Canada’s New Children’s Privacy Code

On October 20, 2026, the Privacy Commissioner of Canada (the Commissioner) launched Canada’s first Children’s Privacy Code (the Code), with the goal of creating a safer and more transparent online environment for children under 18. The Code provides organizations that handle children’s personal information with guidance on how to protect children’s privacy under Canadian privacy law.

The Code applies to organizations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) that collect, use or disclose personal information through online services that are directed at children or likely to be accessed by them.

The Code sets out seven expectations for organizations, each of which is discussed in detail in the Code, and briefly summarized below:

1. Consent: Organizations must obtain meaningful, age-appropriate consent that reflects the child’s evolving capacity. Non-essential data uses require express opt-in consent, with separate choices for optional features. Children and their parents or guardians should be able to withdraw their consent at any time.
2. Privacy Impact Assessments: Organizations are encouraged to conduct a privacy impact assessment, especially when offering higher-risk products or services.
3. Default High Privacy Settings: Services should use the highest available privacy settings by default, with location tracking and public profile visibility disabled.
4. Data Minimization: Organizations should collect only information necessary to provide their services and retain it only as long as necessary for the purposes for which it was collected.  
5. Transparency: Privacy information should be clear, accessible, and age-appropriate.
6. Correction and Deletion: Children should have practical ways to correct inaccurate or incomplete personal information and to request that their personal information be deleted.
7. Avoiding Profiling: Organizations should avoid profiling children for marketing purposes, including targeted or behavioural advertising, or for the purposes of AI-driven decision-making.

The Code also prohibits practices that undermine children’s privacy and best interests, including deceptive design practices that manipulate or coerce children into providing more personal information, among other things.

The Commissioner will be accepting comments on the Code until January 20, 2027, after which the Code may be updated.

For more information, see the full Code available here.

Summary By: Victoria Di Felice