Children’s Privacy Code: what the OPC’s new guidance means for businesses

Last week, the Office of the Privacy Commissioner of Canada (OPC) released its Children’s Privacy Code (the Code), providing non-binding guidance that organizations should consider when collecting, using, and disclosing children’s personal information. The Code remains open for public comment until January 20, 2027. The Code has significant implications for social media and other platforms, and for the retail (including financial services and loyalty), videogame, and edtech industries.

What you need to know

Businesses should consider whether they are captured by the Code, and if so, review their practices, considering the following from the Code:

• Broad scope. The Code applies to online services “directed at” or “likely to be accessed by” children—regardless of whether children are the service’s primary target.
• Risk-based approach. Privacy protections scale with risks. Organizations should assess the risks of their services to determine how to comply with the Code. High-risk services like social media sites attract heightened attention under the Code.
• Clear consent age bands, with room for context. Organizations should obtain appropriate parental and/or child consents, depending on the child’s evolving capacity. Generally, parental consent is expected for children under the age of 13, while for children 13 and older, the child’s own consent may be appropriate.
• High-privacy defaults and no profiling by default. Privacy-protective settings (e.g., for location data, public profiles, and third-party sharing) should be on by default, and organizations should not profile children unless doing so is in the child’s best interests.
• No deceptive design. Organizations should not employ deceptive design techniques when engaging with children.

The Code

The Children’s Privacy Code was developed following public consultation and engagement with young Canadians, including the OPC’s Youth Council. It sets out a series of “expectations” that organizations should consider when handling children’s personal information.

The OPC states that the Code builds on the Personal Information Protection and Electronic Documents Act (PIPEDA) by interpreting how its protections apply to children. While non-binding, organizations can expect the Code to inform OPC expectations in its enforcement activity.

Scope

The Code applies to organizations with online services “directed at children” or “likely to be accessed by children”. Services may be “directed at children” when the subject matter is of interest to or designed for children, the service is marketed to children or their parents, and/or where children make up a significant portion of an organization’s user base.

Services “likely to be accessed by children” are those with a reasonable probability of child access, even if children are not the primary target. Relevant factors include whether (i) research indicates that children are in the user base; (ii) third-party advertisers target children on the service; (iii) the service’s content, design, and activities appeal to children; and (iv) children are known to access similar services. Organizations that conclude a service is out of scope should document that decision and its rationale.

Risk-based approach

Obligations under the Code depend on an organization’s assessment of the risk that its services pose to children’s privacy, considering (i) the nature of the service; (ii) its intended audience; (iii) children’s expected engagement; (iv) the types and sensitivity of personal information collected; and (v) the likelihood and severity of harm if information is mishandled.

For example, the Code treats social media services with direct messaging and location sharing as “high risk” and browsing a retail website as “low risk”.

Evolving capacity and ability to consent

The Code defines children as anyone under the age of 18; however, it expressly recognizes their evolving capacity and notes that practices should be calibrated to reflect children’s developmental stages.

The Code also recognizes children’s autonomy over their privacy. For children 13 and older, the child’s own consent may be required where they can understand what they are consenting to, although parental awareness may be required, depending on the service’s risk. Blanket parental consent for lower-risk services for children 13 and older may therefore no longer be sufficient. For children under the age of 13, the OPC expects parental consent to be obtained in all but exceptional cases, with written or visual notices provided directly to children, where appropriate.

Assessing risk is important for organizations in determining how to comply with the Code. The Code says that higher-risk services require greater certainty about a child’s age, so that privacy protections are proportionate to the child’s evolving capacity. Consent notices, default settings, data collection, and content personalization should be designed with this in mind. The OPC continues to identify age assurance technologies as one of several approaches for assessing capacity, provided they are privacy-preserving and they collect no more information than necessary—but cautions that age assurance is not a silver bullet for safety and privacy risks.

Expectations and prohibited practices

Expectations

The Code sets out the following expectations for organizations in designing and operating online services:

• Consent. Organizations must obtain meaningful consent, calibrated to children’s evolving capacity. Non-essential data uses should require express, opt-in consent, with separate choices offered for each optional feature or enhancement. Withdrawing consent should be as straightforward as giving it.
• Privacy Impact Assessments (PIAs). Organizations are strongly encouraged to conduct PIAs before launching services or making changes to products or services that fall under the scope of the Code. Risks explicitly warranting a PIA might include using children’s information for monitoring, profiling, inferences, or decision-making; collecting sensitive information such as location or behavioural data; or sharing information extensively with third parties.
• Privacy by default. Services falling under the scope of the Code should employ privacy-protective measures by default, unless there is a compelling reason not to. Examples of features that should be turned off by default are location data, public profiles and visibility, third-party data sharing, and profiling.
• Data minimization. Organizations must limit collection to what is necessary, set clear retention periods, and delete or anonymize information when no longer needed. They should also address what happens to data when children reach the age of majority, including offering deletion of data collected during childhood.
• Transparency. Consent notices should be age-appropriate, in plain language, and in a format that suits the nature of the service and the way children interact with it.
• Correction and deletion. Children must be provided with a practical means of requesting to correct or delete personal information, in a manner that supports the transparency principle.
• Avoiding profiling. Organizations should not profile children by default, unless profiling is in the child’s best interests and is not driven by commercial or other inappropriate purposes. For example, children should not be profiled for marketing, as they cannot understand the associated risks. Where profiling occurs, organizations should (i) inform children; (ii) explain how the profile was assembled; and (iii) conduct a PIA. AI systems that handle children’s personal information must also account for children’s vulnerabilities.

Prohibited practices

The Code explicitly classifies certain practices as prohibited. These include using deceptive design (e.g., manipulative interfaces, pressure tactics in consent flows, and exploitative engagement features such as points, streaks, and rewards to maximize data collection) and data practices that introduce or amplify harms to children (e.g., inferring sensitive characteristics about children or using a child’s emotional state to prompt further disclosure).

Alignment with Bill C-36

The federal government recently introduced Bill C-36, which, if passed, would overhaul PIPEDA and establish a new federal privacy regime (the Protecting Privacy and Consumer Data Act (PPACDA))¹. PPACDA treats children’s personal information as “sensitive”, thereby attracting heightened privacy requirements and potential administrative monetary penalties or fines for certain violations. Similarly grounded in the “best interests of the child” in its approach to children’s privacy, the Code appears to complement PPACDA’s proposed treatment of children’s privacy, and would operate alongside it, if passed.

How the Code compares

More stringent than the United States

Compliance with the US Children’s Online Privacy Protection Act Rule (COPPA) alone will often not satisfy the Code. While the Code’s under-13 parental consent threshold mirrors COPPA’s consent requirement, the Code goes beyond COPPA in several respects. In terms of scope alone, the Code applies to anyone under 18, whereas COPPA protects only children under 13. In addition, while COPPA applies to general-audience services only where they have actual knowledge that they collect personal information from children under 13, the Code applies to services that are “likely to be accessed” by children.

Parallels with the United Kingdom and European Union

The Code appears to most closely align with the UK’s Age Appropriate Design Code, which sets 15 standards for services likely to be accessed by under-18s, including best interests, risk-based age assurance, high-privacy defaults, and no profiling by default.

Parallels also exist with EU requirements. Both the Code and the EU’s requirements (whether under the GDPR or the Digital Services Act) include high-privacy defaults, prohibitions on manipulative design, data minimization, and child-appropriate transparency.

Slightly out of step with Québec

Québec’s Act respecting the protection of personal information in the private sector deems the age of minor consent to be 14. Businesses operating both in Québec and in other provinces should be aware of this misalignment.

Next steps

Organizations should take the following steps to consider whether their online services are aligned with the Code:

• Evaluate the online services they provide and consider whether their services may be subject to the Code (and, if not, document that determination).
• Assess the risk their services may pose to children’s privacy.
• Review data flows involving children’s data, including ad tech, analytics, software development kits, and third-party sharing.
• Rather than starting from scratch, leverage existing UK, EU and US compliance work to identify gaps.
• Implement the Code’s expectations accordingly, including reviewing consent flows and privacy defaults, and conducting PIAs.

As parental consent may no longer be enough, organizations should consider whether it is appropriate to continue relying on blanket parental consent—or, given the evolving capacity of children aged 13 and older, establish child-friendly mechanisms to obtain children’s consent.

Organizations with “high risk” services should be particularly aware of the heightened obligations that the Code may impose. This may include services that permit engagement between users, profile or target users, or target users for marketing purposes.

Sector-specific considerations

While the OPC intends to supplement the Code with sector- or risk-specific guidance, the Code already has implications for businesses providing in-scope services:

• Technology platforms with teen accounts may face particular scrutiny.
• Financial institutions offering teen products (e.g., supplemental payment cards) should consider whether their activities are captured, and if so, whether to introduce teen-appropriate notices and separate opt-ins, and review household-level data used for marketing.
• General-audience and e-commerce services may be able to rely on “not for minors” terms for lower-risk offerings if supported by a documented determination that services do not fall under the Code’s scope.
• Loyalty programs open to minors should review their practices and consider impacts on marketing and personalization activities.
• Videogame publishers and platforms should limit sign-up data, keep profiles private by default, and scrutinize engagement and rewards mechanics.
• Edtech providers should limit data collection and use, and document necessary steps and PIAs for any profiling being conducted.