Key takeaways
- On October 20, 2026, the Office of the Privacy Commissioner of Canada launched Canada’s first Children’s Privacy Code, setting practical expectations for how organizations handle children’s personal information online. The OPC is accepting comments until January 20, 2027.
- The Code expects meaningful consent (including parental consent for under-13s and opt-in consent for non-essential uses), age-appropriate communication, correction and full deletion of children’s data on request, no profiling of children for marketing or AI-driven decision-making, and privacy-by-default settings for location, profile visibility, and third-party sharing.
- It also bans deceptive design practices aimed at children and the use of children’s information to exploit their vulnerabilities. The Code is guidance, not a binding rule, but the OPC builds its investigations around exactly this kind of guidance.
What landed yesterday
On October 20, 2026, in Gatineau, Commissioner Philippe Dufresne launched Canada’s first Children’s Privacy Code. The news release calls it a safer, more transparent online environment for children and teens. The practical reading is narrower and more useful: this is the first Canadian document that tells a product team what “protect children under Canadian privacy law” means in practice.
The OPC ran an exploratory consultation from May to August 2025 (37 responses) and worked with its Youth Council, seven students aged 14 to 17 who also helped write a simplified youth-friendly version. The release quotes Dufresne: young Canadians’ primary concerns are lack of control, lack of choice, and lack of age-appropriate information.
The five rules, translated into product checks
The Code speaks in expectations, not orders. Each one maps to a concrete check in your product:
| The Code expects | Check your product for |
|---|---|
| Meaningful consent, including parental consent for under-13s and opt-in consent for non-essential uses | Every under-13 flow, and every non-essential data use that defaults to on |
| Privacy information communicated in a clear, accessible, age-appropriate manner | Any privacy notice a child is likely to see, not just the legal page |
| A practical means of correcting inaccurate or incomplete information, plus the option to delete personal information entirely | Whether a teenager can actually wipe their account history, including inferred data |
| No profiling of children for marketing (including targeted or behavioural advertising) or for AI-driven decision-making | Recommender systems, ad targeting, and automated scoring that touch child users |
| Privacy by default: location tracking, profile visibility, and third-party sharing automatically off | Default settings on signup, not the settings page |
Two details deserve a closer look. First, the deletion right goes beyond access and correction: children get the option to delete their personal information entirely, “particularly as they and their views grow and evolve.” That is a right-to-be-forgotten designed for people whose opinions change with age. Second, the profiling ban names AI-driven decision-making explicitly, not just advertising. Recommender systems are the first thing I would audit.
The ban with actual teeth: deceptive design
The strongest language in the release targets dark patterns. The Code states that websites and apps cannot use deceptive design practices to influence, manipulate, or coerce children into providing more personal information than they need, or use children’s information to exploit their vulnerabilities.
The OPC’s 2024 international sweep found 97% of reviewed websites and apps used at least one deceptive design pattern, and the release notes that child-targeted sites leaned hardest on emotive language and nagging. Its recent TikTok investigation ended with commitments to better measures for keeping children off the platform and to stop using granular interest data to target ads at users under 18. The Code now turns that enforcement energy into a written standard.
Guidance, not law, and why it still matters
Read the release carefully: organizations are “expected to.” The Code is OPC guidance, not a binding rule. Dufresne cannot write law, and nothing in this document changes that.
But the OPC’s private-sector toolkit under PIPEDA is investigations and published findings, and those findings measure organizations against his guidance. The third-party service provider guidance from October 6 did exactly this for vendor files; the Children’s Privacy Code is the same move for youth-facing products. The enforcement threat is not a fine tomorrow; it is a published finding measuring you against a standard handed out today.
The age-gate paradox nobody has solved yet
Here is the tension the Code leaves open. Parental consent for under-13s means knowing which users are under 13. That means age assurance, which means collecting more data, possibly sensitive identity data, about exactly the population the Code wants you to minimize data on. The OPC published age-assurance guidance earlier this month, and the Code points at the same problem from the other side. Nobody has published a clean answer yet: how do you verify age without feeding the minimization problem the Code is trying to solve. It is the design question worth watching through the January 20 comment window.
Actionable takeaway: Pull the signup and settings flows of any product children can use. Score them against the table above before the January 20, 2027 comment deadline, and send the OPC your comments on what is unworkable at cpvp-opcconsultation1@priv.gc.ca. Guidance has a way of becoming the yardstick, and this one just shipped with a feedback form attached.