Does Quebec Law 25 affect lead capture?

It depends on whether Quebec residents are actually in your funnel. Law 25 — Quebec’s modernized private-sector privacy law, phased fully into force between 2022 and 2024 — governs enterprises handling Quebec residents’ personal information, and it does not stop at the provincial border. Ads reaching Gatineau, relocation leads from Montreal, a francophone farming strategy: knowingly collecting Quebecers’ information brings its obligations into frame. An Ontario-only practice mostly needs awareness, not restructuring. General information, not legal advice.

When Law 25 reaches an out-of-province agent

The law follows the data subject, not your office address. The realistic triggers for an agent outside Quebec: running ads whose geography includes Quebec — an Ottawa farm that spills across the river is the canonical case; working relocation pipelines that collect Montreal sellers before they move; buying leads from vendors whose forms capture Quebec residents; or marketing in French to audiences that are substantially Québécois. What does not trigger it is the accident of an open website — a Quebec visitor stumbling onto your Oakville listings page is not a business relationship. The honest test is intent: if Quebec residents are part of your acquisition strategy, plan for the law; if they are noise in your analytics, awareness suffices.

What it demands beyond the baseline you (should) have

Lead capture is already regulated everywhere in Canada — PIPEDA attaches to every lead form — so the useful frame is Law 25’s deltas. Accountability is formalized: a designated person responsible for personal information, with the role published. Transparency is sharpened: collection notices in clear language, stating purposes, at or before collection — and specific disclosure when technology profiles or tracks, which implicates the analytics and pixels behind most lead funnels. Consent gets stricter about granularity and about secondary uses. Incidents carry assessment and notification duties. And moving Quebecers’ data outside Quebec — which any non-Quebec agent using cloud tools does by default — formally calls for a privacy assessment of the transfer. The pattern across all of it: obligations PIPEDA implies, Law 25 itemizes.

When you genuinely do not need to restructure

Most Ontario and BC practices can file this under monitoring. If your marketing geography, lead sources, and client base are outside Quebec, your governing regime remains the federal and provincial framework you already operate under, and building one privacy program to the strictest standard that plausibly touches you — which increasingly means Law 25’s shape — is prudence rather than obligation. The check worth calendaring is drift: lead vendors change their traffic mix, ad platforms loosen geo-fences, and a “Canada-wide” campaign includes Quebec by definition. A team expanding toward Ottawa should treat the question as live rather than settled, since the National Capital Region’s market straddles the river as a matter of geography. Reread your acquisition map yearly and this page stays theoretical.

If Quebec leads are real for you, the short list

Four moves cover the practical distance. Name the responsible person and publish the contact. Rewrite your privacy policy in plain language that states purposes, tracking technologies, and the officer’s coordinates — bilingually if you market in French. Make your forms disclose at the point of capture: what you collect, why, and what happens next, with marketing consent separate and unchecked, the same hygiene CASL already demands of the follow-up. And log consent with timestamps per contact, since Quebec’s regulator, like every regulator, treats unprovable consent as absent. On BrokerFold, the capture layer carries the disclosure text you configure and stores consent state on each contact record — the mechanics are the easy half. The judgment call about whether Quebec is in your business at all is yours, as of mid-2026 and reviewed yearly thereafter.