Quebec Law 25 and biometrics: identity verification guide (2026)

Last reviewed: 31 October 2026 · Not legal advice

Quebec Law 25 (Bill 64 before it passed) is the 2021 statute that modernised Quebec's privacy laws, and its biometric rules reach online identity checks that compare a live selfie with the photo on an ID document.^[8][6] For a business subject to these rules, a face match is a declared, consent-based process with its own deletion rule and, when data leaves the province, a privacy impact assessment.^[1][3]

This guide reads the official texts section by section, including the Act respecting the protection of personal information in the private sector, the CAI's declaration form, its decisions since 2024, the federal guidance of 11 August 2025, Bill C-36 and four provinces' public-sector rules. It ends with a checklist for this month (and our Canada page).

Quebec Law 25 and biometrics at a glance

1. Sept. 2022s. 44-45 amendedLaw 25's biometric changes take effect; CAI guide updated.
2. 22 Sept. 2023Most dutiesPIA before data leaves Quebec, express consent for sensitive data.
3. 18 Feb. 2025Metro orderFirst CAI order under s. 45: a biometric database prohibited.
4. 11 Aug. 2025OPC guidanceFederal biometrics guidance for businesses.
5. 15 June 2026Bill C-36Introduced; at second reading on 31 October 2026.

Dated milestones for biometric identity verification in Quebec and Canada.^{[6][8][10][14][17]}

What Quebec Law 25 says about biometric identity verification

Law 25 amended several statutes. Its biometric rules sit in sections 44 and 45 of the Act to establish a legal framework for information technology (CQLR c. C-1.1; in French, Loi concernant le cadre juridique des technologies de l’information, LCCJTI).^[1] Section 44 is the one an identity verification flow triggers.

Section 44Act to establish a legal framework for information technology

"A person's identity may not be verified or confirmed by means of a process that allows biometric characteristics or measurements to then be used except where such verification or confirmation has been previously disclosed to the Commission d’accès à l’information and except with the express consent of the person concerned."

Source: LégisQuébec, CQLR c. C-1.1^[1]

The French text, which is equally official, opens with a prohibition: « Nul ne peut exiger, sans l’avoir divulgué préalablement à la Commission d’accès à l’information et sans le consentement exprès de la personne, que la vérification ou la confirmation de son identité soit faite au moyen d’un procédé permettant de saisir des caractéristiques ou des mesures biométriques. » (No one may require identity to be verified by a biometric process without first disclosing it to the CAI and without the person's express consent.)^[2] The CAI's own page goes further: it states that requiring biometric identity verification is prohibited and that another means must be provided when a person does not consent.^[5]

Section 44 then adds three limits that shape the product:

• Minimum data: only the characteristics needed to link the person to the act, captured with the person's knowledge.^[1]
• No other use: nothing else revealed by the biometric data may be used to make a decision about the person or for any other purpose.^[1]
• Destruction: "The record of the characteristics or measurements and any notation relating thereto must be destroyed as soon as the purpose of verification or confirmation of identity has been met or the reason for the verification or confirmation no longer exists."^[1]

A 1:1 selfie match counts

The CAI's guide covers both purposes: identification, which searches a database among many identities, and authentication, which validates an identity by a "one against one" comparison with the biometric data of a known person.^[6] The guide also states that a code, template or model derived from an image by an algorithm is biometric information too.^[6] In February 2025 the CAI found that a retailer's facial recognition project was identity verification by biometric means, which requires express consent under the Act.^[11]

Section 44 declaration or section 45 database

Section 45 applies to a biometric database, for example stored face images or templates.^[1]

These powers are used: the CAI's first order under section 45, in February 2025, prohibited a retailer's facial recognition database.^[11]

What the CAI declaration form asks, and what to get from your vendor

The enterprise that verifies identity declares, through the CAI's online form, and every field is mandatory.^[5][7] In practice, many of the answers are about the vendor's system, so ask for them before you sign.

Attach the user manual, the consent form, the agreement for data sent outside Quebec and the privacy impact assessment (in French, évaluation des facteurs relatifs à la vie privée, EFVP).^[7]

Express consent and the non-biometric alternative

Section 12 of the private-sector Act says consent "must be given expressly when it concerns sensitive personal information", and it names a biometric nature among the reasons information is sensitive.^[3][4] For biometrics, the CAI says valid consent is manifest and express, free, informed, specific and limited in time.^[5] The CAI publishes a model consent form to adapt to your system.^[5]

The second half of the rule is the one product teams miss. Because a person must be free to refuse or withdraw, the CAI says another solution must be provided.^[5] The federal regulator says the same for non-essential uses: "you must provide individuals with other means of access or participation" and must not hinder access to them.^[15]

A consent-first verification flow for Quebec users. The alternative must not be a dead end.^[3][5]

Section 12.1 adds that when a decision is based exclusively on automated processing, you must tell the person and let them submit observations to a staff member who can review it.^[3]

Section 17: the privacy impact assessment before data leaves Quebec

Section 17Act respecting the protection of personal information in the private sector

"Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment."

Source: LégisQuébec, CQLR c. P-39.1^[3]

The assessment must weigh the sensitivity of the data, its purpose, the protection measures including contracts, and the legal framework of the destination.^[3] The data may go only if the assessment shows adequate protection, and the transfer "must be the subject of a written agreement" that reflects the assessment.^[3] The same applies when a person or body outside Quebec collects, uses, communicates or keeps the data on your behalf, which is the vendor case.^[3] In our reading, "outside Québec" includes the other Canadian provinces: the text does not stop at the Canadian border.^[3]

Section 3.3 requires a privacy impact assessment for any project to acquire or overhaul an information system, so a new vendor needs one even inside Quebec.^[3] Section 18.3 requires a written contract that limits the vendor to the mandate and stops it keeping the data afterwards.^[3]

Where each Law 25 duty sits in a vendor-based verification.^[1][3]

Penalties under Law 25

Collecting, using, keeping or destroying personal information in breach of the law can lead to a CAI administrative penalty or a penal fine.^[3][9]

What the CAI has decided on facial recognition

Canada-wide context: PIPEDA, the OPC guidance and Bill C-36

Age checks with a face also count as biometrics; our guide to age verification in Canada covers that case.

Outside Quebec, private-sector biometrics fall under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) in most provinces. On 11 August 2025 the Office of the Privacy Commissioner of Canada (OPC) published its guidance on biometrics, which lines up with Quebec's rules.^[14]

On cross-border processing, PIPEDA works differently from section 17. The OPC's guidelines state that "PIPEDA does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing", but the organization stays accountable and must use contracts or other means to provide "a comparable level of protection".^[16]

Bill C-36, which would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA, was introduced and read a first time on 15 June 2026 and is at second reading in the House of Commons as of 31 October 2026, according to LEGISinfo.^[17] It is a bill, not law. As introduced, its section 57(1) would require a privacy impact assessment and risk-mitigation measures before personal information is disclosed or transferred outside Canada, and the maximum penalty for the contraventions in one investigation would be the greater of CAD 10 million and 3% of gross global revenue.^[18] It also lists biometric information capable of uniquely identifying a person as sensitive.^[18]

Public-sector data residency in BC, Nova Scotia, Ontario and Alberta

Public bodies follow provincial laws, which drive many residency questions in requests for proposals. Payments and crypto firms: see KYC for money services businesses and crypto in Canada.

Canadian residency does not remove Quebec's section 17 assessment when data leaves Quebec for another province.^[3]

A checklist for Quebec Law 25 biometric verification this month

File the CAI declaration before the face match goes live for Quebec users.^[1]

• List every flow that captures and compares a face, account recovery included.
• Write down the problem the face match solves, with your own fraud data, and the less intrusive options you tried.^[5]
• Check whether stored images or templates form a biometric database; if so, disclose it promptly and at least 60 days before use.^[1]
• Run the section 3.3 and section 17 assessments, and sign a written agreement with the vendor.^[3]
• Build an express-consent screen in French and English, and keep a record of each consent.^[5]
• Offer a non-biometric route that works for people who refuse or withdraw consent.^[5]
• Set retention so biometric data is destroyed once the purpose is met, at the vendor and in backups.^[1][15]
• Route failed matches to a person who can review them, and tell users about automated decisions.^[3][15]
• File the CAI declaration with the manual, consent form, agreement and assessment attached.^[7]

Residency questions for vendors:

• Ask where data is processed and stored by default, and whether another region is available by contract.
• Ask for the full sub-processor list with the country of each one.
• Ask whether staff outside Canada can access production data.
• Ask for the vendor's demographic testing approach and error measures.^[15]

Reporting entities under federal anti-money laundering rules: our guide to FINTRAC identity verification in 2026 covers that side; assess Quebec privacy obligations separately.

How Didit helps

Didit's ID verification and liveness run in one workflow: the document is read and checked for tampering, then a passive, 3D action or flashing liveness check confirms a live person, and a 1:1 face match compares the selfie with the document portrait.^[24][25][34] Face templates are not kept after a session is deleted unless you turn template retention on, with a set number of days.^[27]

Didit acts as a data processor; you remain the controller.^[29] Database validation, including the Canadian credit-bureau check, is a non-biometric check you can assess for your alternative route: see database validation, AML screening and pricing.^[33]

Frequently asked questions

Sources

1. Act to establish a legal framework for information technology, CQLR c. C-1.1, sections 44 and 45, LégisQuébec, consolidated to 29 October 2026.
2. Loi concernant le cadre juridique des technologies de l’information, RLRQ c. C-1.1, articles 44 et 45, LégisQuébec.
3. Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, LégisQuébec.
4. Loi sur la protection des renseignements personnels dans le secteur privé, RLRQ c. P-39.1, LégisQuébec.
5. Biométrie, Commission d’accès à l’information du Québec.
6. Biométrie : principes à respecter et obligations légales des organisations, version 2.0, CAI, 21 September 2022.
7. Formulaire de déclaration d’un système biométrique ou procédé permettant de saisir des caractéristiques ou des mesures biométriques, CAI.
8. Des dispositions de la Loi 25 qui entrent en vigueur aujourd’hui, CAI, 22 September 2023.
9. Principaux changements apportés par la Loi 25, CAI.
10. Décision, dossier 1037199-S, Metro Inc., CAI, 18 February 2025.
11. La Commission interdit à Metro Inc. de mettre en service une banque de caractéristiques ou de mesures biométriques, CAI.
12. The CAI's facial recognition ruling: shaping the future of retail biometrics in Québec, Ogletree Deakins, 2 July 2026.
13. Québec privacy commissioner continues to set high bar for biometric data processing, Osler.
14. Privacy Commissioner of Canada publishes guidance on biometrics, OPC, 11 August 2025.
15. Guidance for processing biometrics, for businesses, OPC, 11 August 2025.
16. Guidelines for processing personal data across borders, OPC, 2009.
17. Bill C-36, 45th Parliament, 1st session, LEGISinfo, read 31 October 2026.
18. Bill C-36, first reading text, Parliament of Canada, 15 June 2026.
19. Guidance on disclosures outside of Canada, Government of British Columbia, updated 13 February 2025.
20. Personal Information International Disclosure Protection Act, questions and answers, Government of Nova Scotia.
21. Nova Scotia's new Freedom of Information and Protection of Privacy Act, David Fraser, Canadian Privacy Law Blog, 9 November 2025.
22. FIPPA and MFIPPA updates, Information and Privacy Commissioner of Ontario.
23. Protection of Privacy Act, Office of the Information and Privacy Commissioner of Alberta.
24. Face Match (1:1), Didit documentation.
25. Liveness detection, Didit documentation.
26. Biometric consent, Didit documentation.
27. Data retention and deletion, Didit documentation.
28. Delete session, Didit documentation.
29. Security and compliance, Didit documentation.
30. Certifications, Didit documentation.
31. Supported languages, Didit documentation.
32. Manual review, Didit documentation.
33. Canada credit bureau (FINTRAC) verification, Didit documentation.
34. ID verification, Didit documentation.

Next: identity verification in Canada, our FINTRAC guide and the ID verification page.