Canada’s first Children’s Privacy Code: what it asks of apps, and what parents can use

On October 20, 2026, Privacy Commissioner of Canada Philippe Dufresne launched Canada’s first Children’s Privacy Code. It sets out what his office expects from organizations that handle children’s personal information online, whether that’s a game, a social app or a learning platform.

If you have kids, or work with them, here’s what it says and how you can use it.

What the code is

The code isn’t a new law. According to the code itself, it builds on PIPEDA, Canada’s federal private-sector privacy law, by explaining how its protections apply to children. It covers everyone under 18, and expects organizations to scale their measures to a child’s age and development.

The commissioner’s office says the code is similar to ones in some European countries and U.S. states. It was developed with an exploratory consultation and with the office’s Youth Council, seven students aged 14 to 17, who also helped write a simplified version for younger readers.

What it expects of organizations

Among other things, the announcement says organizations are expected to:

• get meaningful consent, including a parent’s consent for children under 13, and opt-in consent for non-essential uses of data
• explain privacy in clear, age-appropriate language
• give children a practical way to correct their information, or delete it entirely, as they grow up and change their minds
• avoid profiling children for marketing, including targeted or behavioural advertising, and for AI-driven decisions
• make privacy the default, with settings like location tracking, profile visibility and third-party sharing off from the start

It also names practices it considers incompatible with a child’s best interests. Apps and websites can’t use deceptive design to push children into giving up more information than needed, or use their information to exploit their vulnerabilities.

Why it matters

Kids don’t read privacy policies, and most parents don’t have time to. Defaults decide most of what happens. A code that says location should be off, profiles private and ads untargeted unless someone deliberately changes them puts the work where it belongs: on the company, not the child.

It’s guidance, so how much it changes in practice will depend on how companies respond and how the commissioner uses it in investigations. Canada’s proposed federal privacy law is a separate track; our Bill C-36 explainer covers that.

What you can do

1. Check the defaults on your kids’ apps. Look for location sharing, public profiles, contact syncing and ad personalization. The code’s expectation is that these start off. If they don’t, turn them off.
2. Ask for deletion when it’s time. The code expects companies to offer a practical way for children to delete their information. If your child leaves an app or a game, ask the company to delete the account and its data, not just deactivate it.
3. Read the youth version together. The simplified code was co-written with teenagers and is a good starting point for a conversation about what apps collect.
4. Raise concerns. Start with the company. If you’re not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.
5. Have your say. The office is taking comments on the code until January 20, 2027, by email at cpvp-opcconsultation1@priv.gc.ca.

Sources

• Office of the Privacy Commissioner of Canada, Privacy Commissioner of Canada launches Children’s Privacy Code to support strong online protections for youth, October 20, 2026
• Office of the Privacy Commissioner of Canada, Children’s privacy code, October 2026
• Office of the Privacy Commissioner of Canada, Children’s Privacy Code – What you need to know about your privacy, October 2026