Law 25 Basics for Creators Who Collect Emails

Law 25 is Quebec's modernized privacy legislation for the private sector. If you collect emails or other personal information from people in Quebec, the general principles are: be transparent about what you collect and why, get appropriate consent, protect the data and respond to people's requests. This is general information, not legal advice.

If you run a newsletter, a booking form or a giveaway, you handle personal information. A few clear habits help you respect your audience and reduce risk.

Important note

This article is general, educational information. It does not cover every situation and it is not legal advice. Privacy and anti-spam rules apply differently depending on who you are, what you collect and where your audience lives. Check with official sources, such as Quebec's privacy regulator, or a qualified professional for your case.

What counts as personal information

Personal information is anything that identifies a person or can be used to identify them. For creators, that often includes:

• Names and email addresses.
• Phone numbers and mailing addresses.
• Messages sent to you and booking details.
• Photos and video of identifiable people.
• Website and email analytics tied to individuals.

The core principles in plain language

Be transparent

Tell people what you collect, why, how you will use it and who you share it with. A clear, readable privacy policy on your website is a good starting point, and people should be able to find it easily.

Get meaningful consent

People should understand what they are agreeing to. Avoid pre-ticked boxes and buried wording. Ask separately for different uses. For example, subscribing to a newsletter is not the same as agreeing to have their data shared with sponsors.

Collect only what you need

If you only need an email address to send a newsletter, do not ask for a birth date and phone number as well. Less data means less risk.

Keep it secure

Use strong passwords and two-factor authentication on your email platform and tools. Limit who has access. Be careful with spreadsheets and exports that contain subscriber lists.

Know where your data goes

Email services, forms and AI tools may store data outside Quebec. Review the terms of the services you use, and understand what happens to the information you give them.

Have a point of contact

Organizations are expected to designate someone responsible for protecting personal information. For a solo creator, that is usually you. Put a contact address in your privacy policy so people can ask questions or make requests.

Be ready for requests and incidents

People may ask what you hold about them, ask for corrections or ask you to stop using their data. Have a simple process. If personal data is lost or exposed, know that there may be reporting duties. Seek professional guidance quickly in that situation.

A practical checklist for your email list

• A sign-up form that says plainly what people will receive and how often.
• An unchecked consent box or clear action, with a link to your privacy policy.
• A confirmation or welcome email.
• A working unsubscribe link in every message.
• A record of when and how each person signed up.
• A simple retention habit: remove inactive or unsubscribed contacts according to your policy.
• A list of tools that touch subscriber data.

Do not forget anti-spam rules

Canada also has anti-spam legislation that governs commercial electronic messages, including consent and unsubscribe requirements. It works alongside privacy law. Learn the basics and check the official guidance.

Using AI tools with subscriber data

Be cautious about pasting subscriber lists or private messages into AI tools. Read the tool's data policy first. Where possible, remove names and details you do not need before using it.

Giveaways, contests and sponsors

If you collect entries or share leads with a partner, state it clearly in the entry terms and get consent for each use. Contest rules can have their own legal requirements, so get advice before running one.

Start simple

You do not need a perfect system on day one. Write a clear privacy policy, use a reputable email provider, collect only what you need, honour unsubscribes and keep records. Then review your practices every few months.

Keep learning

Collège Unica offers online programs, including the Applied AI A.E.C. program. Check the program page for current details. Full-time students have Unica incubation included with their full-time program (6-12 months online, 12-20 months on-campus), with no cash value and not transferable.

Frequently asked questions

What is Law 25?

Law 25 is Quebec legislation that modernized how private-sector organizations must protect personal information. It affects how you collect, use, store and share data.

Does Law 25 apply to me as a solo creator?

It may, depending on your activities and the people whose information you collect. Get advice on your specific situation from a qualified professional.

Is an email address personal information?

Generally yes, an email address that identifies or can identify a person is treated as personal information.

Is this legal advice?

No. This article is general information only. Consult a lawyer or the relevant authority for advice on your situation.

Take the next step

Are you a creator, artist, influencer or young founder looking for real opportunities? Join the Unica Creator Business Hub: https://api.leadconnectorhq.com/widget/survey/iH7MbTqb1IDT7FY60fuM