Canada’s New Children’s Privacy Code Signals Regulatory Expectations of Online Services

On October 20, 2026, the Office of the Privacy Commissioner of Canada (the “OPC”) released the Children’s Privacy Code. The Code provides dedicated guidance for private-sector organizations that handle children’s personal information and involve an online service (including websites, applications, platforms and digital tools); interprets how the protections outlined in the Personal Information Protection and Electronic Documents Act (PIPEDA) apply to children; and sets limits on data practices that are “fundamentally incompatible with children’s best interests”. The OPC is accepting feedback on the Code until January 20, 2027, giving interested organizations an opportunity to help shape future revisions to the guidance.

Background to the Code

The Code forms part of a broader Canadian effort to strengthen online protections and transparency for children. In recent years, several legislative proposals have sought to establish statutory and regulatory frameworks that more effectively govern the collection, use and disclosure of children’s personal information as well as children’s engagement with online platforms. Most recently, the federal government introduced Bill C-34, the Safe Social Media Act, which proposes to regulate harmful content on social media platforms and chatbot services, as well as any category of online services that may be determined to “pose a significant risk of harm to children in Canada” and meet a prescribed user threshold.¹

The OPC launched its exploratory consultation on a potential children’s privacy code in 2025, drawing on international precedents such as the United Kingdom’s Children’s Code, as well as the OPC’s own Resolution on putting best interests of young people at the forefront of privacy and access to personal information. Stakeholder input from that consultation – including from children themselves – informed the development of the Code, and the OPC promises to engage with organizations requiring further clarification “as part of a collaborative approach to protecting children’s privacy”.

Key Aspects of the Code: What Organizations Need to Know

The Code is grounded in several foundational principles, including children’s right to privacy, guided autonomy to engage online, and the recognition of their evolving capacities. The Code also reflects a risk-based approach wherein organizations are expected to evaluate the risks posed by their services and implement mitigating measures proportionate to those risks.

The Code applies to a wide range of online service organizations: Consistent with its foundational principles, the Code sets out expectations for organizations that collect, use or disclose the personal information of all children under the age of 18. It applies to any online service that is subject to existing privacy legislation and is either “directed at children” or “likely to be accessed” by them:

• A service is likely “directed at children” if its subject-matter, content or theme is primarily of interest to children; it uses child-directed language, imagery, animation or characters; it is marketed through channels targeting children or their parents; it is designed or structured to be suitable for children; or children constitute a significant portion of its actual user base.
  
• A service is “likely to be accessed” by children where relevant factors indicate a “reasonable probability of child access”, such as: any available research the organization has conducted about its user base or user behaviours that indicates the presence of children; third-party advertisers place ads directed at children on the service; the presence of content, design features or activities that  appeal to children; and whether children are known to access similar services.
  
  If an organization decides that a service is not likely to be accessed by children and therefore that it need not consider the Code’s guidance, then the organization should document the decision and its reasons for it.

The 4Cs of privacy risks for children – content, contact, commercial and conduct: The Code notes that common privacy risks for children relate to:

• content (harms associated with the type of materials a child engages with, either by choice or by exposure due to algorithms and advertising);
• contact (harms associated with interactions, for example, with someone they do not know who shares inappropriate content with them, or with people they know who share information and media about them without their consent);
• commercial activities (harms associated with exploiting children’s personal information for commercial purposes, sometimes by using deceptive design patterns); and
• conduct (where children act as perpetrators of online harms such as cyberbullying or data theft).

The Code calls for an evolving concept of meaningful consent and age-appropriate transparency: The Code states that an organization’s approach to consent should reflect children’s evolving capacity and be calibrated to the age and developmental stage of the children who access its service.  It sets out an expectation of parental/guardian consent for children under the age of 13 in all but exceptional circumstances (with simple written or visual notice to children ages 6-9 and written notice to children ages 10-12). From age 13 onwards, the child’s own consent is required,² if the organization has assessed that the child has sufficient capacity to understand what they are consenting to in the context of the specific data practice, particularly for sensitive personal information.

Consent for all non-essential uses (being those uses that go beyond what is necessary to provide the core product or service) should be on an opt-in basis and must be in the best interests of the child. The Code provides, as an example, the distinction between email and age as essential information for a social media app, while biometric data and demographic information would be non-essential information.

Information about privacy and consent must be designed to be understandable to the children who will encounter it, considering their age, developmental capacity and the nature of the product or service they are using. Organizations should also allow children and their parents or guardians to withdraw consent at any time, which may require the deletion of previously collected information (for instance, with a social media account deletion).

The Code “strongly encourages” organizations to conduct a privacy impact assessment (PIA) before launching or making significant changes to any product or service directed at children or likely to be accessed by children. Privacy risks warranting a PIA may arise, for example, where a product or service involves: (a) monitoring, profiling or making inferences about children; (b) the use of children’s personal information to make or inform decisions that could have significant effects on a child; (c) the collection or use of information about a child’s location, activities, relationships or behaviour; or (d) extensive or repeated sharing of children’s personal information with third parties, particularly where the organization cannot exercise meaningful control over how the information will subsequently be used.  The Code provides guidance on what such PIAs should include and explains that organizations should use the PIA to demonstrate how each of PIPEDA’s principles is met in practice over the full lifecycle of children’s personal information.

The Code expects certain presumptive protective practices (i.e., most privacy protective by default): The Code expects high-privacy default settings, data minimization, and that organizations will avoid profiling unless they “can clearly demonstrate that any use of automated decision-making is consistent with children’s best interests and is not driven by commercial or other inappropriate purposes”.

Certain practices are prohibited altogether: Organizations must not use deceptive design patterns to prompt children into disclosing more personal information than they would otherwise choose to share, such as pre-selecting options that default to broader consent than the service requires or structuring consent in ways that create artificial urgency or social pressure. Such practices cannot be justified by any purpose or mitigation efforts.

Implications for Online Service Organizations

The Code serves as interpretive guidance to promote compliance with privacy obligations under PIPEDA and does not, on its own, introduce new legislation or confer independent enforcement powers. However, the OPC describes it as “reflect[ing] the OPC’s views on organizations’ obligations under PIPEDA with respect to children’s privacy and provid[ing] practical guidance on how organizations can meet those obligations and better protect children’s personal information.” Organizations should thus expect the Code’s guidance to inform the OPC’s enforcement posture and its practical implications to extend across the online privacy ecosystem.

Release of the Code also continues the OPC’s heightened regulatory focus – and more broadly, the Canadian government’s legislative interest – in children’s privacy and protection against online harms. While not directly applicable in provinces with their own private-sector privacy statutes (Alberta, B.C. and Quebec), organizations should still expect local privacy regulators to have regard to the Code’s guidance.

Comments on the Code may be submitted by email to cpvp-opcconsultation1@priv.gc.ca. The OPC also indicates it will complement the Code over time with more targeted guidance for specific sectors or risk areas and welcomes input from interested parties on topics for which specific guidance would be most valuable.

²Notably, this is at odds with Quebec’s Act respecting the protection of personal information in the private sector, which requires consent by the person having parental authority or the tutor (legal guardian) for the collection of personal information of a minor under 14 years of age (unless the collection is clearly for the minor’s benefit).