Canada's New Children's Privacy Code

 

This shouldn’t be a radical idea. A seventeen-year-old young person is different from a seven-year-old child, who are both different from a three year old toddler. When we're talking about children's privacy, online safety, and their ability to make decisions about their own personal information, we should recognize those differences.

And that’s baked into Privacy Commissioner of Canada’s new Children's Privacy Code, released on October 20, 2026.

It's a substantial document setting out the OPC’s views on how businesses should collect, use, and disclose the personal information of children and young people.

And I think there's a lot to like about it.

It emphasizes that children have privacy rights of their own. It recognizes that children develop greater independence and decision-making capacity as they mature. And it says that online services should be designed to protect children's privacy without preventing them from participating in the digital world.

This is particularly interesting at a time when governments are proposing increasingly blunt measures to “protect” young people online, including outright restrictions on access to social media.

And there's another interesting wrinkle. The Commissioner's recognition that meaningful consent needs to account for an individual's capacity seems to sit a little awkwardly alongside the arguments his office has been making before the Supreme Court of Canada in the Facebook privacy case. I'll get to that.

In this episode, I'm going to explain where this new Code came from, what it says, what it means for businesses and young people, and why I think its underlying philosophy is particularly important.

And I'll point out some legal questions and a few inconsistencies along the way.

What exactly is a Children's Privacy Code?

This is not a new law. Parliament hasn't passed a Children's Privacy Act. And the Commissioner hasn't suddenly acquired the authority to impose new legal obligations simply by publishing a document.

What we're looking at is regulatory guidance. The Code sets out the Privacy Commissioner's interpretation of how Canada's existing private-sector privacy law, PIPEDA, applies when businesses collect, use, and disclose children's personal information.

PIPEDA is the Personal Information Protection and Electronic Documents Act. It has been Canada's federal private-sector privacy law since 2001.

It establishes broad principles covering consent, appropriate purposes, limits on collection, safeguards, access to personal information, and accountability. But PIPEDA doesn't really distinguish between adults and children. And it doesn't contain a special set of children's privacy rights.

The Commissioner has therefore taken existing legal requirements and developed guidance for applying them to young people. This is significant, but we need to understand its limitations.

For example, the Code repeatedly says organizations must do certain things.

Sometimes that's a fair reflection of obligations already imposed by PIPEDA. Other times, the Code is setting out the Commissioner's interpretation of what compliance requires. Those are not necessarily the same thing.

A regulator's interpretation of the law can be persuasive, and it can tell businesses what to expect during investigations. But it doesn't have the same legal force as legislation, and ultimately the courts determine what PIPEDA requires. So it's important not to confuse the Privacy Commissioner's expectations with new statutory requirements. In short, if you follow the code, you’re likely to stay on the Commissioner’s good side.

Where did this come from?

The Children's Privacy Code didn't appear out of nowhere. For several years, privacy regulators around the world have been paying increasing attention to the particular challenges children face online.

The United Kingdom has its Age Appropriate Design Code, which is probably one of the best-known examples. Ireland has developed children's data protection guidance, and jurisdictions including California have adopted or proposed additional requirements for online services used by children.

There's also an international human rights dimension. Canada ratified the United Nations Convention on the Rights of the Child in 1991. That Convention recognizes that children have rights of their own, including a right to privacy. It also emphasizes their best interests, their right to participate in decisions affecting them, and their evolving capacities.

In 2021, the UN Committee on the Rights of the Child published guidance explaining how those rights apply in digital environments.

Canadian courts have also repeatedly recognized that young people deserve particular privacy protections.

In A.B. v. Bragg Communications, the Supreme Court recognized the inherent vulnerability of children and the importance of their privacy.

And in R. v. Jarvis, the Court recognized that Canadian law often provides children with greater privacy protections than adults.

Against that background, the Privacy Commissioner launched a consultation process to develop a Canadian Children's Privacy Code. That exploratory consultation concluded in August 2025.

The Commissioner also sought input from young people, including through a Youth Council consisting of students aged fourteen to seventeen.

And I think that deserves some credit. If you're going to develop rules that affect how young people use technology, you really should talk to young people.

According to the Commissioner, some of their biggest concerns were the lack of control over their information, the lack of meaningful choice, and the difficulty understanding what companies were doing with their data. 

Young people definitely weren't asking to be excluded from the internet. They wanted greater control over how they participated in it. And that takes us to what I consider the most important part of the Code.

Children are not all the same

The Code expressly recognizes that children under eighteen are not a homogeneous group.

That's an important point.

A five-year-old, a twelve-year-old, and a seventeen-year-old can have radically different abilities to understand information, assess risks, and make decisions.

And children don't suddenly acquire the ability to exercise privacy rights at midnight on their eighteenth birthday. They develop that ability over time. The Code calls this evolving capacity.

Younger children generally require greater protection and more involvement from parents or guardians.

As they grow older, they should be given increasing autonomy over their personal information.

The Code actually provides a table dividing childhood into five developmental stages.

For children from birth to age five, it contemplates parental consent.

For children aged six to nine, parental consent remains necessary, but they should also receive simple written or visual explanations.

For children ten to twelve, the expectation is parental consent along with information directed to the child.

At thirteen to fifteen, the Code contemplates consent from the young person themselves.

And for sixteen- and seventeen-year-olds, again, the young person generally provides their own consent.

But these categories aren't supposed to be a mechanical substitute for considering capacity.

The Code says that, for children thirteen and older, organizations should consider whether the young person can understand the particular decision they're being asked to make. And that assessment should account for the sensitivity of the personal information and the potential consequences.

That makes sense. Consider a fourteen-year-old signing up for an online chess club.

Maybe the service needs a username, an email address, and a password. That's one thing.

Now consider the same fourteen-year-old being asked to consent to the continuous collection of precise location information, detailed behavioural profiling, and disclosure of that information to advertising companies. Those are very different privacy decisions.

A young person might be perfectly capable of understanding one while struggling to appreciate all the implications of the other. And importantly, greater maturity should mean greater autonomy, not simply fewer rights.

The Code recognizes that privacy protections and parental involvement should be adjusted as children become more capable of making their own decisions.

I particularly like the idea of guided autonomy.

Parents have an important role, but they shouldn't necessarily be able to control every aspect of their teenager's digital life. And businesses shouldn't outsource responsibility for privacy protection to parents by assuming that parental controls solve everything.

Children are rights-holders in their own right. That includes the right to some privacy from their parents.

That's a more sophisticated approach than simply saying everybody under eighteen needs adult supervision at all times.

What businesses are expected to do

Now let's look at the practical requirements.

The Code contains seven main expectations, along with a discussion of practices the Commissioner considers unacceptable. And some of these expectations probably should inform how online services are designed.

First: meaningful consent.

Consent mechanisms have to be understandable to the children who are using them.

You can't simply take a twenty-page privacy policy written by lawyers for lawyers, put an "I agree" button at the bottom, and assume a twelve-year-old has meaningfully consented. Actually, you probably shouldn't be doing that to adults either.

The Code says optional uses of personal information should require express, opt-in consent. If an app wants to collect information to deliver its essential service, that's one question. If it also wants to collect additional information for personalization, analytics, or other optional features, those choices should be presented separately. And businesses shouldn't penalize children for declining optional data collection.

They also have to make it easy to withdraw consent.

Second: privacy impact assessments.

The Commissioner encourages organizations to assess the privacy risks of their services, especially when those services involve higher-risk activities.

This means looking at what information is collected, why it's needed, how it could be misused, and what consequences that misuse could have for young people. It's a privacy-by-design approach.

Ideally, those questions are asked before the product launches, not after something goes wrong.

Third: high privacy settings by default.

This is a particularly important recommendation. Children shouldn't have to go hunting through complicated settings menus to turn on privacy protections.

The protections should already be enabled. For example, precise location sharing should be turned off by default. Profiles shouldn't automatically be visible to the entire internet. Third-party sharing should be off unless appropriate consent is obtained. And profiling should also be off by default.

The underlying philosophy is simple: a child shouldn't have to understand every possible privacy risk before the service becomes reasonably safe to use.

Fourth: data minimization.

Businesses should only collect the personal information they actually need to provide the service.

Not everything that might be useful someday. Not everything that might be commercially valuable. And not everything that might help the marketing department develop a more detailed profile.

If an online game works perfectly well with a username, it probably doesn't need a child's real name, home address, precise location, and complete contact list. The Code also emphasizes that information shouldn't be retained longer than necessary.

And because children develop and change so quickly, companies should consider what happens to information collected during childhood as those children mature and become adults.

Fifth: transparency.

Privacy notices have to be understandable to their intended audience. And that means more than simply making them shorter. Information should be presented at appropriate times, in language and formats suitable for the young people using the service.

A thirteen-year-old might understand a relatively straightforward explanation of how recommendations are generated. A seven-year-old might need something much simpler, perhaps with illustrations. 

The important thing is that the explanation is genuinely understandable. 

The Commissioner’s report has some interesting examples of how to communicate privacy related choices to kids. 

Sixth: correction and deletion.

The Code says young people should have practical ways to correct inaccurate personal information and request its deletion. This is especially important when we're talking about things that people shared when they were children. Something that seemed funny or important when someone was eleven may be embarrassing, misleading, or completely irrelevant by the time they're seventeen.

And young people should have some meaningful ability to move beyond their digital history.

The Commissioner wants businesses to make correction and deletion processes easy to find and use.

There are legal questions about the extent to which PIPEDA creates an enforceable deletion right, but the underlying policy objective makes sense.

Seventh: avoiding profiling.

This is one of the most consequential parts of the Code.

The Commissioner says businesses should not use children's personal information for behavioural advertising or other forms of commercial profiling that exploit their vulnerabilities.

That means collecting information about what a child clicks on, watches, searches for, and interacts with, then using that information to infer their interests and target them with advertising.

The Code is particularly concerned about profiling through artificial intelligence.

AI systems can identify patterns and infer things about people that they haven't explicitly disclosed.

And when those systems are used to influence the behaviour of young people, there are significant privacy concerns.

The Code isn't saying that all personalization is prohibited.

There may be legitimate reasons to adapt a service to a child's needs.

But the question has to be whether the practice is genuinely in the child's best interests, not simply whether it increases engagement or advertising revenue.

Some things the Commissioner says consent cannot fix

The Code goes further than simply asking businesses to improve their consent processes.

It identifies certain practices that the Commissioner considers fundamentally incompatible with children's privacy and best interests. These include deceptive design patterns, sometimes called dark patterns.

For example, an interface might make the option to share information bright, colourful, and easy to select, while burying the privacy-protective option behind several additional screens.

Or a service might pressure a child into disclosing information by suggesting they'll lose access, miss out on rewards, or disappoint their friends.

The Code also addresses engagement mechanisms, including points, streaks, and social pressure, when they're deliberately used to generate additional opportunities to collect personal information.

And it takes aim at emotional profiling. The Commissioner uses the following example: Imagine a platform inferring that a child is feeling lonely, insecure, or anxious and then using that information to persuade them to disclose more personal information.

The Commissioner considers that to be exploitative and unacceptable.

The Facebook consent problem

Now, I want to return to something I mentioned at the beginning.

There's an interesting tension between this Code and the position that the Privacy Commissioner has taken in the Facebook litigation. (Canadian Privacy Law Blog: Appeal court reverses Facebook’s Canadian privacy win)

You probably remember the Cambridge Analytica scandal.

Facebook allowed third-party applications to access personal information through its platform, and information relating to hundreds of thousands of Canadians was potentially disclosed through the application at the centre of that scandal.

The Privacy Commissioner concluded that Facebook had failed to obtain meaningful consent and had failed to provide adequate safeguards.

The case eventually made its way to the Supreme Court of Canada.

One of the central issues is how courts should determine whether meaningful consent has actually been obtained.

Under section 6.1 of PIPEDA, consent is only valid if it is reasonable to expect that the individual would understand the nature, purpose, and consequences of the collection, use, or disclosure.

The court below noted that the Commissioner didn’t lead any evidence on what a Facebook user would have understood at the time. The Commissioner said that wasn’t relevant. It’s an objective standard and doesn't have to do with what an actual Facebook user would have understood. 

I get that you don't want compliance with privacy law to depend entirely on the subjective recollections or knowledge of millions of individual users. But the new Children's Privacy Code says that meaningful consent needs to be calibrated to the age, maturity, and developing capacity of the person providing it.

It expressly recognizes that children are not all capable of understanding the same things.

And it says that a particular child may have sufficient capacity to consent to one data practice, but not necessarily another. So clearly you need to understand the actual characteristics and capacities of the people providing consent..

Now, to be fair, those positions aren't necessarily irreconcilable.

An objective test can be contextual.

We can ask what a reasonable thirteen-year-old would understand, rather than what a reasonable adult would understand.

And we can recognize that certain categories of people have particular characteristics without requiring proof of what every individual actually knew.

I wouldn't go so far as to say the Commissioner has contradicted himself.

And I'll be interested to see how the Supreme Court ultimately addresses meaningful consent.

A better alternative to banning young people from the internet?

There's another reason I find this Code interesting.

At the same time the Privacy Commissioner is emphasizing children's autonomy and their right to participate in digital life, governments have been considering restrictions that would prevent young people below a certain age from accessing social media services. 

I've talked about Canada's proposed Safe Social Media Act, Bill C-34, in previous episodes.

One of my fundamental objections to broad social media bans is that they treat young people as a homogeneous group.

They assume that everyone below a particular age should be excluded, regardless of maturity, circumstances, or the benefits they might obtain from participating.

And those benefits can be substantial.

Young people use online services to learn, communicate, develop friendships, participate in communities, express themselves, and access information.

For some young people, particularly those who are isolated or marginalized, those opportunities can be especially important.

The Privacy Commissioner's Code recognizes that participation in digital life isn't some optional luxury. It's just part of ordinary life.

And the Code's stated objective isn't to prevent children from participating.

It's to make participation more privacy-protective and appropriate to their developing capacities.

I think that's a good starting point.

Instead of asking how we can exclude young people from portions of the internet, we should be asking how we can make online services safer while respecting their rights.

Of course, privacy is only one part of online safety.

This Code doesn't try to solve all the other problems.

And perhaps that should inform the broader debate about online safety legislation.

What happens next?

So where does this leave us? The Children's Privacy Code was released on October 20, 2026.

Although the document has been published as the Code, the Privacy Commissioner's office is still accepting feedback until January 20, 2027.

It may be updated in response to that feedback.

The Commissioner has also indicated that additional, more specific guidance may follow.

For businesses, the practical message is that children's privacy is clearly an enforcement priority for the Commissioner.

Conclusion

Overall, I think the Privacy Commissioner's Children's Privacy Code is a welcome development.

It's not legislation, and much of it goes beyond what’s written in and required by PIPEDA.

But I support its underlying philosophy.

Children have privacy rights.

Those rights don't belong exclusively to their parents.

Young people develop greater capacity and autonomy as they mature.

And protecting their privacy should be about empowering them to participate safely in digital life, rather than excluding them from it.

That's a more thoughtful approach than treating every person under eighteen as incapable of making decisions for themselves.

And perhaps, when we're debating children's online safety more broadly, we could use a little more of that nuance.