The Privacy Commissioner of Canada, Philippe Dufresne, has launched Canada’s first Children’s Privacy Code, setting out how organisations subject to the federal private sector privacy law (PIPEDA) are expected to protect the personal information of children and teenagers online. The code follows a consultation that began in May 2025 and is itself open for comment.
Key points
- Covers everyone under 18, with parental consent expected for children under 13 and opt-in consent for non-essential uses of data.
- Organisations should avoid profiling children for marketing or for AI-driven decisions about them.
- No deceptive design to push children into sharing more data.
- Privacy-protective defaults, with location tracking, profile visibility, and third-party sharing switched off unless chosen.
- Expectations on privacy impact assessments and data minimisation; comments are due by 20 January 2027.
The code is relevant to any organisation offering apps, games, education technology, or online services in Canada that children are likely to use, including UK and European providers. It closely follows the direction of the UK Age Appropriate Design Code, so organisations that already meet that code are well placed, but should check the Canadian consent and profiling expectations and consider responding to the consultation.
Source: Office of the Privacy Commissioner of Canada
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
