Blocking Google Analytics before consent under Quebec's Law 25 (English)
A consent banner can be correctly installed, render normally, and still let a request reach Google before the visitor has chosen anything. The cause is the shape of the code Google's own setup documentation hands every site owner: a script tag with async and src written straight into the page's initial HTML. The browser's preload scanner starts that download before a JavaScript observer can neutralise the element, and that network request carries the visitor's IP address to the provider. Google Consent Mode, set to denied by default, limits what an already-loaded tag can store and send, but it does not prevent the download. Article 14 of the Act respecting the protection of personal information in the private sector (CQLR, chapter P-39.1) ends with this paragraph: a consent that is not given in accordance with the Act is without effect (s. 14 para. 4), so a click that arrives afterwards does not cover retroactively what has already left. The reliable fix is declarative: mark the tag with type="text/plain" and a category attribute so the browser never downloads it, and release it on consent. We are writing this because our own scanner found exactly this on helionai.ca on 31 July 2026, while our published privacy policy said the opposite. It was fixed and deployed the same day, on all 22 public pages.
Not legal advice. HelionAI is a software tool, not a law firm. The information provided is general in nature and does not constitute legal advice. For complex situations, consult qualified legal counsel.