Understanding Young Canadians’ Online Experiences in Relation to Data Privacy
Prepared by the Policy and Research Group of the Office of the Privacy Commissioner of Canada
May 2026
Overview
This report presents the findings from focus groups that the Office of the Privacy Commissioner of Canada (OPC) conducted in February 2025 to better understand the views of youth regarding their online privacy.
Key findings included:
- Participants shared positive, neutral and negative feelings about their experiences online, and identified benefits (e.g. connecting with friends, consuming interesting content) as well as risks (e.g. other people posting negative things about them).
- Participants shared concerns about engaging online, particularly regarding their reputation. They were primarily concerned about the actions of other users (either individuals they know or strangers).
- Participants did not have strong knowledge of what businesses collect about them and that their likes, views, and other online activity may be stored by businesses and potentially shared.
- Participants confirmed that they have low knowledge of what companies collect and retain about them, and about their privacy rights and how to exercise them. Many said they did not know where to seek out information about their privacy.
- Control was important to participants. They spoke about taking steps to control their information online, including by limiting what they post, using private accounts, and blocking people to control who can access their content.
- Most participants rely on and trust their parents to provide them with information on privacy, indicating that parents are an important stakeholder. Most said that youth should have more responsibility to make privacy decisions as they grow older.
- Some participants had negative experiences with their parents posting about them online. Some expressed that they wished that their parents would ask for their permission before posting about them.
- Finally, when asked about what they wished would be done to help them to protect their privacy online and what parents, teachers or decision-makers could do, participants said that they wished that companies took more action to protect them, and requested more privacy education for themselves, their parents and their teachers.
Other findings of interest:
Median age participant started going on websites or apps: 10
Websites and apps most used: Snapchat, TikTok, YouTube, Instagram
Reasons for going online: Communicating with friends and family, consuming content
Who participants trust when faced with privacy issues: Parents are the most trusted. Friends, teachers, schools, companies and police were also mentioned.
Introduction
Obtaining the perspectives of children and youthFootnote 1 is important. It is often adults who advocate and give voice to children and youth. The OPC has heard from youth that they are rarely asked directly about their online experiences and what it is that they want or do not want when it comes to their privacy rights.
With this in mind, the purpose of the focus groups was to better understand the online experiences of Canadian youth related to data privacy. Our focus groups allowed participants to express their perceptions and experiences related to protecting their personal information and their knowledge of their privacy rights and how to exercise them, among other issues. The focus groups were planned to help the OPC address key initiatives from our Strategic Plan 2024-2027, namely ensuring that children’s privacy is protected and that youth are able to exercise their rights. The focus groups were specifically intended to:
- fill knowledge gaps by conducting comprehensive research;
- engage with and hear from a diverse range of children and youth directly; and
- help to deepen our understanding and appreciation of youth-related audiences, privacy risks, and issues.
Hearing the perspectives of Canadian youth on protecting their privacy and exercising their rights helps to better inform the OPC’s work. For example, it can support the development of guidance and advice to organizations on their practices for data privacy on websites and apps. Findings from this research may also benefit the OPC’s public outreach for Canadian youth and their families, as well as other key stakeholders in children’s privacy, such as civil society organizations, educators, and businesses.
Results
Youth see benefits and risks to engaging online
Overall, participants shared positive, neutral and negative feelings about their experiences and perceptions online and identified both benefits and risks to using online services. Participants were mainly concerned about the activities of other users online instead of organizations, although they did note that they wished that companies did more to protect them, particularly when it came to removing content that they did not want others to see.
Benefits include communicating with friends and family
Participants noted a variety of benefits arising from the use of websites and apps. Communication with friends and family was the most frequently cited benefit, with some youth mentioning that it was an easy way to communicate and interact with friends outside of school. Some mentioned that they enjoy sharing videos and photos with friends, and one participant noted that they like seeing what friends are doing or if there is something they “need to watch”. One participant shared that they get inspiration and ideas for crafts on social media.
Participants in the French-language focus group noted more frequently benefits related to consuming content rather than communicating. For example, they enjoyed watching short videos on Instagram and TikTok and liked that content (music, videos, content from artists) was shown to them according to their interests.
Risks include threats from other individuals online
Responses varied when asked about overall concerns about privacy related to the websites and apps being used. Some participants felt that their privacy was protected for the most part, noting that it was “pretty safe” or did not express concerns when asked about their privacy when using websites and apps. Others said that they were somewhat protected because of the knowledge they have about protecting themselves online and that they did not post anything “that would be bad”.
For others, reputational damage was a key concern. One participant said that what people post can affect their reputation, and that sometimes people can post things about someone that can have consequences and make them feel shame.
Concerns were primarily focused on the actions of other people on websites and apps, including that on Instagram, users’ stories can sometimes be shared with other people if your account is not private. A few participants said that others reposting things that they did not like, such as an unflattering photo, was a worry. Many of the participants (in all focus groups) were concerned about others screenshottingFootnote 2 content and then sharing it without them knowing.
One participant said that they did not like that on some websites and apps strangers could see their profile photo or name, “I wish only your friends could see that and that they needed a code to add you, something like that.”
Some noted that being stalked or catfishedFootnote 3 is a concern, as “it’s easy to post photos of someone else and create a whole new online person and be someone you’re not.” Others repurposing information they had posted, or reusing information in another context was also seen as problematic.
One participant noted that while websites and apps are “mostly secure,” there are always data leaks and breaches, and they felt that they could not control that. Another raised that if someone obtained their address or password and engaged in cyberbullying, that could lead to serious harm.
Youth have mixed experiences and views regarding online privacy
A portion of the focus groups involved OPC research staff providing examples of harmful privacy experiences raised by teens in other countries that had been identified through earlier research. Participants were asked whether they had encountered these scenarios and, if so, what their experiences had been. For those who had not encountered the outlined scenarios, they were asked to imagine how it might make them feel if they experienced it. A few of the examples can be found below with a summary of the answers.Footnote 4
Example: Your activities online are tracked and used for advertising. You start receiving ads about things you think could be harmful, such as vaping or alcohol consumption.
Most participants said that they had not personally experienced seeing ads of this nature. Most said that they would either ignore such an ad or block the ad or company if they were confronted with inappropriate content. Many could recognize the harms that would result from receiving such ads. A few participants said that they would feel “weirded out” by such content but suggested that they would not be influenced by it.
One participant said that friends of theirs had received such content and it had a negative impact on them.
Example: Your social media algorithm starts to show you reels from influencers promoting extreme diets or extreme workout regimens.
Focus group participants were more likely to have received this type of content on their social media feeds, and only two said that they had not received such reels. Opinions were mixed on the potential harm, with some noting that it can impact their view of their bodies and others noting that this kind of content can give false hope:
“On my apps in my feed, I try to get influencers who have body positivity because I’m into sports. I have seen things like that [i.e. extreme diets/workouts]. It makes me feel uncomfortable, it would not make me feel very good – like I’m not enough.” (youth participant)
A few participants said that they felt positively about influencers showing extreme workouts. They felt that seeing the workouts could empower youth to learn about physical activity and to try to achieve what they perceived to be a better body.
“It didn’t really make me feel uncomfortable. When you see products that might help you with things you want to achieve, like goals, that’s good.” (youth participant)
Example: You download a new app on your phone and are asked to create an account. It is unclear what information you can choose to share or what information the app is collecting and saving about you.
Many participants said that they did not think that this situation has happened to them and did not know what they would do. A few suggested that it would depend on what information the app was asking for, and whether the service had terms and conditions. Participants that did answer said that they would be uncomfortable sharing their phone numbers, email addresses, and real birth dates. A number of participants said that if they were asked for such information, they would likely input a false birth date or avoid the app and not download it.
When asked if there were other situations that have impacted their privacy online, a couple of participants said that being fed misinformation and political news can be harmful, as they do not always know the facts. One noted “I have had [misinformation] come up way too much” and that they try to ignore or block accounts feeding this type of information.
Specific knowledge of privacy rights is low, but some take privacy-protective actions
Participants shared that they have low knowledge of what companies collect and retain about them and about their privacy rights more generally. Many also expressed that they did not know where to seek out information about their privacy. That said, participants were aware of general privacy issues online and provided many examples of how they are taking steps to protect their personal information from others. This included by limiting what they post, setting their accounts to private mode, and blocking unwanted people and content.
Knowledge of companies’ practices
When asked what they know about the information that websites and apps may collect and retain about them, most participants could not name anything or said they did not know. One noted that “I don’t really know much about that. I am interested in what they do with it.” Another noted that they thought that such information could be found in terms and conditions, but “when you make an account you agree to terms and conditions, and not everyone reads it. Once you’ve done it [signed up for the service] you stop thinking about it later on.”
Participants in the French-language session noted a few types of information that companies collect, including names, phone numbers, and email addresses.
Knowledge of privacy rights
None of the participants said they had specific knowledge about their privacy rights. Many said that they do not know anything about their privacy rights or how to exercise them.
A few participants said they think they do have rights, but they were not sure about them. A couple of participants said that privacy settings would help protect them, or that the existence of privacy policies help set out expectations and some sort of violation would occur if they were not followed.
A few participants called for more control over their online privacy, and that they would like to be properly informed about what happens to their information online. One noted that sometimes companies send personal information to other companies without them knowing and they did not like that.
Seeking information about privacy rights
When asked where they would go to find information about their privacy rights, answers varied. While many participants said that they did not know, the most common answer was that they would seek out information on the websites and applications themselves to learn about their rights. Several said that they would seek out information in privacy settings or in profile settings. Others suggested doing an online search or consulting a service such as TikTok or YouTube to learn about privacy by seeing what other users have to say on the topic. Other answers included asking parents, friends, or seeing if schools might have information on it.
Actions taken to protect privacy
When asked about steps they can take to protect their privacy online and whether they have used privacy settings, participant answers focused on three main themes that were common across all focus groups. Notably, all three themes focused on protecting the user from other users online. The themes, in order of prevalence, are discussed below.
Limiting personal information posted
Teens from all three focus groups spoke about the importance of being careful about what and where they post information. Comments included, “Don’t post things that are too personal,” and “You can post but just don’t post things that could later be embarrassing.”
Many spoke about limiting comments and activity to give themselves more privacy. A few noted that they do not post their real name, birthday, or photos of their face online. Other comments focused on frequency of posting, and that you can protect your privacy by “not posting things about yourself and what you do on a daily basis. That’s how most people get stalked or harassed.” Another participant noted a loss of control once information is out there, “You can’t control what other people do with your information – once it’s out there it’s very hard to delete. It’s out there forever.”
Some participants said that they may post misleading information, such as incorrect year of birth or location in an effort to protect their privacy.
Private accounts
The second most common theme among all focus groups was related to changing privacy settings so that profiles or story settings were set to private. Many noted that all their social media accounts were set to private, and many noted that they also block their location on apps such as Snapchat.
One participant mentioned that private profiles lead to a sense of greater control for the user, “Private your account. If you private it, you can control who can see everything.”
Several benefits to using private accounts were raised, including greater control over who can message you, look at your profile, interact with content and see your location.
One participant said that their accounts used to be public, as they did not realize that they could be changed to private, but following a discussion with their friends, they changed their accounts to private immediately.
Blocking
Participants in each focus group mentioned that they have blocked people – either explicitly by blocking their accounts or by blocking locations or other information from certain users. Participants in the French focus group said they had blocked other users more frequently than those in the English language groups.
Other comments regarding steps taken to protect their privacy included having separate accounts for engaging with certain audiences (such as an account for friends and a different one for family, or having an email address for “important things” and another for signing up for accounts). One participant noted that they always make sure they are visiting a real website before signing up or putting personal information into a site in case it is not real.
Parents are trusted to help exercise rights, but some youth are concerned about sharenting
During the focus groups, three key themes emerged regarding the involvement of parents when it comes to navigating the online world:
- parental involvement in decision-making;
- parents as a trusted source;
- parents posting about participants online, or “sharenting”.
Parental involvement in decision-making: it depends on age and capacity
When asked whether they should get to make decisions about privacy on their own, most participants said that it depends on age. Some said that setting your own settings is a responsibility, and as you age, youth should get more responsibility to manage their own settings. Some noted that parents should ultimately have the control over the use of websites and apps, even if it is just to check to ensure that they are adjusting settings responsibly. One noted, “We should have some say, but adults should have [the final say] because they know more and have more experience.”
One participant noted that it is a case of capacity, “When you’re younger, you’re new to the online world so parents should have control over if you get an app or a private or public account. When you get older, you have more knowledge, so it’s for your own safety and you should be able to protect yourself.” Another supported this, saying: “when you get older you gain more independence, and that independence – you get wiser and you know what not to post.” A few participants thought that from ages 13 or 14 and younger, youth should not have a choice about what to post separate from their parents because they can sometimes make decisions that are “not the best.” An example provided was posting publicly about their private life when they should not be.
Others noted that their parents told them about the risks of engaging online when they were younger and limited their time online back then. One individual said that when they were younger and signed up for their first Roblox account, their parents monitored their activity, disabled the chat function and would not allow them to add people they did not know.
Some participants noted that they have parents who still actively review their accounts to ensure that they are protecting their privacy. Again, their focus was on protecting themselves from other users online, and not on how companies collect, use or disclose personal information. One youth noted that their mother will look through their apps and ask who certain contacts are on their list to ensure that they are people they know in real life. A few participants noted that their parents adjust their privacy settings for them or with them. One had a parent change their settings because people tried to talk to them who were not their friends in real life (i.e. offline).
Parents are seen as a trusted resource
When asked what they would do if they found out that their personal information was used inappropriately, participants of all focus groups overwhelmingly named parents as the most trusted resource. Almost all participants said they would go to their parents if they had an issue online. Reasons provided were that they trust their parents, because parents have more experience online, because parents have their best interests in mind, and because of the closeness they feel with their parents.
Older participants said that they would try to resolve the issue with the individual first, and then they would ask their parents to step in if they were unable to resolve the issue.
Other trusted individuals named included friends, teachers, school principals and councils, people in the technology field, the applications or company that hosted the problematic material, and depending on the severity, the police.
Negative experiences with “sharenting”
When asked about parents posting content about them, participant answers varied on whether that was seen as a problem.
The majority of participants did not like that their parents post about them online, and said it was a negative experience for them. Some expressed that they wished that their parents would ask for their permission before posting about them. A few said their parents used to post a lot about them when they were younger, but after telling their parents to post less they stopped posting as much. Insights from participants included the following:
“We used to live in a different country, most of the time when we did go out she would post videos or photos online. Now she has removed most of them because I told her we need less info out there about us, because people can be weird.” (youth participant)
“I play basketball and my dad shares a lot of my basketball stuff. He adds extra stuff to it as well. My friends or people I play against might see that, it’s annoying to see he’s doing that without me seeing or knowing about it until later.” (youth participant)
“My parents used to post more when I was younger, probably because they wanted to show my accomplishments. They’ve been doing it less now, because I want my information out there less. So, it’s been fine now.” (youth participant)
Some participants did not mind if their parents posted about them, particularly because their parents limited who they shared content with (such as with close relatives), so they were not bothered by it since they knew the people commenting on posts. Some said that their parents would never post things that could harm them in the future, so they did not see a problem.
Finally, a small number of participants from each of the focus groups said that their parents would seek out their consent before posting about them. Some said that their parents would get them to approve photos before posting to Facebook. Two participants said their parents had never posted about them without their consent.
Youth-identified priorities for improving online privacy
When asked about what they wished would be done to help protect their privacy online and what parents, teachers or decision-makers could do, participant responses focused on two themes: asking companies to do more and asking for more privacy education.
Companies should play an active role
Even though participants did not seem aware of the potential harms to their privacy that companies themselves could cause (resulting from practices such as behavioural targeting, for example), the most common theme was that companies could be doing more to help youth engage online in a privacy protective way. This was primarily related to content takedown, as participants were concerned about third parties seeing content about them that they did not want them to see.
Several participants said that companies are slow to respond when things go wrong:
“Tech companies are super slow with things like that. If someone I knew posted something and I didn’t like the photo [of me], the tech companies don’t respond fast enough for it to actually matter. If it’s been posted for a day, that’s enough time for a lot of people to see it.” (youth participant)
“I agree that they are slow with it. I understand many people need to contact them, but they should increase their team size because they’re very slow.” (youth participant)
One participant was not sure if there were teams that search for inappropriate videos or accounts online and removed them but suggested that would be a good idea.
While most participants did not mention safeguards, a few noted that the risk of hacks and information leaking was concerning, so more should be done to protect that information.
More privacy education is needed
Participants said that it would help them if they were more educated about online privacy and how to protect it. Some asked for more privacy education in schools and suggested that it would be beneficial to have someone their age available as a resource. A few called for more messaging that highlights that what users post online is public, and that anything posted would be there for a long time, even on private accounts. One participant cautioned that messaging focused on abstaining from social media is not effective:
“Rather than saying ‘don’t post on social media’, in this age it’s not realistic to not use social media at all. It’s the main form of contact for a lot of people. Go into detail instead about how we can keep privacy safe while still using it.” (youth participant)
Others called for more education for parents and teachers:
“If teachers or parents were more educated on this stuff then we could be more educated on it. A lot of teachers for example will try teaching us about it but will have no idea what they’re talking about.” (youth participant)
Additional takeaway: Age assurance
While researchers did not specifically ask about age assurance, several teens mentioned this theme in their answers either directly or indirectly. As discussed above in the Harmful privacy experiences section, providing a false birth date was seen as an effective way to protect privacy by reducing the amount of accurate personal information shared with companies that they perceived to be asking for too much information. This behaviour may have unintended consequences for age assurance efforts that rely on self-declaration.
“On most apps they have the age thing – verifying people’s age – but you can’t verify the age properly, so that’s one of the biggest issues we have when it comes to the Internet. It doesn’t actually have something where you say your real [birth]date – people can change their birth year to look older.”
Others reported that they had changed their birth year so that they could access services such as games and Instagram when they were younger. A couple of participants noted that they were able to do this because age limits are not enforced on many sites.
Conclusion
In 2024, when Commissioner Dufresne established championing children’s privacy rights as a strategic priority, he set out a goal of deepening the OPC’s understanding of youth privacy, learning directly from them, and identifying key opportunities through research and engagement. The OPC’s focus groups have provided several key findings that will help to inform the work of the Office, namely when it comes to outreach and public education for youth, and through its engagements and advice to organizations.
The OPC will continue its privacy education efforts with the help of its Youth Council and in partnership with provincial and territorial counterparts to ensure that resources are developed with high impact. It will also look to partners to leverage and promote the excellent privacy education resources being developed across the country. The OPC also sees a need for further engagement with parents and teachers, given their important role as trusted advisors to youth and the rising complexities associated with engaging in the online world safely.
The OPC will similarly continue to champion children’s privacy rights with organizations. Insights from the focus groups will be helpful as the Office develops guidance and recommendations and in proactive engagements with businesses. The OPC will continue to provide advice and guidance to help organizations meet their obligations to respect children’s privacy, and to design products and services with children’s privacy in mind. As the Office advances the children’s code work, it will continue to engage with businesses, youth, and other interested parties at each step of the process to ensure that it is developing clear, practical guidelines for organizations that handle children’s personal information.
Methodology
On February 8, 2025, two researchers from the OPC’s Policy and Research team led three 60-minute virtual focus groups with young Canadians from the general population between the ages of 13 and 17 years old. Participants were asked questions related to their online experiences, their perceptions of privacy protections and privacy-related issues, and about their knowledge of privacy rights and resources available to them.
The OPC engaged an external Independent Review Board to ensure that OPC researchers had appropriate qualifications and that the research design was methodologically sound for involving human participants.
Online focus groups were chosen as it was determined to be a cost-effective method to reach a representative audience from across Canada, and it would limit the need for respondents to travel to the National Capital Region.
The OPC engaged a recruitment firm to ensure a diverse representative sample of the Canadian population, from provinces and territories across Canada. It ran a total of three focus groups: two groups in English (one with 7 participants and the other with 5), and one focus group of 7 youth in French.
For both consent and assent, parents and youth participants were informed about the purpose of the study, what youth participation entailed, what the researchers would do with the collected data, as well as the risks and benefits of participating in the study. Responses were collected without identifiers and were anonymized.
- Date modified: