Canada’s First Children’s Privacy Code: What Does it Say?

On October 20, 2026, the Office of the Privacy Commissioner of Canada (the “OPC”) launched Canada’s first Children’s Privacy Code (the “Code”), which guides how organizations should collect, use and disclose children’s personal information online. The Code interprets how the Personal Information Protection and Electronic Documents Act (“PIPEDA”) applies to children, whom the OPC recognizes as privacy rights-holders deserving of enhanced protection. Critically, it applies to any organization subject to PIPEDA whose online services are directed at children or are likely to be accessed by children. If your organization operates a website, app, platform or digital tool that children use, or may use, read ahead.

What does the Code say?

The OPC’s stated intent is not to keep children out of digital life, but to let them explore, learn and express themselves online in ways appropriate to their age and evolving capacity. Although PIPEDA does not distinguish between children’s and adults’ privacy rights, the OPC considers that children’s personal information warrants heightened protection, and the Code reflects how existing PIPEDA obligations should be applied accordingly. The Code is grounded in Canadian case law, including the Supreme Court of Canada’s decisions in AB v. Bragg Communications Inc. and R. v. Jarvis, and in Canada’s obligations under the United Nations Convention on the Rights of the Child.

Who and what is covered?

The Code protects all children under 18 and expects organizations to calibrate their measures to the age and maturity of children who access, or are likely to access, their services. A service is likely “directed at children” where, for example, its content is primarily of interest to children, it uses child-directed language, imagery or characters, it is marketed through channels targeting children or their parents, or children make up a significant portion of its users.

A service is “likely to be accessed by children” where relevant factors indicate a reasonable probability of child access, such as the organization’s own user research, third-party child-directed ads on the site, child-appealing content or features, and whether children access similar services. No single factor is determinative. A service not designed for children is still covered if children use it in practice, and organizations concluding otherwise should document that decision and their reasons.

A risk-based approach

The Code is designed to be flexible and proportionate. Organizations are expected to actively consider the risks their services pose to children, having regard for the nature of the service, its intended audience and likelihood of child access, children’s expected level of engagement, the type and sensitivity of the personal information involved, and the likelihood and severity of potential harm. As the OPC notes, a risk-based approach does not reduce obligations; it directs protections to where the need is greatest.

Foundational principles

Organizations should draw on the Code’s foundational principles when interpreting it and wherever it lacks specific guidance: children’s right to privacy; the best interests of the child (which should be given greater weight where it conflicts with other interests); child-specific risks (including the “4Cs” of content, contact, commercial and conduct risks); children’s evolving capacity; and parental support and guided autonomy.

Because children of different ages and capacities demand different levels of care, the Code expects parental consent for children under 13 (with a simple written or visual notice for ages 6 to 9 and a written notice for ages 10 to 12), while children aged 13 to 17 may generally consent for themselves. Age assurance and other methods of identifying children should be proportionate to the risk; where age cannot be determined with sufficient certainty, protections should apply to all users by default. Parents and guardians play a supportive role, but privacy protections must be built into products and services rather than delegated to parental oversight.

The Code sets out seven core expectations for organizations:

1. Consent. Organizations must obtain meaningful consent calibrated to the child’s evolving capacity. For children under 13, consent must almost always come from a parent or guardian; for those aged 13 to 18, organizations should assess whether the child can understand the specific data practice, particularly where sensitive information is involved. Non-essential uses require express, opt-in consent and must be shown to be in the child’s best interests. Consent should not be inferred from inaction or continued use, and access to or quality of the core service should not depend on consent to non-essential uses. Withdrawing consent should be as easy as giving it, should stop the relevant practice and, in some cases, should trigger deletion (e.g., deleting a social media account should delete all associated personal information).
   
2. Privacy impact assessments. Organizations are strongly encouraged to conduct a privacy impact assessment (“PIA”) before launching or significantly changing any product or service directed at or likely to be accessed by children. PIAs are not one-time exercises and should map the full lifecycle of children’s personal information, identifying risks to children and corresponding mitigation measures.
   
3. Default high privacy settings. Settings affecting a child’s personal information should default to the most privacy-protective option unless there is a compelling, documented reason otherwise. Location data collection should be off by default, enabled only where directly necessary for the core service or to protect the child’s life, health or security, and no more precise than necessary. By default, children’s profiles should be private and not indexed by external search engines, and third-party data sharing and profiling should be off.
   
4. Data minimization. Organizations must collect only the personal information necessary for the specific function the child is using, assessed feature by feature, and not because it “may” be useful later. Anonymized, aggregated or de-identified information should be preferred where it achieves the purpose. Organizations should set clear retention periods by category of information, delete or anonymize data once no longer needed, and allow individuals reaching the age of majority to request deletion of information collected about them as children.
   
5. Transparency. Privacy practices should be clear, concise and age appropriate, using plain language best suited to the reading level of their audience. Where a service spans a wide age range, essential information should be accessible to the youngest likely users.
   
6. Correction and deletion. Because information shared in childhood can follow children into adulthood, organizations must provide easy-to-locate, plain-language mechanisms, generally accessible to all children to correct inaccurate or incomplete information and delete personal information.
   
7. Avoiding profiling. Organizations should not use children’s personal information to build profiles or for purposes that could harm them, including targeted or behavioural advertising, inferring characteristics from children’s digital activities for commercial targeting, or sharing children’s profile data with third parties for advertising or marketing. AI chatbots and agents should not encourage children to overshare or infer characteristics to make age-inappropriate recommendations or biased responses. Where profiling informs automated decisions about children, the child’s best interests should be the primary consideration.

Prohibited practices

Finally, the Code identifies practices the OPC considers incompatible with children’s best interests and inappropriate under subsection 5(3) of PIPEDA, which cannot be justified by a legitimate purpose, mitigated through safeguards, or permitted by consent. They include:

• Deceptive design (for example, interfaces with options that default to maximum data sharing)
• Consent processes that rely on artificial urgency
• Threat of loss or social pressure
• Engagement mechanisms such as points, streaks or rewards used to expand data collection

The Code also cautions against inferring undisclosed sensitive characteristics (such as health, sexual orientation, gender identity or family circumstances), exploiting a child’s developmental stage, and using emotional analytics to manipulate children into sharing more information. The OPC’s pointed example: an app that detects signs of loneliness and prompts a child to share their location “so friends nearby can find you” is strictly forbidden.

Why is this important?

The Code is the clearest statement to date of how the OPC expects PIPEDA to apply to children’s personal information and signals the standard against which it will likely assess organizations’ practices. Its scope extends well beyond children’s apps and games: general-audience platforms, retailers, streaming services and other online businesses should take note if children are likely to access their services. Silence is likely insufficient, as the Code expects organizations to document their reasoning if they determine their services are not likely to be accessed by children.

Compliance is also not a one-time exercise. Organizations should embed privacy by design from the earliest stages of development and revisit their approach as services and user bases evolve, which for many will mean reviewing default settings, consent flows, retention schedules, advertising technology and AI-driven personalization. The Code aligns Canada with growing international consensus on children’s online privacy, including guidance from the United Kingdom’s Information Commissioner’s Office, Ireland’s Data Protection Commission and the Office of the Australian Information Commissioner. The OPC is accepting comments until January 20, 2027, after which the Code may be revised, and intends to supplement it with targeted sector- and risk-specific guidance; it encourages early engagement where clarification is needed.

The takeaway is clear: organizations whose services are likely to be accessed by children should act now. Well-prepared organizations anticipate regulatory change rather than react to it, and those that wait for the Code to be finalized, enforced or reflected in new legislation risk scrambling to retrofit products, consent flows and data practices under pressure. Assessing current practices and internal readiness against the Code today is the hallmark of strong governance and compliance preparedness, and the surest way to manage the significant compliance and reputational risk that comes with failing to protect children’s personal information.

Torkin Manes can assist with assessing whether your organization’s services are directed at or likely to be accessed by children, conducting privacy impact assessments, and aligning your privacy practices with the Code. For more information about children’s privacy compliance under Canada’s privacy laws, please contact Roland Hung or Laura Crimi of Torkin Manes’ Privacy, Data & Cybersecurity, AI & Innovation, and Technology Groups.

 The authors would like to acknowledge Torkin Manes’ Articling Student Raza Akbari for his invaluable contribution in drafting this bulletin.