAI publishes its decisions.

The OQLF publishes the businesses convicted each year, and websites are regular entries. In 2021 alone: Le Marché Fooderie and Cible Jeu ($1,500 each, commercial publications including their sites), real-estate firm Qiang Zhong Inc. ($1,500, English-only website), and Diebold Nixdorf Canada ($1,500). Those amounts were under the OLD regime — Bill 96 has since raised the floor to $3,000 per offence, per day.

Quebec's regulator, jointly with federal and provincial counterparts, found a facial-recognition company's mass collection of images without consent unlawful and ordered it to destroy every image and biometric profile collected from Quebecers within 90 days.