Canada's First Children's Privacy Code: What the OPC Guidance Says

Canada's First Children's Privacy Code: What the OPC Guidance Says

Privacy Commissioner of Canada Philippe Dufresne launched Canada's first Children's Privacy Code on 20 October 2026. It is regulator guidance interpreting an existing statute, PIPEDA, rather than a new law, and the OPC is taking comments on it until 20 January 2027.

Information last verified on October 23, 2026. This is a developing story; we update it as the record changes.

Status: The Children's Privacy Code was launched on 20 October 2026 as guidance from the Office of the Privacy Commissioner of Canada under existing federal privacy law, principally the Personal Information Protection and Electronic Documents Act (PIPEDA). It is not a statute, it creates no new offence and no new penalty of its own, and it remains open for public comment until 20 January 2027. The OPC says that after that date "the document may be updated."

Jurisdiction scope: This article covers Canadian federal private-sector privacy law, meaning PIPEDA as the OPC interprets it in the Code. Provincial regimes differ. Quebec's private-sector act sets its own rules for minors and carries a monetary penalty regime the OPC does not have, and Alberta and British Columbia each have their own statute. See our overview of Canadian privacy law for how the federal and provincial layers fit together.

What Happened

On 20 October 2026, from Gatineau, Quebec, Privacy Commissioner of Canada Philippe Dufresne launched Canada's first Children's Privacy Code. The OPC describes it as establishing "clear, practical expectations for organizations that handle children's personal information," and says the Code "also helps organizations understand how to protect children under Canadian privacy law."

The document followed an exploratory consultation that concluded in August 2025, and was developed with the OPC Youth Council, a group of seven students aged 14 to 17 from across the country. The Youth Council also helped produce a plain-language version of the Code written for young readers. Quotations from youth roundtable participants appear throughout the main document, including one on location sharing: "these are people who see your location on a regular basis, are you still ok with that".

The Code is not final. The OPC's news release states that it "is accepting comments on the Code until January 20, 2027, after which the document may be updated," with comments sent to a dedicated consultation mailbox. The OPC's consultation page repeats the same date.

What the Law Actually Says

The Code interprets PIPEDA; it does not add to it

PIPEDA is the federal statute governing how private-sector organizations collect, use and disclose personal information in the course of commercial activity. It is built on ten fair information principles set out in Schedule 1: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Our guide to how PIPEDA works walks through those principles in detail.

The Code is explicit about its own legal character. It says it "builds on the Personal Information Protection and Electronic Document (PIPEDA) by interpreting how its protections apply to children," and that it "reflects the OPC's views on organizations' obligations under PIPEDA with respect to children's privacy and provides practical guidance on how organizations can meet those obligations."

That framing matters because PIPEDA itself draws no line based on age. As the Code puts it: "While PIPEDA does not expressly distinguish between the privacy rights of children and adults, the OPC has consistently taken the position that children's personal information warrants heightened protection." PIPEDA sets no age threshold, uses no age of consent, and its private-sector part never uses the word "child". Its only mentions of young people are incidental, inside Schedule 1, which binds organizations through section 5(1): the Note to clause 4.3 observes that seeking consent "may be impossible or inappropriate when the individual is a minor, seriously ill, or mentally incapacitated," and clause 4.3.6 permits consent to be given by "an authorized representative (such as a legal guardian or a person having power of attorney)." Neither draws an age line nor creates a child-specific duty. The age 13 line and the developmental-stage table in the Code are the regulator's interpretation of the existing meaningful-consent standard, not statutory text.

Who and what the Code covers

The Code "provides guidance to protect all children under the age of 18," while telling organizations to calibrate protections to developmental stage, so that younger children get heightened protection and "more mature children greater autonomy."

On the organizational side, it reaches any organization subject to PIPEDA that collects, uses or discloses personal information during a commercial activity "where that activity involves an online service (including websites, applications, platforms and digital tools) that is directed at children or is likely to be accessed by children." It then sets out indicators for each limb. A service is likely directed at children where, for example, its subject matter is primarily of interest to children, it uses child-directed language or characters, or "children constitute a significant portion of the actual user base." A service is "likely to be accessed by children" where factors such as the organization's own user research, child-directed third-party advertising on the site, or appealing design features indicate a reasonable probability of child access.

Critically, the Code says it "applies regardless of whether children are the intended or primary audience of the service," and that an organization "cannot avoid its obligations under privacy law described in the Code solely on the basis that its service was not designated for children, if children are accessing it in practice." If an organization concludes the Code does not apply, the Code says it "should document the decision and the reasons for it."

The Code is also risk-based, calibrated to the nature of the service, the likelihood of child access, expected engagement, the sensitivity of the information and the likelihood and severity of harm. It adds a caution against reading that as a discount: "A risk-based approach does not reduce obligations; it helps to ensure that efforts and protections are directed to where the need is greatest."

The five foundational principles

The Code sets out five: children's right to privacy, best interests of the child, child-specific risks, evolving capacity, and parental support and guided autonomy. It tells readers exactly how much weight to give them: "They do not prescribe specific actions or obligations; rather, they articulate the intent and spirit of the Code and organizations should draw on them when interpreting expectations, exercising judgement and determining how requirements apply in context."

The rights-based grounding is Canadian case law plus the United Nations Convention on the Rights of the Child, which Canada ratified in 1991. The Code reproduces a passage from the Supreme Court of Canada's unanimous 2012 decision in A.B. v. Bragg Communications Inc., 2012 SCC 46, where Justice Abella wrote that "The law attributes heightened vulnerability based on chronology, not temperament," and cites R. v. Jarvis, 2019 SCC 10, for the proposition that Canadian law gives children greater privacy protection than similarly situated adults.

The evolving-capacity principle carries a developmental table. Ages 0 to 5, 6 to 9 and 10 to 12 are mapped to parental consent, with written or visual notice to the child from age 6; ages 13 to 15 and 16 to 17 are mapped to child consent. Where an organization cannot achieve sufficient certainty about a user's age, the Code says "protections should be applied to all users as a default." On age assurance it is cautious rather than enthusiastic, calling it "one of the multiple approaches" and insisting the goal "can and must be advanced without creating an undue impact on privacy rights."

The seven expectations

1. Consent. "Organizations must obtain meaningful consent for the collection, use and disclosure of children's personal information, calibrated to the child's evolving capacity." For children under 13, "in all but exceptional circumstances, organizations must obtain consent from a parent or guardian." For children 13 to 18, organizations should assess whether the child has capacity to understand the specific data practice. Non-essential uses, meaning anything beyond what is necessary for the core product or service, should carry express opt-in consent, and the Code says organizations should not infer consent from inaction or from a child's continued use of a service. Where such uses are made, organizations "must demonstrate that these uses are in the best interests of the child." Organizations should also not make access to a service, or its quality or functionality, conditional on consent to non-essential uses. Withdrawal must be as straightforward as giving consent.
2. Privacy impact assessments. This is the softest expectation in the document, and the Code says so: organizations "are encouraged" and in places "strongly encouraged" to conduct a PIA, particularly for higher-risk products and services, and the Code lists what one should cover.
3. Default high privacy settings. "The OPC's expectation is that, unless there is a compelling reason to do otherwise, settings that affect the collection, use or disclosure of a child's personal information, or that makes their personal information public, should default to the most privacy protective option available." Location collection off by default, with narrow exceptions where it is directly necessary to the core service or necessary to protect the child's life, health or security. Child profiles private by default and not indexed by external search engines by default. Third party sharing off by default, and the Code warns that "blanket consent obtained through terms of service would likely not satisfy this expectation." Profiling off by default.
4. Data minimization. "Organizations must collect only what is demonstrably necessary," assessed feature by feature rather than for the service as a whole, and must not collect information on the basis that it might be useful later. Retention must not exceed the purpose, and the Code asks organizations to build processes for what happens when a child stops using a service or reaches adulthood, including "ensuring that individuals are able to request deletion of personal information collected about them as children once they reach the age of majority."
5. Transparency. The requirement is that organizations "must present privacy information in ways that genuinely support individuals making informed choices and go beyond technical disclosure," and that the information be designed to be understandable to the children who will encounter it. The specifics are framed as expectations: plain language suited to the child's age and reading level, kept concise, provided before or at the point of collection and again at the moment a child is about to engage with the relevant feature, and "available in both official languages."
6. Correction and deletion. Organizations "must provide children with simple and accessible mechanism to request the correction or deletion of personal information," easy to locate, in age-appropriate language, accessible regardless of ability, and fulfilled promptly with the child told the outcome.
7. Avoiding profiling. Organizations should not use children's information to deliver targeted or behavioural advertising, infer characteristics usable to target them commercially, or share children's profile data with third parties for advertising. On artificial intelligence, the Code says AI technologies should not "encourage children to share additional personal information than that which is necessary for the running of their service" or "infer characteristics from children's activities on the system to make age-inappropriate recommendations or biased responses to queries." Where profiling does inform automated decisions about a child, the best interests of the child must be the primary consideration, the child must be told in age-appropriate language, and a PIA should show how risks are mitigated.

The prohibited practices

Two categories sit outside the consent framework entirely. The Code says of them: "These practices cannot be justified by demonstrating a legitimate purpose, mitigated through enhanced safeguards or allowed by obtaining consent." Its statutory hook is PIPEDA subsection 5(3), which reads: "An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances."

The first category is deceptive design: pre-selected options defaulting to maximum data sharing, misleading labels or visual misdirection, consent processes using artificial urgency, threat of loss or social pressure, and engagement techniques such as points and streaks deployed to expand data collection. On manipulated consent the Code is blunt: "Consent obtained through any of these practices will not be considered as valid and cannot be relied upon by an organization to justify the collection, use or disclosure of a child's personal information."

The second category covers data practices that introduce or amplify privacy harms, including generating inferences about undisclosed sensitive characteristics such as health, emotional state, sexual orientation, gender identity or family circumstances, and using indicators of younger age or lower maturity to intensify data collection. Emotional analytics gets its own prohibition: organizations "must not use children's personal information to infer emotional states or vulnerabilities for the purpose of exploiting those vulnerabilities."

What the OPC can actually do about it

This is where a reader arriving from coverage of European fines is most likely to go wrong. The OPC has no power to fine an organization under PIPEDA.

Under section 11, an individual may file a written complaint, or the Commissioner may initiate one. Under section 13(1), the Commissioner "shall, within one year after the day on which a complaint is filed or is initiated by the Commissioner, prepare a report that contains" the Commissioner's findings and recommendations, any settlement reached, where appropriate a request for notice of action taken, and "the recourse, if any, that is available under section 14."

Court involvement comes next, and it belongs in the first instance to the complainant. Section 14(1) provides that "a complainant may, after receiving the Commissioner's report," apply to the Court, defined in section 2(1) as the Federal Court, for a hearing on the matters listed there. Section 15 then allows the Commissioner, in respect of a complaint the Commissioner did not initiate, to "apply to the Court, within the time limited by section 14, for a hearing in respect of any matter described in that section, if the Commissioner has the consent of the complainant," to appear on behalf of a complainant who has applied, or with leave to appear as a party.

Remedies are the Court's, not the Commissioner's. Section 16 provides that the Court may "order an organization to correct its practices in order to comply with Divisions 1 and 1.1," order it to publish a notice of corrective action, and "award damages to the complainant, including damages for any humiliation that the complainant has suffered." Section 17(1) directs that such applications be heard "without delay and in a summary way" unless inappropriate. Separately, section 17.1 lets the Commissioner enter a compliance agreement with an organization.

PIPEDA does contain offences, at section 28, but they are narrow and unrelated to the substance of the Code: knowingly contravening the access-request retention duty in subsection 8(8), the breach-reporting and breach-record provisions, or the whistleblower-reprisal provision, or obstructing the Commissioner, carries a fine of up to $10,000 on summary conviction or $100,000 on indictment. Nothing in the Code adds to that list.

Quebec is a different regime

Quebec's Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, as amended by Law 25, sets its own rules, and the Code's own footnotes point to them. Section 4.1 provides that personal information concerning "a minor under 14 years of age may not be collected from him without the consent of the person having parental authority or of the tutor, unless collecting the information is clearly for the minor's benefit." Section 14 says consent for a minor under 14 is given by the person having parental authority or by the tutor, and that the consent of a minor 14 or over is given "by the minor, by the person having parental authority or by the tutor," so parental authority runs in parallel rather than dropping out at 14. Section 9.1 requires that a technological product or service offered to the public with privacy settings "must ensure that those settings provide the highest level of confidentiality by default," excluding browser cookies.

So Quebec's statutory line is 14, not 13, and privacy by default is a legislated requirement there rather than a regulator's expectation. The interaction between the federal act and the provincial ones is set out in our guide to Canada's data privacy framework. Quebec also has the enforcement tool the OPC lacks, administered by the Commission d'accès à l'information: under section 90.12, the maximum monetary administrative penalty is $50,000 for a natural person and, for anyone else, $10,000,000 or 2% of worldwide turnover, whichever is greater, with separate penal provisions in section 91 and minimum punitive damages of $1,000 under section 93.1 where the infringement is intentional or results from a gross fault. Our page on Quebec's Law 25 regime covers those obligations, and Alberta and British Columbia PIPA covers the other two provincial private-sector acts.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The most useful way to read this Code is as a statement of how the OPC will apply a 2000-era statute to a 2026 problem, published in advance rather than discovered through an investigation. PIPEDA is a principles-based act with no age provisions, and for a quarter of a century organizations have had to guess how the meaningful-consent standard and subsection 5(3) apply to a 10-year-old. The Code removes much of that guesswork. That is real value even with no new legal power behind it, because the OPC's stated interpretation is what an organization will be measured against if a complaint lands, and because the OPC publishes findings summaries where it considers publication to be in the public interest under section 20(2), the section 13 report itself going only to the complainant and the organization under section 13(3).

The drafting is also unusually candid about its own gradations, and that is worth noticing rather than flattening. "Must" language clusters around consent, data minimization, correction and deletion mechanisms and the prohibited practices. "Should" language carries the default-settings expectations. The PIA expectation is explicitly only encouragement. The foundational principles are described in the document itself as not prescribing obligations. A compliance exercise that treats all of this as one undifferentiated rulebook will misallocate effort, and one that treats the whole document as optional will miss that several expectations are framed as restatements of existing statutory duties.

The structural shift most likely to catch organizations is scope. The Code applies to services "likely to be accessed by children" regardless of intended audience, and asks an organization that concludes otherwise to document why. That is a documentation burden placed on general-audience services that have never thought of themselves as child-facing, and the OPC has borrowed the framing from the UK Information Commissioner's Office age-appropriate design code, Ireland's Data Protection Commission fundamentals and the Australian Information Commissioner's exposure draft. The Code names that convergence as deliberate.

The gap between expectation and enforcement is genuine and should not be papered over. The OPC cannot fine. A Code expectation becomes consequential through a complaint, a section 13 finding, reputational exposure, a compliance agreement, or a complainant's own trip to the Federal Court. Quebec, by contrast, already legislates a 14-year threshold and privacy by default and can impose administrative penalties in the millions. For a national service, the binding constraint on children's data handling may well be provincial rather than federal, which is the opposite of what a reader would assume from a federal launch announcement.

Finally, the document is open for comment. Comments run for three months, and the OPC says the text may change. Treating the current wording as settled is premature, and the sections most likely to attract industry comment are the ones with the sharpest operational cost: the breadth of "likely to be accessed by children", the prohibition on conditioning service quality on non-essential consent, and the default-off treatment of profiling and third party sharing.

What Happens Next

The OPC is accepting comments on the Children's Privacy Code until 20 January 2027, by email to the consultation mailbox named in its news release and on its consultation page. The release states that after that date "the document may be updated." Neither the release nor the Code commits to a date for a final version, and neither says what form any revision will take.

The Code also signals further work beyond the consultation itself. It states that the OPC "will complement the Code over time with more targeted guidance for specific sector or risk areas and welcomes input from interested parties on topics for which specific guidance would be most valuable." Where guidance is absent, organizations are told to fall back on the foundational principles.

We will re-check the consultation and the Code page after 20 January 2027 and update this article when the OPC publishes a revised document or says the current text stands. Until then, the version launched on 20 October 2026 is the current text, and the OPC says it may be updated after the comment period closes.

How This Affects You

If you are a parent or a young person in Canada. The Code does not give you a new right you can enforce in court. What it does is describe, in public, what the federal privacy regulator expects an online service to do with a young person's information, and the OPC also published a plain-language version aimed at young readers. The underlying complaint route is the existing one: a written complaint to the OPC under PIPEDA section 11, a Commissioner's report under section 13, and a possible Federal Court application under section 14. If the service is governed by a provincial private-sector act instead, the provincial regulator is the right door.

If you run a service children use. The practical first step is the scope question, because the Code puts the burden on you either way: either your service is directed at children or likely to be accessed by them, in which case the expectations apply, or you conclude it is not and the Code says you should document that conclusion and your reasons. From there, the defaults are the fastest-moving items, since location, public profile visibility, third party sharing and profiling are all expected to be off at first use, and the consent architecture is the slowest, since separating core from optional collection and offering genuine opt-in for non-essential uses is a product change rather than a policy change. If you operate in Quebec, check section 9.1 and sections 4.1 and 14 of the provincial act directly, because those are statutory duties with penalties attached rather than expectations. And if the consultation matters to your business, the comment window closes on 20 January 2027.

This is general legal information, not legal advice. This article describes guidance published by the Office of the Privacy Commissioner of Canada and the federal and Quebec statutes it interacts with, in Canada, verified as of 23 October 2026. The Children's Privacy Code is open for public comment and its text may change. Nothing here addresses any individual's or organization's circumstances, and nothing here creates a solicitor and client relationship. For advice on your own situation, consult a lawyer or notary qualified in the relevant Canadian jurisdiction.

Related articles

• Canadian privacy law overview
• PIPEDA explained
• Quebec Law 25 explained
• Alberta and BC PIPA
• Canada's data privacy framework

Last updated: 2026-10-23. This is a developing story; details verified as of 2026-10-23.

Frequently Asked Questions

Did Canada pass a new children's privacy law in October 2026?

No. The Children's Privacy Code launched on 20 October 2026 is guidance from the Office of the Privacy Commissioner of Canada, not legislation. It interprets how the existing Personal Information Protection and Electronic Documents Act (PIPEDA) applies to children's personal information, and it creates no new offence and no new penalty of its own. It is also open for public comment: the OPC is taking comments until 20 January 2027 and says the document may be updated afterward.

Is the Code legally binding on organizations?

The Code itself is not a statute and does not bind organizations the way legislation does. What binds them is PIPEDA, and the Code sets out how the regulator reads PIPEDA's requirements in the context of children's data. The Code's own language is graded: some expectations are written as "must", several as "should", the privacy impact assessment expectation only as encouragement, and the foundational principles are described in the document as not prescribing specific actions or obligations.

Does PIPEDA require parental consent for children under 13?

Not in its text. PIPEDA does not expressly distinguish between the privacy rights of children and adults: it sets no age threshold and uses no age of consent, and its private-sector part never uses the word “child”. Its only mentions of young people are incidental, inside Schedule 1, which binds organizations through section 5(1): the Note to clause 4.3 says seeking consent may be “impossible or inappropriate when the individual is a minor”, and clause 4.3.6 permits consent by an authorized representative “such as a legal guardian”. Neither draws an age line. The under-13 parental consent expectation comes from the Code, where the OPC states that in all but exceptional circumstances organizations must obtain consent from a parent or guardian for a child under 13. It is the regulator's application of PIPEDA's meaningful-consent standard, not a statutory line.

Can the Privacy Commissioner fine a company for breaching the Code?

No. The OPC is not a fining authority under PIPEDA. It investigates complaints and, under section 13, prepares a report containing findings and recommendations. Under section 14 a complainant may apply to the Federal Court for a hearing, and under section 15 the Commissioner may apply with the complainant's consent, appear on a complainant's behalf, or with leave appear as a party. Section 16 gives the Court the remedies: orders to correct practices, orders to publish notice of corrective action, and damages including for humiliation. PIPEDA's own offence provision, section 28, is narrow and covers matters such as breach-reporting failures and obstructing the Commissioner, with fines up to $10,000 on summary conviction or $100,000 on indictment.

Which organizations does the Code apply to?

Any organization subject to PIPEDA that collects, uses or discloses personal information during a commercial activity, where that activity involves an online service directed at children or likely to be accessed by children. The Code applies regardless of whether children are the intended audience, and it says an organization cannot avoid the obligations it describes solely on the basis that its service was not designed for children if children are in fact accessing it. An organization that concludes the Code does not apply is told to document that decision and its reasons.

What age does the Code cover?

It provides guidance to protect all children under 18, with protections calibrated to developmental stage. The Code includes a table mapping age ranges to the nature of consent: parental consent for ages 0 to 5, 6 to 9 and 10 to 12, with age-appropriate notice to the child from age 6, and child consent for ages 13 to 15 and 16 to 17. Where an organization cannot be sufficiently certain of a user's age, the Code says protections should be applied to all users by default.

What settings does the Code expect to be off by default?

Location data collection, public profile visibility, third party data sharing and profiling. The Code's general expectation is that, unless there is a compelling reason otherwise, any setting affecting the collection, use or disclosure of a child's personal information, or making it public, should default to the most privacy protective option available. It also says children's profiles should not be indexed by external search engines by default, and that blanket consent obtained through terms of service would likely not satisfy the third party sharing expectation.

What does the Code say about profiling and artificial intelligence?

Profiling should be off by default, and organizations should not use children's information for targeted or behavioural advertising, infer characteristics usable to target them commercially, or share children's profile data with third parties for advertising. On AI, the Code says such technologies should not encourage children to share more personal information than is necessary to run the service, and should not infer characteristics from children's activity to make age-inappropriate recommendations or biased responses. Where profiling informs automated decisions about a child, the best interests of the child should be the primary consideration, the child should be told in age-appropriate language, and a privacy impact assessment should show how risks are mitigated.

How is Quebec different?

Quebec has a separate regime under the Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, as amended by Law 25, overseen by the Commission d'accès à l'information. Section 4.1 and section 14 set the consent threshold for minors at 14 rather than 13, section 9.1 legislates highest-confidentiality privacy settings by default for technological products and services offered to the public, and the Commission can impose monetary administrative penalties up to $50,000 for a natural person or, for others, $10,000,000 or 2% of worldwide turnover under section 90.12. Those are statutory duties with penalties attached, unlike the federal Code's expectations.

Can I still comment on the Code?

Yes, as of 23 October 2026. The OPC is accepting comments until 20 January 2027 by email to the consultation address given in its news release and on its consultation page, and says the document may be updated after that date. Neither document sets a date for a final version.