Canada launches Children’s Privacy Code for stronger protections

Canada’s first Children’s Privacy Code covers every child under 18, reaching any online service with “a reasonable probability of child access,” including services built for adults. 

Anyone running a consumer app, website, or platform now has guidance for deciding whether the code applies to their service, and the commissioner expects them to document that decision.

What happened

Privacy Commissioner of Canada Philippe Dufresne launched the code on Oct. 20. 

According to the announcement, it “establishes clear, practical expectations for organizations that handle children’s personal information,” including parental consent for children under 13, opt-in consent for non-essential uses, and default settings with location tracking, profile visibility, and third-party data sharing switched off.

Organizations are also expected to avoid profiling children for marketing, including targeted or behavioural advertising, or for AI-driven decision-making, and they can’t use deceptive design to influence, manipulate, or coerce children.

“The launch of the Children’s Privacy Code is an important milestone towards advancing youth privacy in a digital world,” says Philippe Dufresne, privacy commissioner of Canada.

“Young Canadians tell us that their primary concerns when engaging with online platforms are the lack of control, lack of choice, and lack of age-appropriate information. The Children’s Privacy Code seeks to address these concerns and help create a digital world where the best interests of children are paramount.”

The context

The full text of the code is presented as practical guidance on meeting obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal law that governs how businesses handle personal information in commercial activity. 

The Office of the Privacy Commissioner of Canada is taking comments until Jan. 20, 2027, after which the document may be updated. They have also published a simplified version of the code for kids and teens, an important move that emphasizes privacy as a fundamental right to all. 

Some lines are firm, emphasizing that consent gathered through tactics such as artificial urgency or threat of loss “will not be considered as valid,” and an organization that decides its service isn’t likely to be used by children should “document the decision and the reasons for it.” 

The commissioner strongly encourages a privacy impact assessment before launching or significantly changing a product children are likely to use.

Why this matters now

With this code, children’s privacy integrates product management, data, and marketing, in addition to compliance.

It reaches decisions about default settings, behavioural advertising, profiling, AI-driven decision-making, and how much control younger users have over their information. 

Privacy choices can shape how a service works, what data it collects, and what it can do with that data.

Ale Brown, founder and CEO of Kirke Consulting, told Digital Journal in July that privacy is a business issue and that business opportunities are what keep leaders up at night.

This code is a good example of why. Any company can, and should, comply. They also need to make sure that product, marketing, and data practices are aligned with stronger protections for children from the start.