What consent looks like
Meaningful consent requires that you understand four key points: what is collected, why, with whom it is shared, and the consequences. If any of those are hidden behind dense legalese, consent may not be valid.
When you can withdraw
You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.
Organizations may still need to retain some information for legal purposes (tax records, regulatory reporting), but must stop using it for the purposes you withdrew consent for.
Quebec Law 25: stronger express consent rules
Quebec's private-sector Act (as amended by Law 25) requires express consent for sensitive information (health, financial, biometric). For profiling technology it requires that the person be informed and that profiling functions be off by default (s.8.1), and for decisions based exclusively on automated processing it requires notice and a chance to submit observations (s.12.1). A consent request must be clear, distinct from other information, and presented separately.