The effects of Law 25 on your marketing strategies and operations

The legislation that modernizes legal provisions for the protection of personal information in the private sector, also known as Law 25, strengthens the standards and policies protecting the privacy of residents of Quebec. Similar to the GDPR in Europe and the CCPA in California, its goal is to protect individuals’ personal information based on current technological realities. It’s highly likely we’ll soon be witnessing the appearance of similar laws in other Canadian provinces or even at the federal level. In a situation of criminal violation, the fine could now be as high as $25,000,000 or even 4 percent of the offending company’s worldwide revenue.

The adoption of this law is a step in the right direction for Quebec consumers, since it provides them with better control over their personal information while maintaining a certain level of anonymity regarding their behaviour both online and offline. It also forces companies to be more transparent about the use of their customers’ data, in addition to requiring them to maintain high standards when it comes to privacy and security. At the same time, it creates new challenges for marketing specialists and analytics experts, and they will need to meet these challenges in the coming months and years ahead.

The content of this section has been taken from the fact sheet provided by the Commission d’accès à l’information du Québec. We also invite you to read the article written by our colleague Charles-Henri about Law 25, in which he dissects and explains in detail a few specific elements of the legislation.

The following list of obligations is provided for informational purposes only and should not serve as a guideline for the specific needs of your company. It also doesn’t free you from having to consult with a legal specialist or security experts, who should provide you with the guidance you need to ensure compliance with the new law. For more specific details on the matter, please refer to the original document.

As a reminder, here is a list of a few of the more important obligations and regulatory changes you should be aware of, organized by their effective date:

• As of September 22, 2022:
  

   

  • appointment of a person responsible for personal information;
    
  • new obligation to report confidentiality incidents involving personal information;
    
  • framework for the communication of personal information for the purposes of conducting a study, research or producing statistics and as part of a business transaction;
    
  • new framework for identification through biometrics.
    

• As of September 22, 2023:
  

   

  • adoption of policies and practices for the protection of personal information;
    
  • evaluation of factors relating to privacy;
    
  • information and transparency disclosure;
    
  • new obligations regarding consent;
    
  • new obligations concerning the use of personal information;
    
  • principle of default privacy protection;
    
  • new obligation concerning the destruction of personal information;
    
  • new rules concerning the communication of personal information outside of Quebec;
    
  • creation of a right to prevent communication, re-indexing or de-indexing (the right to be forgotten)
• As of September 22, 2024:
  

   

  • creation of a right to data portability.
    

This is not an exhaustive list. The sectors cited were selected arbitrarily for the purposes of addressing the subject of this article.

Effects on organizational culture (which should not be underestimated)

Law 25 will transform the way in which customer and consumer data are processed with organizations, particularly by requiring changes in their usual philosophy of privacy management. This new law could also compel the development of programs aiming to educate the members of a company to the sensitivity of the personal data they have collected, since effective management of incidents related to confidentiality will become increasingly essential. In the new context to come, designing an internal data governance policy will now be a necessity—for every company.

Foreseeable effects on business and marketing

The efficiency and effectiveness of marketing initiatives will inevitably be affected when Law 25 comes into effect. It is likely to limit the ability of marketing technologies and analytics to collect granular data, which will change the precision of performance measurement and campaign optimization.

The main results of this phenomenon will be:

• a likely increase in acquisition costs of a new customer or a prospect for most companies (this aspect will be elaborated a bit later on, in the section “Effects on digital media”);
  
• difficulty improving marketing return on investment due to the increased complexity of measuring marketing performance.

Effects on data and advertising technology

In September 2023, a few of the legal provisions will bring major changes that will transform the way the digital ecosystem currently functions.

Consent must be obtained before any personal data can be collected

Data gathering by platforms like Google Analytics or Adobe Analytics will require the explicit consent of users. Advertising data can no longer be relayed to platforms without approval. This means it’s the entire digital ecosystem as it currently stands that will be affected.

Use of personal data must be compatible with the purposes for which they were collected

Companies must communicate in simple, clear terms the purposes for which personal data is being collected. They must also ensure that their use complies with the purposes initially stated, which involves long-term tracking from their initial collection to their final use. This clause will have an especially pronounced impact on analytics systems using data from several sources. The purposes for use must therefore be tracked from initial collection through to the final use of the personal data.

Transfer of personal data outside of Quebec will be the focus of an impact study

Most analytics, media or CRM platforms transfer personal data outside of Quebec. This means the entire digital ecosystem of such companies will become the subject of a privacy impact assessment (PIA).

Effects on digital media

In terms of media activities, the introduction of Law 25 will have a notable impact on a number of current practices. One of the most major will be in traffic acquisition, irrespective of whatever landing page is used for an ad campaign. Each visit to an advertiser’s web property will have to include an explicit opt-in in order to be in compliance with Law 25. While that might seem obvious, it’s only the tip of the iceberg.

Effect of targeting visitors to your sites

Since the implementation of App Tracking Transparency by Apple in the spring of 2021, the rate of consent to tracking and tracing has plateaued at around 25 percent.

Chart source: Flurry

Based on this measurement, it can be expected that a significant proportion of users will adopt similar behaviour and will not want to be tracked with traditional methods, which will have a direct effect on the generation of primary data (or first-party cookies).

Retargeting tactics in digital media will be necessarily affected by the reduction in the quantity of data available—a fairly worrying phenomenon, since these strategies have a big impact on advertisers’ business results.

Effect on digital performance measurement

In tandem with media activities, performance measurement will be heavily affected by Law 25, irrespective of your preferred attribution model.

Performance tracking through behavioural profiling systems (such as Google Analytics or Adobe Analytics) will from now on have limited access to primary data (website cookies) to measure output using classic attribution models. The same will go for attribution on your ad platforms like Google Ads, Meta Ad Manager or any other ad purchasing platform offering a conversion attribution solution.

Thus, it’s highly likely that acquisition costs for a new customer will increase due to the increased difficulty experienced by companies looking to reach low-hanging fruit (customers most likely to be persuaded) via retargeting, and because attribution will no longer provide the same precision and granularity in ad campaign performance measurement for digital media.

Financial effects

To prepare themselves, companies must invest in a number of projects and programs to ensure:

• they have on hand expertise in legislation and security to comply with the introduction of these new rules;
  
• the development of programs to educate employees internally about confidentiality issues;
  
• investment in data strategy and governance by updating policies currently in place;
  
• investment in zero-party data acquisition programs (the equivalent of first-party data, but obtained by consent) and primary data acquisition programs (data collected directly by the company from its customers; information about customers; data on their behaviour on the web, mobile and offline; business transaction data; information collected through surveys);
• the acquisition of new data technologies such as a marketing data warehouse and other tools for creating a 360-degree view of customers (integrated or modular CDP/Data Cloud + Reverse ETL), realized with zero-party and first-party data, but also technologies to manage user consent (consent management platforms).

Faced with these new regulations and the imminent disappearance of third-party cookies, we recommend developing marketing strategies through the adoption of three key concepts, which will enable you to navigate the legislative changes while maintaining a positive return on your investments:

• privacy-centric marketing: focus on obtaining consent from your users and customers, showing your transparency with regard to the way in which data are used, respecting their right to no longer be tracked or contacted;
  
• customer-centric marketing: always focus on the evolving needs of customers as well as their motivations;
  
• value-centric marketing: orient your work based on the value obtained by the end customer, but also by the business, and never invest effort in initiatives that have no value for the customer or organization you work for.

Privacy-centric marketing

Present your customers with a simple, clear privacy policy that is available on your website and, naturally, respects the provisions of Law 25. Be transparent about your use of your customers’ and users’ data. Be sure to establish the highest standards in security and confidentiality when it comes to personal data, both within your company and with your partners. Don’t collect data from customers without their consent—plan on setting up a consent manager.

Devise a data strategy or update your current one by promoting the acquisition of zero-party or primary data. Explain to users the benefits they’ll get by accepting to share their data (for example, better customer experience, loyalty program, better offers, etc.).

Customer-centric marketing

Modern marketing must facilitate the organization of an effective customer journey, from acquisition through to retention. Developing a better understanding of your customers, both in terms of their monetary value as well as their behaviour and needs, will become an even more strategic element for companies. This understanding results from acquiring a 360-degree view of your clientele as well as through the analysis of their journey on your platform.

Development of this 360-degree view can be accomplished through a marketing data warehouse. The use of descriptive and predictive analytical techniques is needed to generate relevant insights about your clientele, while the use of surveys will enable you to better grasp their motivations and evolving needs.

A better understanding of customers contributes to improved segmentation as well as better audience management. These audiences can be activated using an omnichannel strategy with zero-party data and internal data (email, phone numbers, etc.). Modern marketing focuses above all on customer experience as well as advertising offered at various points of contact. Information about your clientele is essential to maintaining a good return on your marketing investment and to increase value for your customers.

Value-centric marketing

Obtaining consent and the acquisition of zero- or first-party data cannot happen if the user does not perceive any advantage to sharing their personal information with your company. Developing content to enhance the value of your offer from your clientele’s point of view has become a necessity, an element that will need to be carefully considered.

And yes, that means “Content is king” is making a comeback.

Generating valuable content (blog posts, e-books, case studies, benchmarks, personalized newsletters, webinars, research, online and offline events, etc.) can incite interest in both prospects and regular customers. Once they’ve become interested in your attractive, diverse range of content, the people you are reaching will probably be more likely to provide you with their email address and agree to be contacted by you.

You therefore need to develop onboarding strategies that will allow your prospects to get to know your brand better and perform a maximum number of tests to ensure the relevance of your content and the experience you’re offering on your website. In other words, you need to be sure you’re offering added value to your customers and prospects during every interaction they have with your brand.

In addition to enhancing customer value, marketing efforts must obviously bring an interesting return on investment for the organization initiating them. But don’t worry: Measuring the impacts of marketing initiatives on business goals will remain a possibility thanks to statistical regression techniques such as regression-based attribution (RBA), marketing mix modelling (MMM), impact analyses and panel regression techniques.

Wondering how you can simultaneously meet all these new challenges affecting the marketing field? Don’t hesitate to get in touch with us! Our specialists would be happy to help you achieve your business objectives.