The Office of the Privacy Commissioner of Canada (OPC) has developed a Children's Privacy Code and is accepting feedback on it until January 20, 2027, by email at [email protected]. The OPC describes the code as guidance for how organizations should collect, use, and disclose children's personal information in digital environments. It is not a new statute, and the OPC's consultation page calls it a code it has developed, not a law that has passed.
That distinction matters for a small site owner. The code's own text says it reflects Canadian privacy law as it applies to organizations subject to PIPEDA, so the expectations in it show how the regulator reads rules that already apply to you today.
Source: Office of the Privacy Commissioner of Canada, consultation page, captured October 31, 2026.
How the code got here
The Commissioner announced his intention to develop the code in May 2025. An exploratory consultation ran from May to August 2025, with four roundtable discussions, one of them with youth from across Canada. The OPC's consultation page says it then prepared the code building on that feedback, and the page was last modified on October 20, 2026.
Figure 1: Consultation milestones as stated on the OPC consultation page.
Figure 2: The OPC's "What we heard" summary reports 37 responses, including one joint response representing more than 40 individuals and organizations.
Respondents generally said they would welcome a code that clarifies what organizations owe when they handle children's data, according to the OPC.
Does it apply to a site that is not built for kids?
Yes, in the OPC's reading. The code covers organizations subject to PIPEDA that collect, use or disclose personal information in a commercial activity through an online service "directed at children or is likely to be accessed by children." It applies whether or not children are the intended audience, and the text says an organization cannot avoid its obligations solely because its service was not designated for children if children are using it in practice.
A recipe blog with a comments section, a homework tool, or a hobby game with a leaderboard can all fit that description. If you already read our look at children's online privacy data or the UK Children's Code coverage, the shape will feel familiar, and the OPC itself points to the United Kingdom, California and Ireland as places that have benefited from similar guidance or legislation.
What the code expects, in plain terms
The foundational principles start with the best interests of the child: children's well-being and rights should be primary considerations, and where interests conflict, greater weight goes to what serves the child best. The detailed expectations then get specific.
On defaults, the code calls for high privacy settings. Its example of good practice has profile visibility off by default with several levels offered, and location sharing off. It says profiling of children should be off by default unless the child has explicitly opted in and it is in their best interest.
On tracking, the code says organizations should avoid profiling children for marketing. It lists three things they should not do: use children's personal information for targeted or behavioral advertising, infer characteristics from children's activity that can be used to target them commercially, or share children's profile data with third parties for advertising or marketing.
On language, privacy information should be written in plain language suited to the age and reading level of the children who will see it, with short sentences, little legal jargon, and availability in both official languages.
On consent, the OPC says adult-style consent flows will generally not meet PIPEDA's meaningful consent standard when applied to children. Its age guide suggests parental consent for ages 0 to 5, and parental consent plus a simple written or visual notice for ages 6 to 9, with the table continuing through older ranges. Withdrawing consent should be as straightforward as giving it.
On age assurance, the code asks for a risk-based, proportionate approach. Where risk is higher, organizations are expected to have greater certainty about age, and where sufficient certainty cannot be reached, protections should be applied to all users by default. Any method should avoid collecting more personal information than necessary.
On retention, children's data must not be kept longer than necessary, and people should be able to request deletion of information collected about them as children once they reach the age of majority. The code also stresses privacy impact assessments before a product launches or changes significantly.
One more point is easy to miss: the OPC says parents should not be the primary safeguard. Protections belong in how the product is built, not in a settings page a parent has to find.
What to check in your privacy policy now
Start with whether children can realistically reach your service, then compare your policy to the expectations above. A short checklist, each item grounded in the code text:
- Does the policy say whether you collect age or date of birth, and what you do when a user may be a child?
- Does it state that you do not use children's data for targeted advertising, and do your analytics and ad tags actually match that statement?
- Are retention periods stated per category of data, with a way to request deletion?
- Is there a short, plain-language section a young reader could follow?
- Does it explain how a parent or child withdraws consent?
If any answer is no, fix the product or fix the policy so the two agree. For existing Canadian background, our PIPEDA breach data shows how the same law is already being used. You can draft the updated language with the Privacy Policy Generator and then review it against the OPC's text, which remains open for comment until January 20, 2027.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
