Investigation into a swimming pool’s compliance with consent requirements under the Personal Information Protection and Electronic Documents Act

PIPEDA Findings #2025-005

November 25, 2025

---

Takeaways

This investigation will serve as a good reminder that:

• Organizations that deliver services to children have important obligations to ensure that they get parental/guardian consent to collect, use and disclose personal information about them; and
• We found that in this case involving children it was inappropriate for the organization to require consent for the use of photos and videos as a condition of service.

Report of findings

Overview

1. The Office of the Privacy Commissioner of Canada (“OPC”) received a complaint under the Personal Information Protection and Electronic Documents Act (“PIPEDA”), from an individual alleging that a privately owned swimming pool in Canada requires parents/guardians to give consent to allow photographs and/or videos of their children be taken for promotional purposes in order to allow them to participate in swimming lessons.
2. Principle 4.3.3 of Schedule 1 of PIPEDA states that an organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purposes.
3. Principle 4.3.6 of Schedule 1 of PIPEDA states, in part, that the way in which an organization seeks consent may vary, depending on the circumstances and the type of information collected. An organization should generally seek express consent when the information is likely to be considered sensitive.
4. Our investigation found that the requirement that parents accept a waiver allowing the organization to take and post images of their children in swim attire on public platforms as a condition to enroll them in swimming lessons is an inappropriate condition of service. We found that it is not strictly necessary to deliver the service. In the circumstances of this issue, we would expect an organization to seek express consent. As the respondent agreed to implement an opt-in photo policy, we find that the complaint is well-founded and resolved.

Background and complaint

5. The respondent is a privately-run swimming pool located in Canada.
6. The complainant alleges that the swimming pool requires individuals to give consent to allow the facility to take images of their children for promotional purposes to participate in swimming lessons at the facility.
7. More specifically, in the process of registering their daughter for swimming lessons at the facility, it came to the complainant’s attention that they needed to accept a waiver acknowledging that images may be taken of their daughter, a minor, during swim lessons.
8. The Photo Waiver stated:

   we allow photography within the facility for parents and guardians to capture special moments for their own children. However, since photography is permitted, we cannot guarantee that your child will not appear in the background of someone else’s photo or video. We encourage all families to be mindful of others when taking pictures and to respect each other’s privacy especially when posting on social media platforms.
   
   By entering our facility, you acknowledge and accept that photos and videos taken during lessons, events, or activities may be used for promotional purposes, including but not limited to our website, social media channels, or marketing materials.

9. The complainant states that they engaged with facility personnel on several occasions to discuss his concerns about the waiver, and on one occasion shared portions of the OPC’s Guidelines on obtaining meaningful consent with staff. The respondent ultimately explained to the complainant that if the waiver was not accepted, their daughter would not be able to participate in swimming lessons at the facility.
10. Dissatisfied with the respondents’ response and remaining concerned that the facility was requiring them to consent to the policy as a condition of service without an opt-out option, the complainant filed a complaint with the OPC under PIPEDA.

Issue: Does the respondents’ photography policy require individuals to consent to the collection, use, and disclosure of information beyond that required to fulfil legitimate purposes?

11. The OPC’s Guidelines on obtaining meaningful consent states that: (i) organizations must provide a choice to individuals if they want to collect, use or disclose personal information beyond what is necessary to provide the product or service, and (ii) a product or service must be integral to such service in order to make the collection, use or disclosure a valid condition of service.
12. OPC’s Guidance also states: “Organizations must generally obtain express consent when:
    • The information being collected, used or disclosed is sensitive;
    • The collection, use or disclosure is outside of the reasonable expectations of the individual; and/or,
    • The collection, use or disclosure creates a meaningful residual risk of significant harm.”
13. The respondent did not contest that it requires individuals to accept its photo waiver to allow them to proceed in the registration process and participate in activities at the pool.
14. The respondent represented that the photo policy is a reasonable business need because a large number of people go through the facility each week and tracking who gave consent would place a burden on its operations. The respondent added that allowing parents to take pictures of their children is one of the services it offers to its clients.^{Footnote 1}
15. The respondent further represented that the images are a reasonable business need because the photos explain their service, thereby educating their future and current clients by showing them what to expect when they sign up their children for swimming lessons and what to look for when their children are swimming.
16. The respondent further represented that the videos are used for training purposes for its staff.
17. The respondent also represented that when it is having a media day, an email is sent out in advance, a sign is posted on the front door and a photographer is present. While it prefers parents give consent at that time, and they will try not to feature a child whose parents have refused, the child may still be in the background of an image and as they have already provided consent via the waiver, it is not necessary to get consent again.
18. Based on the above, we find that the personal information in question – images of children in swim attire – is sensitive personal information. The subjects are minors who may not be able understand how companies collect, use and disclose their personal information or how it could negatively impact them. We find that the facilities’ requirement that parents accept a waiver allowing the facility to take and post images of children on public platforms in order to enroll them in swimming lessons is beyond that which is required for that purpose. In our view, taking photos/videos for promotional purposes and parent education purposes is not strictly necessary for the service – swimming lessons – to be delivered. Accordingly, requiring all clients to accept a waiver that makes it necessary to accept that images of children can be taken and posted on public platforms for promotional purposes does not meet the requirements of Principle 4.3.3 as it requires consent beyond that required to fulfil the explicitly specified, and legitimate purposes.
19. We find that posting pictures of children in swim attire on a public platform creates a risk of significant harm, as it can result in the distribution of the child’s image to unwanted parties, particularly when the images include images of children in swim attire.^{Footnote 2} The images also indicate the general whereabouts of the child, which can contribute to learning about the child’s habits. These images contribute to the child’s digital footprint/digital identity, which can in turn result in individuals learning more about the child than their parent or guardian may wish others to learn.
20. We also do not accept that it is reasonable for a business to take videos of children’s swimming lessons for staff training purposes without consent. The OPC notes that the waiver is silent on the collection, use or disclosure of personal information for staff training purposes.
21. Further, in our view, in this specific context, it would be inappropriate to require clients to accept the collection, use or disclosure of images of children for staff training purposes as a condition of service. Organizations must provide individuals with a choice whether to consent to the collection, use or disclosure of personal information that is beyond what is necessary to provide the product or service.
22. We find that the respondent did not offer individuals a choice about taking and using images for promotional or staff training purposes, rather it was a condition of service that is beyond that required to fulfil the legitimate purposes for the collection, use or disclosure of personal information. As per Principle 4.3.6, an organization should generally seek express consent when the information is likely to be considered sensitive, as we find it to be in this scenario.
23. We therefore find that the respondent contravened Principles 4.3.3 and 4.3.6 of Schedule 1 of PIPEDA and that the complaint is well-founded.

Corrective Action

24. With a view of bringing the respondent into compliance with PIPEDA, we recommended and it accepted that within 4 months from the issuance of the report it demonstrate to the OPC that it has revised its registration process so that parents can make the choice about whether to provide express opt-in consent to give the respondent permission to take images of their child for promotional or staff training purposes or to be posted to public facing platforms (including its website or social media platforms).

Conclusion

25. Given all of the above, we find the consent matter to be well-founded and resolved.
26. We highlight that organizations that deliver services to children have important obligations under PIPEDA to ensure that they protect children’s privacy by ensuring that they get consent to collect, use and disclose personal information about them.