The legislation that modernizes legal provisions for the protection of personal information in the private sector, also known as Law 25, strengthens the standards and policies protecting the privacy of residents of Quebec. Similar to the GDPR in Europe and the CCPA in California, its goal is to protect individuals’ personal information based on current technological realities. It’s highly likely we’ll soon be witnessing the appearance of similar laws in other Canadian provinces or even at the federal level. In a situation of criminal violation, the fine could now be as high as $25,000,000 or even 4 percent of the offending company’s worldwide revenue.
The adoption of this law is a step in the right direction for Quebec consumers, since it provides them with better control over their personal information while maintaining a certain level of anonymity regarding their behaviour both online and offline. It also forces companies to be more transparent about the use of their customers’ data, in addition to requiring them to maintain high standards when it comes to privacy and security. At the same time, it creates new challenges for marketing specialists and analytics experts, and they will need to meet these challenges in the coming months and years ahead.
The content of this section has been taken from the fact sheet provided by the Commission d’accès à l’information du Québec. We also invite you to read the article written by our colleague Charles-Henri about Law 25, in which he dissects and explains in detail a few specific elements of the legislation.
The following list of obligations is provided for informational purposes only and should not serve as a guideline for the specific needs of your company. It also doesn’t free you from having to consult with a legal specialist or security experts, who should provide you with the guidance you need to ensure compliance with the new law. For more specific details on the matter, please refer to the original document.
As a reminder, here is a list of a few of the more important obligations and regulatory changes you should be aware of, organized by their effective date:
This is not an exhaustive list. The sectors cited were selected arbitrarily for the purposes of addressing the subject of this article.
Effects on organizational culture (which should not be underestimated)
Law 25 will transform the way in which customer and consumer data are processed with organizations, particularly by requiring changes in their usual philosophy of privacy management. This new law could also compel the development of programs aiming to educate the members of a company to the sensitivity of the personal data they have collected, since effective management of incidents related to confidentiality will become increasingly essential. In the new context to come, designing an internal data governance policy will now be a necessity—for every company.
Foreseeable effects on business and marketing
The efficiency and effectiveness of marketing initiatives will inevitably be affected when Law 25 comes into effect. It is likely to limit the ability of marketing technologies and analytics to collect granular data, which will change the precision of performance measurement and campaign optimization.
The main results of this phenomenon will be:
Effects on data and advertising technology
In September 2023, a few of the legal provisions will bring major changes that will transform the way the digital ecosystem currently functions.
Consent must be obtained before any personal data can be collected
Data gathering by platforms like Google Analytics or Adobe Analytics will require the explicit consent of users. Advertising data can no longer be relayed to platforms without approval. This means it’s the entire digital ecosystem as it currently stands that will be affected.
Use of personal data must be compatible with the purposes for which they were collected
Companies must communicate in simple, clear terms the purposes for which personal data is being collected. They must also ensure that their use complies with the purposes initially stated, which involves long-term tracking from their initial collection to their final use. This clause will have an especially pronounced impact on analytics systems using data from several sources. The purposes for use must therefore be tracked from initial collection through to the final use of the personal data.
Transfer of personal data outside of Quebec will be the focus of an impact study
Most analytics, media or CRM platforms transfer personal data outside of Quebec. This means the entire digital ecosystem of such companies will become the subject of a privacy impact assessment (PIA).
Effects on digital media
In terms of media activities, the introduction of Law 25 will have a notable impact on a number of current practices. One of the most major will be in traffic acquisition, irrespective of whatever landing page is used for an ad campaign. Each visit to an advertiser’s web property will have to include an explicit opt-in in order to be in compliance with Law 25. While that might seem obvious, it’s only the tip of the iceberg.
Effect of targeting visitors to your sites
Since the implementation of App Tracking Transparency by Apple in the spring of 2021, the rate of consent to tracking and tracing has plateaued at around 25 percent.
Based on this measurement, it can be expected that a significant proportion of users will adopt similar behaviour and will not want to be tracked with traditional methods, which will have a direct effect on the generation of primary data (or first-party cookies).
Retargeting tactics in digital media will be necessarily affected by the reduction in the quantity of data available—a fairly worrying phenomenon, since these strategies have a big impact on advertisers’ business results.
Effect on digital performance measurement
In tandem with media activities, performance measurement will be heavily affected by Law 25, irrespective of your preferred attribution model.
Performance tracking through behavioural profiling systems (such as Google Analytics or Adobe Analytics) will from now on have limited access to primary data (website cookies) to measure output using classic attribution models. The same will go for attribution on your ad platforms like Google Ads, Meta Ad Manager or any other ad purchasing platform offering a conversion attribution solution.
Thus, it’s highly likely that acquisition costs for a new customer will increase due to the increased difficulty experienced by companies looking to reach low-hanging fruit (customers most likely to be persuaded) via retargeting, and because attribution will no longer provide the same precision and granularity in ad campaign performance measurement for digital media.
Financial effects
To prepare themselves, companies must invest in a number of projects and programs to ensure:
Faced with these new regulations and the imminent disappearance of third-party cookies, we recommend developing marketing strategies through the adoption of three key concepts, which will enable you to navigate the legislative changes while maintaining a positive return on your investments:
Privacy-centric marketing
Present your customers with a simple, clear privacy policy that is available on your website and, naturally, respects the provisions of Law 25. Be transparent about your use of your customers’ and users’ data. Be sure to establish the highest standards in security and confidentiality when it comes to personal data, both within your company and with your partners. Don’t collect data from customers without their consent—plan on setting up a consent manager.
Devise a data strategy or update your current one by promoting the acquisition of zero-party or primary data. Explain to users the benefits they’ll get by accepting to share their data (for example, better customer experience, loyalty program, better offers, etc.).
Customer-centric marketing
Modern marketing must facilitate the organization of an effective customer journey, from acquisition through to retention. Developing a better understanding of your customers, both in terms of their monetary value as well as their behaviour and needs, will become an even more strategic element for companies. This understanding results from acquiring a 360-degree view of your clientele as well as through the analysis of their journey on your platform.
Development of this 360-degree view can be accomplished through a marketing data warehouse. The use of descriptive and predictive analytical techniques is needed to generate relevant insights about your clientele, while the use of surveys will enable you to better grasp their motivations and evolving needs.
A better understanding of customers contributes to improved segmentation as well as better audience management. These audiences can be activated using an omnichannel strategy with zero-party data and internal data (email, phone numbers, etc.). Modern marketing focuses above all on customer experience as well as advertising offered at various points of contact. Information about your clientele is essential to maintaining a good return on your marketing investment and to increase value for your customers.
Value-centric marketing
Obtaining consent and the acquisition of zero- or first-party data cannot happen if the user does not perceive any advantage to sharing their personal information with your company. Developing content to enhance the value of your offer from your clientele’s point of view has become a necessity, an element that will need to be carefully considered.
And yes, that means “Content is king” is making a comeback.
Generating valuable content (blog posts, e-books, case studies, benchmarks, personalized newsletters, webinars, research, online and offline events, etc.) can incite interest in both prospects and regular customers. Once they’ve become interested in your attractive, diverse range of content, the people you are reaching will probably be more likely to provide you with their email address and agree to be contacted by you.
You therefore need to develop onboarding strategies that will allow your prospects to get to know your brand better and perform a maximum number of tests to ensure the relevance of your content and the experience you’re offering on your website. In other words, you need to be sure you’re offering added value to your customers and prospects during every interaction they have with your brand.
In addition to enhancing customer value, marketing efforts must obviously bring an interesting return on investment for the organization initiating them. But don’t worry: Measuring the impacts of marketing initiatives on business goals will remain a possibility thanks to statistical regression techniques such as regression-based attribution (RBA), marketing mix modelling (MMM), impact analyses and panel regression techniques.
Wondering how you can simultaneously meet all these new challenges affecting the marketing field? Don’t hesitate to get in touch with us! Our specialists would be happy to help you achieve your business objectives.