On October 20, 2026, the Office of the Privacy Commissioner of Canada (OPC) published its Children's Privacy Code (the Code). The Code is OPC guidance on how the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to children's personal information. It is not legally binding, but the OPC is likely to rely on it when assessing compliance, so aligning with it reduces regulatory risk.

The Code takes a risk-based approach: protections scale with the likelihood of child access, expected engagement, data sensitivity and potential harm. Key expectations include express opt-in consent for non-essential uses, privacy-protective default settings and avoiding the profiling of children, particularly for targeted advertising.

Understanding the Code: Nature, purpose and approach

The Code sets out general guidance on how organizations should collect, use and disclose children's personal information in digital environments. It builds on PIPEDA by interpreting how its protections apply to children, whom it treats as holders of rights. The OPC says the intent is not to prevent children from participating in digital life, but to let them explore, learn and express themselves online in ways suited to their age and evolving capacity.

  • Nature: The Code sets out foundational principles and expectations grounded in PIPEDA's requirements and informed by best practices.
  • Enforcement: The Code reflects the OPC's views on organizations' obligations under PIPEDA. It is not legally binding, but the OPC can be expected to refer to it when assessing compliance, as it does with its other guidance.
  • Purpose: The Code aims to ensure that children's personal information is collected, used and disclosed in ways that respect their rights, account for their evolving capacity and serve their best interests. Robust privacy protection should be built into design practices and decision making from the outset.
  • Risk-based approach: Protections should scale with several factors: the nature of the service, the intended audience and likelihood of child access, children's expected engagement, the sensitivity of the information, and the likelihood and severity of harm. A risk-based approach does not reduce obligations. It directs protections to where they are most needed.
  • Alignment: The Code is consistent with children's privacy guidance from regulators in the United Kingdom, Ireland and Australia. It also aligns with the 2023 joint resolution of Canada's federal, provincial and territorial privacy regulators on the best interests of young people.

Scope: Which children and services are covered

The Code applies to any organization subject to PIPEDA that collects, uses or discloses personal information in a commercial activity involving an online service that is directed at children or likely to be accessed by them. Online services include websites, applications, platforms and digital tools. Organizations cannot avoid their obligations simply because a service was not designed for children if children use it in practice.

  • Children: The Code protects all children under 18. Measures should be calibrated to each child's developmental stage.
  • Services: The Code covers online services directed at children or likely to be accessed by them, whether or not children are the intended or primary audience.
  • Indicators of likely access: Relevant factors include research on the organization's user base, child-directed third-party advertising, content or features that appeal to children, and children's use of similar services. No single factor is determinative.
  • Documentation: An organization that concludes a service is not likely to be accessed by children should document that decision and its reasons.

Foundational principles guiding interpretation

The foundational principles set out the values that underpin the Code. They do not prescribe specific actions. Instead, they express the Code's intent and spirit, and organizations should draw on them when interpreting expectations and when the Code gives no specific guidance.

  • Children's right to privacy: Children have their own genuine interest in controlling their personal information. Privacy considerations therefore cannot be reduced to risk management or harm avoidance alone.
  • Best interests of the child: Conflicts with other interests are resolved case by case, with greater weight given to what serves the child best.
  • Child-specific risks: Common risks relate to content, contact, commercial activities and conduct (the "4Cs"). Applying adult-oriented frameworks without adaptation is not adequate risk management.
  • Evolving capacity: The Code provides an age-band guide. Children aged 0 to 12 require parental consent, with a simple written or visual notice to the child at ages 6 to 9 and a written notice at ages 10 to 12. Children aged 13 to 17 give their own consent.
  • Parental support and guided autonomy: Parents should complement design-based protections, not replace them. Children should be told in plain language when a parent monitors their activity or adjusts their settings. Parental involvement should be required for higher-risk activities, such as accounts that allow direct interaction with outside individuals or groups, or sharing sensitive information like health or biometric data.
  • Age assurance: Age assurance is one tool among several. It should be used in a risk-based, proportionate and privacy-preserving way.

Key expectations for organizations

The Code's expectations describe what organizations should and should not do when they collect, use or disclose children's personal information. They are technology neutral: they describe intended outcomes rather than technical solutions. Meeting them requires privacy by design, and compliance is not a one-time exercise.

Expectation

Key requirements

Consent

For children under 13, organizations should obtain parental consent in all but exceptional cases, such as a child's request to delete their information, and notify the child in an age-appropriate way. Non-essential uses, meaning those beyond the core service, should rely on express opt-in consent, with a separate, equally visible choice for each optional feature. Inaction or continued use does not amount to consent. Children and parents should be able to withdraw consent at any time, without penalty.

Privacy impact assessments

Organizations are strongly encouraged to conduct a privacy impact assessment (PIA) before launching or significantly changing a service, and whenever in doubt. Potential triggers include monitoring, profiling or making inferences about children; decisions with significant effects on them; location, activity, relationship or behavioural data; and extensive sharing with third parties.

Default high privacy settings

Settings should default to the most privacy-protective option. Location, public profile visibility, third-party data sharing and profiling should generally be off by default. Location may be enabled only where it is directly necessary and obvious to the user, or where it is needed to protect the child's life, health or security.

Transparency

Privacy information should be concise, written in plain, age-appropriate language and available in both official languages. Layered, visual or video formats may help. Key information should be given at the point of collection or feature use, with reminders when updates affect children's information.

Avoiding profiling

Organizations should not use children's information for targeted or behavioural advertising, infer characteristics for commercial targeting, or share profile data for marketing. Profiling should be used only where it is necessary and demonstrably in the child's best interests, for example for accessibility or age verification. In those cases, children should be informed and given an explanation, and a PIA should be conducted. Using profiling to extend a child's time on an app is not in the child's best interests.

Practices to avoid

The Code identifies certain practices as incompatible with children's privacy and best interests. These practices cannot be justified by a legitimate purpose, mitigated through safeguards or permitted by consent. They build on data practices the OPC has previously identified as inappropriate under subsection 5(3) of PIPEDA.

  • Deceptive design: Organizations should not use manipulative interfaces, such as pre-selected maximum-sharing options or misleading labels. They should not use manipulative consent processes involving artificial urgency, threat of loss or social pressure, and consent obtained this way is not valid. They should also avoid exploitative engagement techniques, such as points, streaks or rewards used to expand data collection.
  • Practices that introduce or amplify harms: Organizations should avoid consent requests that assume more maturity than a child has. They should also avoid inferring undisclosed sensitive characteristics, exploiting a child's developmental stage, and using emotional analytics to obtain more information or consent.

Looking ahead

The OPC describes the Code as a foundation that it will build on over time and invites dialogue with interested parties as part of a collaborative approach.

  • Evolving guidance: The OPC will add more targeted guidance for specific sectors and risk areas and welcomes input on the topics where such guidance would be most valuable.
  • Early engagement: Organizations are encouraged to contact the OPC early when they need further clarification.
  • Legislative interplay: The Code says its intent is not to prevent children's taking part in digital life, which may be viewed as contrasting with the proposal in Bill C-34 (Safe Social Media Act) (see our previous bulletin here) to require designated operators of social media platforms to prevent users under 16 from registering, using effective and proportionate age-verification or age-estimation measures. However, exemptions to this requirement could be granted where adequate safeguards are in place, and the Code's expectations would likely help determine what could count as adequate safeguards.

If you have any questions about the Code, please contact the authors or a member of Gowling WLG’s Data Protection and Cyber Security team.