Law 25 compliance for a shopping centre app means four duties: assess privacy before you build, keep settings private by default, tell shoppers before you locate them, and get consent. The official text of Quebec’s act, updated October 2026, caps fines at $25 million or 4% of worldwide turnover.

Syndicate sells shopping centres their own shopper app and operator dashboard, so we have a stake in what you choose.

We’re a Canadian-based company, and in Quebec we have assembled this plain-language guide for shopping venues. It isn’t legal advice, so have your privacy officer or a lawyer sign off on your app before launch. The act has broader duties too, such as naming a person in charge of personal information (section 3.1) and reporting serious confidentiality incidents (section 3.5).

Does Law 25 apply to your centre’s app?

If your shopping venue collects personal information about shoppers in Quebec, it does. Law 25 amended Quebec’s Act respecting the protection of personal information in the private sector, and that act applies to any business doing so.

An app account holds a name, an email and often a phone number. Once you add location, offers redeemed and stores visited, you hold a detailed picture of a person. If your privacy officer asked you today where your shoppers’ location data goes and who can see it, would you have the answer? Outside Quebec, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies in most provinces, while Alberta and British Columbia have their own private-sector laws.

What does section 8.1 mean for location features?

Under section 8.1 of the private-sector act, a business that uses technology able to identify, locate or profile a person must tell them first. It also has to explain how to turn those functions on.

Geofenced push notifications fit that description, and so does an offer that follows a shopper’s visits. Your app’s first screens should explain what it does with location, in words a shopper understands, and show where to switch it on or off.

Consent may also need to be express. Section 12 requires express consent for sensitive information, and it judges sensitivity partly by the context of use. A precise, ongoing record of where a person goes could meet that test, so ask your privacy officer to make that call before launch.

What has to be private by default?

Section 9.1 says that when a technological product offered to the public has privacy settings, they must provide the highest level of confidentiality by default. The shopper shouldn’t have to do anything to get that protection.

In practice, every sharing or tracking setting starts off, and the shopper turns on what they want. That’s your chance to explain what they get in return, whether it’s a parking reminder, an offer near the food court or points in their wallet.

When do you need a privacy impact assessment?

You need one before you build, because section 3.3 requires an assessment for any project to acquire, develop or overhaul an information system involving personal information. A shopper app with accounts and location is exactly that kind of project.

The assessment asks what you collect, why, where it’s kept, who sees it and when you delete it, so ask your vendor to answer those questions in writing. Our questions for a shopping centre app demo include several of them.

What happened with the Tim Hortons app?

It’s the closest Canadian precedent for a retail app that tracks location. Four commissioners, including Quebec’s Commission d’accès à l’information, published their findings on June 1, 2022.

The app collected location in the background, even when it was closed. While a phone was moving, it recorded a location every 2.5 or 6 minutes, depending on the app version. Since the permission prompts didn’t disclose this, the commissioners found Tim Hortons did not obtain valid consent.

For your mall app, that means collecting location only while it serves the shopper, saying so in the permission prompt and documenting why you collect it.

What happened at Cadillac Fairview’s malls?

Cadillac Fairview ran cameras inside directory kiosks at 12 Canadian malls. The federal, Alberta and British Columbia privacy commissioners reported on October 29, 2020 that the cameras captured 5 million images of shoppers to estimate their age and gender, without meaningful consent.

The commissioners also found that decals at the mall entrances pointing to a privacy policy weren’t enough, and the company removed the cameras.

What if your vendor stores data outside Quebec?

That’s where section 17 applies. Before personal information is communicated outside Quebec, or a provider outside Quebec is trusted to collect or keep it, the business has to assess the transfer. That assessment looks at how sensitive the data is and the law where it will be stored.

The transfer can only go ahead if the assessment shows the information will be adequately protected, and it needs a written agreement. Since most app platforms run in the cloud, ask every vendor where your shoppers’ data is stored.

What are the penalties?

Under sections 90.12 and 91 of the act, Quebec can impose administrative penalties of up to $10 million or 2% of worldwide turnover, whichever is greater. Penal fines reach $25 million or 4%. Those are maximums: the Commission d’accès à l’information imposes administrative penalties, while courts set penal fines after a prosecution.

What should you check before launch?

Hand this list to your privacy officer. Each line comes from the sections and findings above, and several belong in your questions for an app vendor.

Pre-launch checklist for a shopper app

• A privacy impact assessment is done and documented before development starts (section 3.3).
• Location and every tracking setting start off; the shopper turns them on (section 9.1).
• The app says, before collecting, that it can locate the shopper and how to turn that on (section 8.1).
• The permission prompt matches what the app does, including any background collection.
• Your privacy policy names what you collect, why, where it’s stored and when it’s deleted.
• Your vendor’s contract says the data is yours and limits what the vendor can do with it.
• You know where the vendor stores shopper data, and any transfer outside Quebec is assessed and covered by a written agreement (section 17).
• You can export or delete a shopper’s data when they ask.

What should you ask any app vendor, including us?

Compliance stays with your shopping venue, and a badge on a vendor’s sales page doesn’t change that. What a good vendor can do is build the app so your obligations are easy to meet, and answer this checklist in writing.

With Syndicate, your app is yours, and our data export tools send shopper data to your own systems. Where we host the app’s data is a fair first question to ask us, too.

We’re a Montreal team, in business since 2015. Bring this checklist to your first call, and we’ll go through it with you before a pilot on one part of your property starts.

We checked these sources in November 2026.

Would it be a bad idea to walk through the checklist with your own app plans on the table? Book a time or phone 1-844-404-4796.