Canada's privacy watchdog sets out its first Children's Privacy Code

Canada's privacy watchdog sets out its first Children's Privacy Code

20 October 2026: The Privacy Commissioner of Canada, Philippe Dufresne, has launched the country's first Children's Privacy Code, setting out what his office expects of organisations that handle children's personal information and how Canadian privacy law applies to them. The office is taking comments until 20 January 2027, after which the code may be updated.

Not yet independently verified. The code is the regulator's statement of how it reads existing privacy law and may change after the consultation; the release does not say how it will be enforced. We will update this when it can be confirmed, and remove this note.

What organisations are expected to do

According to the commissioner's release, organisations are expected to:

• obtain meaningful consent for collecting, using and disclosing children's personal information, including parental consent for children under 13 and opt-in consent for non-essential uses;
• explain privacy information in clear, accessible, age-appropriate language;
• give children a practical way to correct inaccurate or incomplete information and the option to delete their personal information entirely, "particularly as they and their views grow and evolve";
• avoid profiling children for marketing, including targeted or behavioural advertising, or for AI-driven decision-making;
• protect privacy by default, with location tracking, profile visibility and third-party data sharing switched off automatically.

Practices the code rules out

The code also names data practices the office regards as fundamentally incompatible with children's best interests. Websites and mobile apps cannot use deceptive design to influence, manipulate or coerce children into giving more personal information than needed, or use children's information to exploit their vulnerabilities. The office links the code to the Global Privacy Enforcement Network's 2024 sweep on deceptive design.

"The launch of the Children's Privacy Code is an important milestone towards advancing youth privacy in a digital world," Dufresne said, adding that young Canadians' main concerns are "the lack of control, lack of choice, and lack of age-appropriate information."

How it was built and who should respond

The release says the code is similar to those in some European countries and US states. It was developed with input from an exploratory consultation and with the office's Youth Council of seven students aged 14 to 17, who also helped write a simplified version for younger readers. Comments go by email to cpvp-opcconsultation1@priv.gc.ca.

For product teams, the demanding items are the ones that change defaults and data flows: switching off location and third-party sharing by default for young users, offering deletion rather than only correction, and stopping profiling of children for ads or automated decisions. Games, education technology, social and messaging apps, and ad-tech vendors serving Canadian users have three months to say where the expectations are unclear or unworkable.

Related on TrustList:

• Poland makes Apple drop "tracking" from its app consent prompts

Sources

• Office of the Privacy Commissioner of Canada: Privacy Commissioner launches Children's Privacy Code, 20 October 2026