Law 25 cookie banner that keeps your Google Ads data (Consent Mode explained)

You can comply with Quebec's Law 25 without blinding your Google Ads account, but you won't keep everything. The law requires that any technology able to identify, locate or profile a visitor be switched off by default until the person turns it on. Google Consent Mode v2 is built for exactly this situation: Google tags respect a refusal and set no advertising cookies, yet still send anonymous signals that let Google estimate some of the conversions you can no longer observe. What you lose is mostly remarketing and visitor-level tracking for people who say no. The realistic goal is to keep what you're entitled to and measure the rest honestly.

What Law 25 actually requires

Law 25 amended Quebec's private-sector privacy act, and most of its rules have applied since September 2023. The Commission d'accès à l'information (CAI), Quebec's privacy regulator, summarizes the website obligation this way: an organization collecting personal information through technology that can identify, locate or profile a person must first inform them of that technology and of how to activate those functions, and the functions cannot be activated by default. The visitor has to take an action to turn them on.

Two points often get missed:

• The law doesn't regulate "cookies" as a category. It regulates what a technology does. A cookie that only keeps a shopping cart or a login session doesn't identify or profile anyone in the sense the law means.
• The CAI notes that the separate duty to offer the highest privacy settings by default for technology products excludes cookie settings. The default-off rule that matters here is the one about identifying, locating and profiling functions.

Administrative monetary penalties can reach $10 million or 2% of worldwide turnover. Few small businesses face numbers like that, but a complaint from a customer or competitor can lead to an investigation, and fixing a banner is far cheaper than answering one.

If you're based outside Quebec but do business with Quebecers, the safe assumption is that the same expectations apply to those visitors; ask your lawyer where your business sits. Many national businesses simply apply the Quebec standard to everyone.

Which tools on a typical site are affected

Analytics is the grey zone. Some lawyers treat basic audience measurement as low-risk; others group it with advertising. If you're unsure, treat it like the others and let Consent Mode recover part of the gap.

How Consent Mode works

Your banner, or consent management platform, passes the visitor's choice to Google tags through four signals:

• ad_storage: advertising cookies and identifiers;
• analytics_storage: analytics cookies;
• ad_user_data: sending user data to Google for advertising;
• ad_personalization: personalized ads and remarketing.

On every page, before any other Google tag command, you declare a default:

``js gtag('consent', 'default', { 'ad_storage': 'denied', 'ad_user_data': 'denied', 'ad_personalization': 'denied', 'analytics_storage': 'denied', 'wait_for_update': 500 }); ``

When the visitor accepts, the banner sends an update command with the signals set to granted. The wait_for_update value gives a slow-loading banner 500 milliseconds to respond before tags send anything.

Google also lets you set region-specific defaults with a region parameter, for example 'region': ['CA-QC']. IP-based location is approximate, though, and VPNs and mobile networks blur it. For a business with a large Quebec audience, one strict default for everyone is simpler and safer.

Basic or advanced mode

• Basic mode blocks Google tags until the visitor chooses. If they refuse, nothing is sent to Google, and conversion modelling falls back on a general model.
• Advanced mode loads tags with consent denied by default. On refusal they send cookieless pings: consent state, the fact that a conversion happened, a timestamp, the browser's user agent and the referring page. Google can then build a model specific to your account.

Advanced mode recovers more, but it does send something to Google before consent. The pings carry no cookies or persistent identifier, and many organizations conclude they don't identify or profile anyone. Others prefer basic mode out of caution. Make that choice deliberately, ideally with whoever is responsible for privacy in your company.

What you keep and what you lose

When a visitor refuses:

You keep

• clicks, impressions and cost in Google Ads, which don't depend on cookies on your site;
• observed conversions from visitors who accepted;
• with advanced mode, modelled conversions, if you meet Google's thresholds.

You lose

• that visitor in remarketing audiences;
• their individual journey in GA4;
• the observed conversion tied to their click, replaced at best by an estimate.

The thresholds are the part most guides skip. Google Ads conversion modelling needs 700 ad clicks per day over a 7-day period, per country and domain grouping. GA4 behavioural modelling needs at least 1,000 events a day with analytics_storage denied for 7 days, plus at least 1,000 daily users with it granted on 7 of the previous 28 days. A small business getting a few hundred clicks a week won't qualify. For that business, Consent Mode's real job is keeping you compliant without breaking tracking for the visitors who do accept.

So expect reported conversions to drop once a correct banner goes live. Those aren't lost customers; they're data you weren't entitled to collect. Adjust your cost-per-conversion expectations and your Smart Bidding targets rather than redesigning the banner to nudge people into accepting.

A set-up order that works

1. Audit what fires today. Open your site in a private window, refuse everything, and check cookies and network requests in the browser's developer tools. There's almost always a forgotten pixel or embed.
2. Pick a consent platform that integrates with Google Tag Manager and passes all four signals. Make sure it supports French: under Quebec's Charter of the French Language, your banner has to be available in French on terms at least as favourable as any English version.
3. Classify every cookie by what it really does: necessary, analytics, advertising, preferences.
4. Design the banner with a short explanation, "Accept", "Reject" and "Settings" buttons of equal visual weight, and a link to the privacy policy.
5. Update the privacy policy to name the technologies you use and explain how visitors can activate them.
6. Connect Consent Mode with all four signals denied by default, declared before Google tags load.
7. Gate non-Google tools too. Consent Mode only governs Google tags. For the Meta Pixel, Meta provides fbq('consent', 'revoke') before initialization and fbq('consent', 'grant') once the visitor accepts.
8. Test both paths. Refuse: no ad cookies, no pixel fires. Accept: conversions show up in Google Ads and GA4.
9. Let people change their mind with a permanent "Cookie settings" link in the footer.

Mistakes we see most often

• A banner that informs but blocks nothing, so the pixel fires before anyone reads it.
• A "Reject" option hidden on a second screen while "Accept" is large and coloured.
• An English-only banner on a site that sells in Quebec.
• Consent Mode set up in Tag Manager while Google tags hard-coded in the site theme ignore it.
• Nobody re-testing after a site update or a new marketing tool is added.

How PNE handles it

Our analytics and performance tracking work starts with an audit of what actually fires on your site, then installs GA4, Google Tag Manager, Consent Mode and conversion tracking in the right order. It's the set-up we run on our own site: every signal denied by default and updated only after the visitor chooses. The aim is numbers you can trust for ad decisions, and a banner you could defend if the CAI ever asked.

Sources

• Principaux changements apportés par la Loi 25 — Commission d'accès à l'information du Québec
• About consent mode — Google Ads Help
• Set up consent mode on websites — Google for Developers
• Behavioral modeling for consent mode — Google Analytics Help
• About consent mode modeling — Google Ads Help
• Meta Pixel: consent — Meta for Developers
• Votre aide-mémoire pour faire des affaires en français au Québec — Office québécois de la langue française