Law 25 website skills compared: Balise, CookieYes

A Québec contractor's site has a cookie banner, and Google Analytics still loads before anyone clicks it. The privacy policy came from an American generator and talks about California. The contact form says nothing about what happens to the name and email it collects. Each of these problems has a tool, and none of the tools sees all three. For an audit run by a coding agent, I use loi-25-website from molveau/skills: it walks the seven obligations that reach a website and writes a pass, fix or n.a. verdict for each, with the page or file that proves it. Like every tool below, it is general information, not legal advice. When the review goes past the website, to contracts, the backend or federal law, Mykhailo Toporkov's skill goes further, and Balise is the better choice if you want a scripted scanner. The obligations themselves are explained section by section in the Law 25 guide.

The contenders

Tool	Author	Licence	Best at	Lacks
CAI guides	Commission d'accès à l'information	Free public guidance	The regulator's own reading: consent, policy, impact assessments, profiling	A self-assessment tool; most guides are in French
pipeda-law25-compliance	Mykhailo Toporkov	MIT	A section-cited review of code, data flows and documents against PIPEDA and Law 25	A walk of a live website, item by item
Balise	Acquiredl	MIT	A Python scanner plus a questionnaire, 32 checks, a bilingual report	A light setup: it is a Python tool, and some checks need an optional model
Loi 25 Comply	AZ Internet	GPLv2 or later; paid Pro version	A WordPress plugin for the person in charge, a generated policy and a banner	Script blocking before consent in the free version
CookieYes	CookieYes	Commercial, with a free plan	A hosted consent banner that blocks third-party cookies until opt-in and logs consent	Everything except consent and the policy
CookieConsent	Orest Bida	MIT	A self-hosted banner in plain JavaScript, with categories	Any Law 25 content; you write the texts and the categories
loi-25-website	Molveau Studio	MIT	A seven-point website audit with evidence and an ordered list of fixes	A script; contracts, backends and federal law

Each one, fairly

The CAI's guides, by the Commission d'accès à l'information

The Commission is the regulator, and its pages are the source every other tool here interprets. The page on the main changes brought by Law 25 covers technology that profiles visitors, the policy on the website, communication outside Québec, the incident register and portability. Separate guides cover the criteria for valid consent, the privacy policy, privacy impact assessments with a report template, and profiling. The Commission offers no self-assessment tool and, as far as I found, no template for the incident register. Read its guides alongside any tool, and where a tool and the Commission disagree, follow the Commission or ask a lawyer.

pipeda-law25-compliance, by Mykhailo Toporkov

This is the closest agent skill to mine, and it is wider. It reviews code, data flows and documents (privacy policies, consent flows, impact assessments, incident registers, vendor contracts) against both PIPEDA and Law 25, records which regime applies to each activity, and writes findings that cite a section, the evidence, the issue and a fix. It says plainly that it is not legal advice, and it flags other regimes for separate review. Install it when the question reaches past the website or when federal law applies too.

Balise, by Acquiredl

Balise scans a public website and pairs the scan with a short questionnaire about what no scan can see: the incident register, impact assessments, transfer agreements, vendor contracts. It runs 32 checks, writes a bilingual report, tags each check by the strength of its legal basis (statute, the Commission's expectation, or a common interpretation) and refuses to give a compliance score. Checks that need judgment use an optional model and report unknown without it. I did not verify its legal reading item by item. Use it if you want a repeatable tool that hands the owner a report.

Loi 25 Comply, by AZ Internet

This WordPress plugin from a Québec company covers three items in its free version: a form to designate the person in charge with a public shortcode, a generated policy in French and English, and a consent banner with a local consent log. Blocking third-party scripts before consent, the incident register, impact assessments and rights requests are in the paid Pro plugin, according to its page. A banner that does not block what loads before the click is the exact problem in the opening paragraph, so check that part before relying on the free version.

CookieYes

CookieYes is one of several hosted consent platforms with a page on Law 25. It scans the site against its cookie database, blocks third-party cookies until the visitor opts in, keeps consent logs and generates a policy. Cookiebot, OneTrust and others offer similar products. They handle consent and part of the notice at collection, and nothing about the person in charge, the impact assessment before data leaves Québec, the register or portability. Use one when the site loads tools that profile visitors and you would rather not maintain the banner yourself.

CookieConsent, by Orest Bida

A free, self-hosted banner in plain JavaScript, with consent categories and scripts held back until their category is accepted. It makes no claim about Law 25, which is honest: the texts, the categories and the choice of what stays off by default are yours. It suits a custom site where a hosted platform would be one more third party to list in the policy.

What loi-25-website adds

• Seven obligations, each with its section. Person in charge (s. 3.1), policy in plain language (s. 8.2), notice at collection (s. 8 and 8.3), opt-in for technology that identifies, locates or profiles (s. 8.1), assessment and agreement before information leaves Québec (s. 17), incident register (s. 3.5 and 3.8), portability (s. 27).
• Where to look in a codebase. The checklist tells the agent what to grep for: forms, mailto: buttons, server actions, scripts, embeds, tag managers, requests to external hosts. Each item has a stated pass condition.
• A fixed report format. One line per obligation, pass, fix or n.a. with the page or file and a reason, then the fixes in order and the open questions for the owner or a lawyer. n.a. needs a reason, and evidence that lives outside the repo, such as a register or an agreement, is never assumed to exist.
• The myths, answered from the text. No size threshold (s. 1). Browser cookie settings are excluded from the confidentiality-by-default rule (s. 9.1), so not everything needs a banner. Hosting outside Canada is allowed after an assessment and an agreement (s. 17).
• Honest limits. It reads code and pages; it does not load the site in a browser, so pair it with a scan of what fires before consent. It covers the website only, not federal law, employee data or vendor contracts. Section numbers are as read on 10 June 2026; check LégisQuébec before relying on them.

Install

The skill alone, with the skills CLI:

npx skills add molveau/skills -s loi-25-website

The Québec bundle (french-typography and loi-25-website):

npx skills add molveau/skills -s french-typography -s loi-25-website

In Claude Code, all eleven skills as one plugin:

/plugin marketplace add molveau/skills
/plugin install molveau-skills@molveau

Every skill and bundle is on the skills page, and the source is at github.com/molveau/skills. Related reading: what Law 25 requires of a website and the French typography skills comparison. If you would rather have it done for you, compliance is offered as a fixed-price package.

Checklist

• The title and contact information of the person in charge are on the site.
• The policy describes what this site collects, in plain language.
• Every form carries a notice and a link to the policy.
• Nothing that profiles visitors loads before they opt in, checked in a browser, not only in the code.
• Each third-party service is listed with where it keeps data, and the assessment exists for those outside Québec.
• Every finding the tool could not prove is an open question for the owner or a lawyer, not a pass.