Children’s privacy code

---

Contents

Executive summary

Summary of expectations

Purpose and framework

Purpose

Rights-based foundation

Statutory framework

Jurisdictional alignment

Risk-based approach

Scope and applicability

Children covered

Organizations and services covered

“Directed at children” indicators

“Likely to be accessed by children” indicators

Foundational principles

Children’s right to privacy

Best interests of the child

Child-specific risks

Evolving capacity

Parental support and guided autonomy

Expectations

Consent

Privacy Impact Assessments

Default high privacy settings

Data minimization

Transparency

Correction and deletion

Avoiding profiling

Prohibited practices

Deceptive design

Data practices that introduce or amplify privacy harms

Footnotes

---

Executive summary

For children today, engaging with technology is less of a choice than a condition of modern life. These technologies have become a primary means through which children learn, connect and participate in society.

As digital environments have grown more complex, so too have the risks that children face within them, and children are too often left without the means to meaningfully exercise their privacy rights.

The Children’s Privacy Code (the Code) sets out overarching guidance for how organizations should collect, use and disclose children’s personal information in digital environments.

The Code builds on the Personal Information Protection and Electronic Document (PIPEDA) by interpreting how its protections apply to children who are rights-holders in Canada’s legal framework. The intent is not to prevent children from participating in digital life, but to allow them to explore, learn and express themselves online in ways that are appropriate to their age and evolving capacity.

The Code is organized around key foundational principles - including children’s right to privacy, guided autonomy and the recognition of evolving capacity - and translates those principles into expectations for organizations. The Code also sets out limits on data practices that are fundamentally incompatible with children’s best interests.

The expectations set out in the Code are targeted at the areas identified as having the highest impact on children’s privacy. Where specific guidance is not provided, organizations are expected to apply the foundational principles set out in Section 4 to inform their decisions and practices.

The Office of the Privacy Commissioner of Canada (OPC) will complement the Code over time with more targeted guidance for specific sector or risk areas and welcomes input from interested parties on topics for which specific guidance would be most valuable.

The Code is designed to be flexible, balanced and proportionate to acknowledge the diversity of contexts in which children’s information is collected and the range of organizations subject to PIPEDA. Where further clarification is needed, organizations are encouraged to engage with the OPC early. The OPC welcomes dialogue as part of a collaborative approach to protecting children’s privacy.

Children themselves have been calling for stronger online privacy protections^{Footnote 1}. In keeping with Article 12 of the United Nations Convention on the Rights of the Child (UNCRC), which requires that adults take children’s views into account when making decisions that impact them, the OPC engaged with children in a variety of ways^{Footnote 2} to help inform the Code.

When consulting with children, the main concerns we heard were related to a lack of control and choice as well as a lack of age-appropriate information.

Summary of expectations

This section provides a brief summary of each expectation set out in the Code. For full guidance, organizations should refer to the relevant sections in the Code.

1. Consent: Organizations must obtain meaningful consent for the collection, use and disclosure of children’s personal information, calibrated to the child’s evolving capacity. Non-essential data uses should require express, opt-in consent with separate choices offered for each optional feature or enhancement. Organizations should allow children and their parents or guardians to withdraw consent at any time.
2. Privacy impact assessments: Organizations are encouraged to conduct a privacy impact assessment, especially when offering higher-risk products or services.
3. Default high privacy settings: Services covered by the Code should be configured to the highest available privacy setting by default. The collection and use of location data, and the public visibility of profiles should be off by default.
4. Data minimization: Organizations must limit the collection of children’s personal information to what is directly necessary for the service. Personal information collected from children must not be retained for longer than is necessary for the purpose for which it was collected.
5. Transparency: Organizations should provide privacy information that is clear, accessible and age appropriate.
6. Correction and deletion: Children should have practical means of correcting personal information that is inaccurate or incomplete as well as of deleting their personal information.
7. Avoiding profiling: Organizations should not use children’s personal information to build profiles on them or for purposes that could harm them. Where profiling informs automated decisions about children, the best interests of the child should be the primary consideration.

Purpose and framework

Purpose

The Code establishes dedicated guidance for the handling of children’s personal information in Canada. It sets out clear expectations for organizations that collect, use or disclose children’s personal information, grounded in the recognition that children are privacy rights holders deserving of enhanced protection. Note that while the Code addresses some of the main considerations, organizations remain responsible for understanding all of their obligations under applicable laws and regulations.

The Code’s purpose is to ensure that children’s personal information is collected, used and disclosed in ways that respect their rights, account for their evolving capacity and serve their best interests. It reflects the principle that robust privacy protection for children should be embedded into design practices and decision making from the outset, not treated as an afterthought. Privacy should not be left to children or families to protect on their own.

The Code’s objective is not to limit children’s participation in digital life, but to help ensure that when they do participate in online activities, their rights are protected and easy to exercise.

Rights-based foundation

This Code reflects Canadian case law that has affirmed the importance of children’s privacy rights. In the Supreme Court of Canada’s (SCC) unanimous 2012 decision in A.B. v. Bragg Communications Inc. Justice Abella, writing for the Court, characterized the privacy rights of children and youth in the following terms:

Recognition of the inherent vulnerability of children has consistent and deep roots in Canadian law. This results in protection for young people’s privacy under the Criminal Code…, the Youth Criminal Justice Act… and child welfare legislation not to mention international protections such as the Convention on the Rights of the Child…, all based on age, not the sensitivity of the particular child. As a result, …, there is no need for a particular child to demonstrate that she personally conforms to the legal paradigm. The law attributes heightened vulnerability based on chronology, not temperament.^{Footnote 3}

Similarly, in R v. Jarvis, the SCC noted that Canadian law provides greater privacy protections to children than “similarly situated adults” in several contexts, which reflects a “societal consensus” about “the shared value of protecting children’s privacy.”^{Footnote 4}

The Code is also grounded in Canada’s obligations under the United Nations Convention on the Rights of the Child (UNCRC), which Canada ratified in 1991. Article 16 of the UNCRC recognizes children’s right to privacy, and Article 3 sets out the principle of the best interests of the child. The UNCRC also recognizes the evolving capacity of children, affirms their right to participate in all matters affecting them, and recognizes children’s right to be protected from harm.

In 2021, the UN Committee on the Rights of the Child issued General Comment No. 25 on children’s rights in relation to the digital environment, which provides guidance on how States and other actors should apply UNCRC obligations in digital contexts. General Comment No. 25 outlines that children’s rights, including the right to privacy, apply online and that States bear responsibility for ensuring that those rights are protected by both public and private actors, including commercial organizations.

General Comment No. 25 emphasizes that upholding “[p]rivacy is vital to children’s agency, dignity and safety and for the exercise of their rights”^{Footnote 5} It is also central to the realization of children’s rights as a whole, including to education, health, information, freedom of expression, and to enjoy their own culture.

Statutory framework

PIPEDA sets the ground rules for how private-sector organizations collect, use, and disclose personal information in the course of for-profit, commercial activities across Canada. PIPEDA sets out a principles-based framework organized around ten fair information principles:

1. Accountability
2. Identifying purposes
3. Consent
4. Limiting collection
5. Limiting use, disclosure, and retention
6. Accuracy
7. Safeguards
8. Openness
9. Individual access
10. Challenging compliance

While PIPEDA does not expressly distinguish between the privacy rights of children and adults, the OPC has consistently taken the position that children’s personal information warrants heightened protection. Accordingly, organizations’ obligations under PIPEDA should be interpreted and applied with the particular sensitivity of children’s personal information in mind.

The Code reflects the OPC’s views on organizations’ obligations under PIPEDA with respect to children’s privacy and provides practical guidance on how organizations can meet those obligations and better protect children’s personal information.

Jurisdictional alignment

The Code reflects a growing consensus, within Canada and internationally, that children require dedicated privacy protection. As a reflection of this, the United Kingdom’s Information Commissioner’s Office (ICO)^{Footnote 6}, Ireland’s Data Protection Commission (DPC)^{Footnote 7}, and the Office of the Australian Information Commissioner (OAIC)^{Footnote 8} published or drafted guidelines for the protection of children’s privacy, and this trend continues to grow internationally.

In Canada, at the federal, provincial and territorial levels, privacy regulators have jointly affirmed this commitment through a resolution calling on organizations to prioritize the best interest of children in the design and delivery of digital services.^{Footnote 9} Provincial legislative developments reflect the same direction.^{Footnote 10}

The OPC’s approach in drafting this Code has been informed by these international and domestic developments, consistent with Canadian law and policy. A coherent and consistent approach to children’s privacy across jurisdictions benefits children, provides greater certainty for organizations operating in multiple markets and contributes to the emergence of common principles for the protection of children’s personal information.

Risk-based approach

The Code takes a risk-based approach. Organizations are expected to actively consider the risks that their products, services and activities pose to children, and to implement mitigating measures that are proportionate to those risks. This means that the level of protection will not always be fixed or uniform; it should be calibrated to factors including:

• the nature of the service;
• the intended audience and the likelihood that children will access it;
• children’s expected level of engagement if accessing the service;
• the types and sensitivity of personal information involved; and
• the likelihood that harm would occur to children if that information were mishandled, and the potential severity of that harm.

A risk-based approach does not reduce obligations; it helps to ensure that efforts and protections are directed to where the need is greatest. Organizations whose services are highly likely to be accessed by children, or that handle sensitive categories of children’s personal information are expected to apply correspondingly robust protections. In all cases, organizations should recognize the vulnerability of children and that greater protections are likely necessary. This risk assessment can help determine the degree to which additional safeguards are required.

Applying a risk-based approach: Illustrative examples

These examples^{Footnote 11} illustrate how the risk factors can be assessed and applied.

Risk factors	Low risk	Medium risk	High risk
Context	A teenager navigates a music store’s website to research guitars.	A child accesses an entertainment website that offers educational games.	A teenager creates a profile on a social media service and explores content.
Nature of service	Retail	Online gaming, without direct messaging	Social media, with direct messaging and location sharing
Intended audience	General population	Children	General population
Level of engagement	The teenager is likely to only research guitars as intended (i.e., low likelihood of sustained child engagement).	The child is likely to be engaged over a long period of time with games.	The teenager is likely to be engaged over a long period of time due to the nature of content and potential social interactions.
Sensitivity of information	Little to no personal information is collected.	There is potential for collection of usage data and personal information if the child has to create an account or profile.	Through usage data, direct messaging, and location sharing, there is a broad range of sensitive data collection.
Potential for harm	Given the nature of the service, the intended audience and the sensitivity of information collected, potential for harm is limited.	Due to the level of engagement and the possibility of sensitive data collection, the potential for harm is moderate.	Due to the sustained level of engagement and the sensitivity of data collected, the potential for harm is high.

Scope and applicability

Children covered

The Code provides guidance to protect all children under the age of 18. Recognizing that children are not a homogenous group, obligations under privacy law as described in the Code should be calibrated to reflect developmental stages. Organizations are expected to apply measures that are proportionate to the age and maturity of children who access or are likely to access their service. This could involve providing heightened protections for younger children, while affording more mature children greater autonomy.

Organizations and services covered

The Code reflects Canadian privacy law as it applies to any organization subject to PIPEDA that collects, uses or discloses personal information during a commercial activity, where that activity involves an online service (including websites, applications, platforms and digital tools) that is directed at children or is likely to be accessed by children.

The Code applies regardless of whether children are the intended or primary audience of the service. Children access a wide range of online services, many of which are not designed or marketed with them in mind. Limiting protection to services directed at children would leave a significant gap, one that does not reflect the reality of how children engage with the digital world. An organization cannot avoid its obligations under privacy law described in the Code solely on the basis that its service was not designated for children, if children are accessing it in practice.

“Directed at children” indicators

A service is likely directed at children where one or more of the following apply:

• the subject matter, content or theme is primarily of interest to children.
• the service uses child-directed language, imagery, animation or characters.
• the service is marketed or promoted through channels targeting children or their parents.
• the service is designed or structured in a way to be suitable for children.
• children constitute a significant portion of the actual user base.^{Footnote 12}; ^{Footnote 13}

“Likely to be accessed by children” indicators

A service is likely to be accessed by children where relevant factors indicate a reasonable probability of child access. These factors may include:

• any available research evidence that an organization has undertaken about its user base, or about user behaviours that indicates the presence of children;
• indication that third-party advertisers place ads directed at children on an organization’s website;
• the presence of content, design features or activities that are appealing to children; and
• whether children are known to access similar websites and services.^{Footnote 14}

No single factor is determinative; organizations should assess the totality of the context and circumstances. If an organization decides that a service is not likely to be accessed by children and that it is therefore not going to consider the Code’s guidance, then the organization should document the decision and the reasons for it.

Foundational principles

The foundational principles set out the overarching values and considerations that underpin this Code. They do not prescribe specific actions or obligations; rather, they articulate the intent and spirit of the Code and organizations should draw on them when interpreting expectations, exercising judgement and determining how requirements apply in context.

Organizations subject to the legislative requirements described in the Code are expected to engage with these principles and use them to inform their decisions and practices in ways that genuinely respect children’s privacy.

Children’s right to privacy

Children have a fundamental right to privacy.

Children are rights-holders whose privacy interests merit recognition and respect. This means that privacy considerations in the context of commercial activities involving children cannot be reduced to risk management or harm avoidance alone. Organizations must approach their obligations with the understanding that children have a genuine and independent interest in controlling their personal information, and that this interest should be considered at every stage of design, development and deployment.

Best interests of the child

The UNCRC affirms children’s rights, including the right to privacy, and introduces the concept of the best interests of the child.

This concept requires that children’s well-being and rights be primary considerations in decisions or actions concerning them directly or indirectly. As a guiding principle, this concept can be applied in a variety of contexts to help assess and balance the interests of young people against the interests of others. Where the best interests of the child conflict with other interests or rights of others, the conflict must be resolved on a case-by-case basis. In that assessment, greater weight should be given to what serves the child best.^{Footnote 15}

In 2023, the OPC, with provincial and territorial counterparts, released a joint resolution and companion document Putting best interests of young people at the forefront of privacy and access to personal information. The resolution sets out recommended practices for public and private sector organizations to adopt to prioritize the best interests of children and protect their privacy.

Child-specific risks

Children face risks that are distinct in nature and consequences from those affecting adults.

The ways in which children engage with digital environments, their developing capacity to recognize and respond to risk, and the potential for privacy harms to follow them into adulthood all require special attention. Organizations should assess privacy risks through a child-specific lens and design their protective measures proportionally. Applying adult-oriented frameworks to children, without adaptation, does not constitute adequate risk management under the Code.

Children’s personal information can be used in ways that pose risks to their development and wellbeing, including exposure to harmful or age-inappropriate content, negative body image, early sexualization and reinforcement of harmful stereotypes. Children can also be disproportionately susceptible to the pressures of practices such as online advertising.

Researchers have identified that common privacy risks for children relate to content, contact, commercial activities and conduct, known as the 4Cs.^{Footnote 16}; ^{Footnote 17}

• Content risks pertain to harms associated with the type of materials a child engages with, either by choice or by exposure due to algorithms and advertising.
• Contact risks pertain to harms associated with interactions in their daily lives. For instance, they may interact with someone they do not know, who shares inappropriate content with them, or people they know who share information and media about them without their consent.
• Commercial risks pertain to harms associated with exploiting children’s personal information for commercial purposes, sometimes by using deceptive design patterns.
• Conduct risks pertain to the children as a perpetrator of online harms such as cyberbullying or data theft.

Some risks may intersect across one or more of the 4Cs.

Evolving capacity

As children develop, their ability to understand, navigate and make meaningful privacy decisions grows.

Younger children require stronger measures and greater reliance on trusted adults. As children mature, they are increasingly capable of exercising agency over their own personal information and should be supported in doing so. Organizations should recognize this progression and build flexibility into their approaches. They should apply protections that are appropriate to the developmental stage of the children they serve, rather than applying uniform standards that fail to account for the diversity of children’s experiences.

The method an organization uses to determine whether its users include children and to assess their capacity to make privacy decisions, such as consenting and adjusting privacy settings, should be proportionate to the risks posed to children. Where risks are lower, a less rigorous approach may be appropriate. Where risks are higher, organizations will be expected to have a greater degree of certainty about the age of their users, which may require more robust measures such as parental confirmation or age assurance tools. Where sufficient certainty cannot be achieved, protections should be applied to all users as a default. Any method used should be privacy preserving, avoid collecting more personal information than necessary and be reviewed regularly as services change.

The following age ranges and developmental stages can be used as a guide for organizations when considering evolving capacity and consent:

Evolving capacity

Ages	Developmental stage	Nature of consent
0 to 5 years old	Pre-literate and early literacy	• Parental consent
6 to 9 years old	Core primary school years	• Parental consent • Simple written or visual notice for child
10 to 12 years old	Transition years	• Parental consent • Written notice to child
13 to 15 years old	Early teenage years	• Child consent
16 to 17 years old	Approaching adulthood	• Child consent

Organizations should take into consideration children’s evolving capacity and developmental stages for the following:

• developing consent mechanisms that are transparent and understandable in a way that is meaningful and comprehensible to children at different stages of development;
• developing default privacy settings, which should be set to the highest level of protection by default, with the child’s ability to adjust appropriately as they mature;
• minimizing data collection, which should only require information that is necessary for the service;
• parental involvement and controls, which should be calibrated to the child’s age and maturity;
• content personalization, which should ensure that recommended or provided content is in the best interests of the child; and
• tone and complexity of communication directed at children, which should be simple and easy to understand for the age range of the child.

The OPC recognizes that some industry sectors may already have established standards or guidelines that differentiate practices based on age. Where such standards exist, organizations may draw on them, taking into account factors such as whether they are grounded in research evidence, reflect an understanding of children’s developmental stages or were developed with input from children.

Age assurance

Age assurance can be a valuable mechanism toward the goal of creating a safer, more privacy-protective online experience for children. This goal can and must be advanced without creating an undue impact on privacy rights.

Consistent with the general approach for the Code, age assurance should be used as one of the multiple approaches to protect children online and used in a risk-based manner, proportionate to the potential harm being addressed. Complementary or alternative means of advancing the goal of a safer, more privacy-protective online experience for children should also be considered or adopted.

The OPC has established guidance on Assessing whether and how to use age assurance (Guidance for websites and online services) and Designing age assurance to be privacy-protective (Guidance for age assurance developers).

Parental support and guided autonomy

Parents and guardians play a valuable role in many children’s digital lives and are a source of guidance and support in a child’s understanding and judgement.

As children grow, many parents and guardians act as trusted guides, offering age-appropriate support, oversight and perspective, while the child progressively develops greater agency over their personal information. While organizations should design products and services that are appropriate for children on their own terms, they should also ensure that parents and guardians are able to play a supportive and complementary role, rather than being placed in a position of primary safeguard against risks that design should address.

This means that privacy protections for children should be embedded in how products and services are built, not delegated to parental oversight after the fact. When the burden of protection falls primarily on parents and guardians, through settings, controls or monitoring, it places unrealistic expectations on families and risks leaving children exposed to risk. The goal of guided autonomy is not to limit children’s access to digital spaces, but to ensure that they can navigate them with confidence and appropriate support.

Where parental controls are offered, they should be age-appropriate, support children’s agency, and respect children’s rights, evolving capacities, and the best interests of the child.^{Footnote 18} Where a child’s activity is being monitored or their settings adjusted by a parent or guardian, the child should be informed in plain language that they can understand. Where appropriate, if a parent or guardian has consented, the child should receive an age-appropriate notice. For instance, it would not be suitable to send a written notice to the child if they are under 5 years old (i.e., pre-literacy and early literacy stage of development).

The OPC’s engagement with children has shown that children are not uniformly opposed to parental involvement in their digital lives. Young children in particular have identified situations where oversight by a trusted adult felt appropriate or was even welcome.^{Footnote 19};^{Footnote 20} At the same time, children consistently expressed a desire to maintain meaningful control and ownership over their personal information. Organizations should make choices with both realities in mind.

We also recognize that not all children have consistent access to a parent or guardian who can provide guidance and support in digital spaces. Products and services should not be designed in ways that effectively condition full participation or privacy protections on the availability of adult oversight. Children who navigate digital spaces with less parental support should not face greater exposure to risk as a result of their circumstances.

Parental involvement should depend on capacity and content. Some kids need more help understanding the consequences of sharing information. I think parents should be part of the journey. – Youth Roundtable Participant

Guided autonomy in practice: Matching parental involvement to risk^{Footnote 21}

As the risk to the child increases, organizations should take greater steps to facilitate meaningful parental involvement in their child’s digital activities. Where a child is under 13, parental consent is always required.

Left to right: Lower risk to higher risk

Child acts independently	Parental awareness expected	Parental involvement should be required
• Playing a game with no social interactions that collects only username • Accessing emergency websites or help lines like Kids Help Line • Deleting their own posts or account activities	• Joining an online community or forum where posts are visible to other users • Using a streaming or content platform that makes recommendations	• Creating an account on a platform that involves direct interaction with other individuals or groups that are not part of the service itself • Sharing sensitive personal information such as health or biometric data

 

Expectations

The expectations set out in the Code establish what organizations should do, and should refrain from doing, when they collect, use or disclose the personal information of children. The expectations are grounded in PIPEDA’s requirements, informed by best practices and consistent with the evolving landscape of children’s privacy protection across Canadian jurisdictions and internationally.

The expectations are technology neutral. They do not prescribe particular technical solutions but rather describe the intended outcomes. How organizations achieve these outcomes will depend on the nature of its product and services, the capacity of the children it serves and the level of risk that its data practices present.

Giving effect to these expectations will require organizations to embed privacy into the foundation of its operations by using privacy by design. It means identifying and addressing privacy risks at the outset of any initiative, building protective measures into the architecture of products and services from the earliest stages of development and sustaining that approach as contexts evolve. Compliance with these expectations is not a one-time exercise.

Consent

Relevant PIPEDA Principles: Consent; Identifying purpose

Relevant OPC guidance: Guidelines for obtaining meaningful consent

Obtaining meaningful consent from children presents distinct challenges. A child’s capacity to understand the nature, purpose and consequences of the collection, use and disclosure of their personal information develops over time, and consent mechanisms designed for adults will generally not meet PIPEDA’s meaningful consent standard when applied to children. For example, where privacy information is presented in complex language or in formats that assume an adult level of comprehension, it would not be reasonable to expect that a child could meaningfully consent. They would be unable to fully grasp the complexities and potential risks of sharing their personal information. Accordingly, an organization’s approach to consent should be reflective of children’s evolving capacity and be calibrated to the age and developmental stage of the children who access their service.

Where consent is the basis upon which organizations collect, use or disclose personal information, we would expect:

• children under 13: In all but exceptional circumstances, organizations must obtain consent from a parent or guardian and should inform the child through an age-appropriate notice when appropriate.
• children 13 to 18: Organizations should assess whether the child has sufficient capacity to understand what they are consenting to in the context of the specific data practice, particularly for sensitive personal information.

Opt-in consent for non-essential data uses

Children should be able to control when and how their personal information is collected, used or disclosed by choosing whether their personal information is collected, used or disclosed for a particular purpose. As described in the OPC’s Guidelines for Obtaining Meaningful Consent, express consent is required where information is sensitive, the use exceeds reasonable expectations or significant risk of harm may result. Given the sensitivity of children’s personal information and their vulnerability and more limited capacity to assess privacy risks, organizations should obtain consent to non-essential uses of children’s personal information on an opt-in basis. For the purposes of this Code, non-essential purposes are those that go beyond what is necessary to provide the core product or service. Organizations must demonstrate that these uses are in the best interests of the child. This may include uses that support personalization or accessibility, such as adapting the visual configuration of a product or service to accommodate a child with a visual impairment. Organizations should not infer consent from:

• inaction; or
• the child’s continued use of a service.

Organizations should also not make access to a product or service, or the quality or functionality of that product or service, conditional on a child or parent providing or maintaining consent to non-essential uses of the child’s personal information. Where consent to such uses is declined or withdrawn, the organization should not penalize the child by withholding the core product or service or materially degrading its essential functionality.

I don’t know if I have complex solutions, but [it is important to have] some parental guidance there for youth. As well as regular check ins [from companies], “these are people who see your location on a regular basis, are you still ok with that”. That’s a big one. – Youth Roundtable Participant

 

 

Withdrawing consent

Organizations should allow children and their parents or guardians to withdraw consent at any time. Mechanisms to withdraw consent should be clear, simple and readily accessible. This includes:

• ensuring that withdrawing consent is as straightforward as giving it;
• ceasing the data practice to which consent applied once consent is withdrawn;
• not penalizing the child for withdrawing consent; and
• providing periodic reminders about consent choices that have been made, at meaningful intervals and moments, and facilitating changes to those decisions.

When children and their parents or guardians withdraw consent, the collection and use of children’s personal information should stop. In some circumstances, this also means that any previously collected information should be deleted. For instance, if a child deletes their social media account on a service, the organization should delete all associated personal information.

Give children separate choices

Where a service offers multiple features or functions, some essential to its core purpose, others optional enhancements, children should be given meaningful choices about which elements they wish to use and, therefore, how much personal information they provide. Organizations should distinguish between the collection of personal information required for optional features and what is needed to deliver the core service.

Where separate choices are offered, each option should be equally visible and accessible to the child. Organizations must not use design to obscure or disadvantage privacy protective choices relative to those that involve greater data sharing (see also: Prohibited Practices – Deceptive Design).

Separating core and optional data collection: Illustrative examples

What is necessary to deliver a service varies by context. These examples^{Footnote 22} illustrate how organizations could distinguish between personal information required for core functionality and that collected for optional features:

Free mobile game	Social media or content sharing app	Online education platform
Core to service • Username • Age range	Core to service • Email • Age • Region	Core to service • Name • School email • Grade level • Class enrollment
Optional • Location • Profile photo	Optional • Specific location • Biometric data • Demographic information	Optional • Location • Address • Demographic information

 

Privacy Impact Assessments

Relevant PIPEDA Principle: Accountability

A privacy impact assessment (PIA) is a process through which an organization identifies, evaluates and addresses the privacy risks associated with a product or service before it is launched or significantly changed. The OPC has consistently identified PIAs as a helpful accountability tool for organizations, one that:

• helps demonstrate that personal information is being handled responsibly;
• supports compliance with privacy law; and
• reduces the likelihood of privacy breaches.

In the context of children’s privacy, where the potential for harm is heightened and the consequences of privacy breaches can be long-lasting, the PIA process takes on particular importance.

When a PIA should be conducted

Organizations are strongly encouraged to conduct a PIA before launching or making significant changes to any product or service directed at children or likely to be accessed by children, particularly where the proposed data practices have the potential to create a higher risk to privacy.

Privacy risks warranting a PIA may arise, for example, where a product or service involves:

• monitoring, profiling or making inferences about children;
• the use of children’s personal information to make or inform decisions that could have significant effects on a child;
• the collection or use of information about a child’s location, activities, relationships or behaviour; or
• extensive or repeated sharing of children’s personal information with third parties, particularly where the organization cannot exercise meaningful control over how the information will subsequently be used.

These examples are intended to illustrate circumstances that may warrant a PIA and do not imply that the underlying practices are appropriate, necessary or permissible. The presence of one of these practices does not necessarily mean that the activity presents a high residual risk. Organizations should first assess whether the collection, use or disclosure of children’s personal information is justified under the law and consistent with the best interests of the child.

Organizations should consider the purpose and necessity of the practice, the nature and sensitivity of the information, the potential impact on children, and the safeguards and limitations that have been put in place to reduce the risk. For example, limiting the collection of location data to what is strictly necessary to provide a core service, or imposing meaningful restrictions on a third party’s use of children’s personal information, may reduce the residual risk. However, where an activity has the potential to create significant privacy risks, even where the activity is intended to advance the best interests of the child, organizations should consider conducting a PIA.

A PIA is not a one-time exercise. A PIA should also be conducted or updated when an organization substantially modifies an existing product or service in ways that introduce or materially change higher-risk data practices affecting children, or when a new feature involving such practices is added to a product or service that children are likely to use.

Where it is unclear whether a product or service meets the threshold for a PIA, organizations are strongly encouraged to conduct one. Identifying and mitigating privacy risks at the design stage can help prevent harms and is always more effective than addressing them after a product or service has been launched.

What should a PIA cover

Organizations should use the PIA to map the full lifecycle of children’s personal information, and demonstrate how each of PIPEDA’s principles is met in practice. For initiatives involving children’s personal information, PIAs should explicitly address risks to children and the mitigation measures put in place to address these risks.

PIAs could include:

• a description of the collection, use and disclosure of personal information and how it is necessary to the running of the service and in the best interests of the child;
• a description of age-appropriate consent processes;
• a description of how privacy practices are communicated to users;
• procedures for the correction, retention and deletion of personal information;
• an evaluation of safeguards, such as how risks are mitigated and how the best interests of the child are met in all processes involving children’s personal information (e.g., collection, use, disclosure, profiling and other automated decision-making, etc.);
• procedures for complaints on the misuse of personal information; and
• an evaluation of how the initiative might impact children from different groups and backgrounds.

Organizations are also encouraged to assess whether their product or service sufficiently mitigates additional risks to children’s rights as defined by the UNCRC^{Footnote 23} by including measures from existing Child Rights Impact Assessments.^{Footnote 24}

Default high privacy settings

Relevant PIPEDA Principles: Consent; Limiting collection; Limiting use, disclosure, and retention; Safeguards

Privacy protective defaults are one of the most effective safeguards for children online. The settings that are on when children first access a product or service will, in most cases, be the settings they use, due to how difficult they can be to navigate. Therefore, in addition to being privacy protective by default, organizations should provide users with easily understandable information to find and adjust their privacy settings. The implications of privacy settings should also be clear and highlight to children how their personal information is collected, used and disclosed, and any associated risks or consequences.

The OPC’s expectation is that, unless there is a compelling reason to do otherwise, settings that affect the collection, use or disclosure of a child’s personal information, or that makes their personal information public, should default to the most privacy protective option available. Where an organization wishes to apply a less protective default, it should document its decision and be able to demonstrate that the alternative default does not expose children to unnecessary privacy risks.

Implications for different categories of privacy settings are described in the following subsections.

Location data

Location data collection should be off by default. It may only be enabled where:

• collection of location is directly necessary for the delivery of the core product or service and it is made obvious to a child, parent or guardian using that product or service; or
• it is necessary to protect the life, health or security of the child.^{Footnote 25}

In the event that the above criteria are met and location data is enabled, the information collected should be limited to what is necessary for the specific function that it supports, and the data must not be used for any secondary purpose without explicit consent.

Organizations should also consider the level of precision at which location data is collected, ensuring that it is no more detailed than necessary to deliver the specific function it supports. A service that requires general regional location, for example, should not collect exact or real time location data.

The collection, use and disclosure of children’s location data carries heightened risks, as exposure of a child’s physical whereabouts can have direct and serious consequences for their personal safety. Organizations should consider this carefully if making location data visible to others.

Companies could do regular check ins, “these are people who see your location on a regular basis, are you still ok with that”. – Youth Roundtable Participant

 

 

Public profiles and visibility

User profiles for children should be set to private by default. Children’s accounts, profile information and activity should not be visible to the general public or to users who are not confirmed connections, unless explicit consent is given.

Children’s profiles should also not be indexed by external search engines by default. A child’s profile should only be discoverable beyond the platform if the child, or their parent or guardian, chose to enable discoverability.

 

 

 

Consent for under 13

In all but exceptional circumstances, consent for the collection, use and disclosure of personal information of children under the age of 13 should be obtained from a parent or guardian. Exceptions must be narrow, clearly defined and demonstrably in the best interest of the children, for example, where a child under the age of 13 asks for the deletion of their personal information.

Third party data sharing

Sharing of a child’s personal information with third parties should be off by default. Data must not be disclosed to third parties unless the child, parent or guardian has consented. Blanket consent obtained through terms of service would likely not satisfy this expectation.

Profiling off by default

Profiling of children should be off by default. Organizations should not build or use profiles of children’s behaviours, interests or characteristics unless the child has explicitly opted into that practice and it is in their best interest (e.g., they have a handicap and agree to automated decision making for a more seamless experience on the product or service).

Data minimization

Relevant PIPEDA Principles: Limiting collection

The less personal information an organization collects, retains and discloses about children, the lower likelihood of harm. Organizations must collect only what is demonstrably necessary. This applies to every stage of a child’s interaction with a product or service.

Limiting collection from the outset

Organizations must only collect personal information that is necessary to deliver the specific function or service that the child is seeking to use. Each individual feature or function should be assessed, not only the product or service as a whole.

Organizations must not collect personal information about children on the basis that it may be useful in the future or that it could improve the organization’s understanding of its user base. Where a purpose can be achieved using anonymized, aggregated or de-identified information, organizations should use that approach rather than using personal information.

 

 

Retention

Personal information collected from children must not be retained for longer than is necessary for the purpose for which it was collected. Because children’s circumstances evolve rapidly, and because information collected during childhood can have lasting consequences, organizations must apply particular rigour to retention decisions involving children’s personal information. Measures could include:

• establishing clear retention periods for each category of personal information from children, tied to the specific purpose for which it was collected;
• deleting or anonymizing personal information as soon as it is no longer needed for that purpose; and
• establishing processes to address what happens to a child’s personal information when they stop using a product or service, or when they reach adulthood. This includes ensuring that individuals are able to request deletion of personal information collected about them as children once they reach the age of majority.

Transparency

Relevant PIPEDA Principles: Openness

Organizations must present privacy information in ways that genuinely support individuals making informed choices and go beyond technical disclosure. This means that information must be designed in a way that will be understandable to the children who will encounter it, taking into account their age, developmental capacity and the nature of the product or service they are using. Information must be accessible, comprehensible and useful.

Age-appropriate presentation

Privacy information should be tailored to the age range and developmental capacity of the children who will encounter it. Where a product or service is used across a wide age range, the most essential information should be accessible to the youngest children likely to use it.

Language

Privacy information should be written in plain language suited to the age and reading level of the children who will encounter it. This includes:

• avoiding legal and technical terminology, or where unavoidable, explaining it in simple terms;
• keeping sentences and paragraphs short and direct; and
• ensuring that privacy information is available in both official languages.

Length

Organizations should keep the consent information concise and prioritize information that is most important for children to know.

Format

The format of privacy information should suit the nature of the product or service and the way children interact with it. Organizations should consider whether interactive or visual format, such as short videos, layered notices or illustrated summaries, would be more effective than text for the age group in question. Using visual aids, icons or examples can help younger children understand key concepts.

I think a lot of youth aren’t necessarily aware of the impacts and what it means [when their personal information is collected and used online]. Sometimes it can be fun to have an educational game [to help explain the concepts in an engaging way]. [It would be helpful to have] digestible information with good examples of real-life scenarios and cases. – Youth Roundtable Participant

Timing

Privacy information should be presented when it is most relevant to children. Organizations should:

• provide key information before or at the point of collection;
• present information about specific practices at the moment a child is about to engage with the relevant feature;
• provide reminders about data practices and consent choices when a product or service is updated in ways that affect children’s personal information; and
• ensure that information about how to exercise privacy rights is easy to locate at any time.

Correction and deletion

Relevant PIPEDA Principles: Consent; Accuracy, Limiting Use, Disclosure, and Retention

As children grow and develop, the personal information that they have shared can follow them in ways that adult users are less likely to experience. The information may be entered incorrectly, shared impulsively or it may simply no longer reflect who they are, and it can live online for a long time. Children should have practical means of correcting personal information that is inaccurate or incomplete as well as of deleting their personal information.

Requests

Organizations must provide children with simple and accessible mechanism to request the correction or deletion of personal information. It should be:

• easy to locate and initiate within the product or service;
• written in plain, age-appropriate language that a child can understand without assistance;
• accessible to all children regardless of ability, with accommodations available where needed to complete the request; and
• fulfilled promptly, with the child informed of the outcome

Organizations should also have internal guidelines and procedures in place for such requests.

 

 

Avoiding profiling

Relevant PIPEDA Principles: Consent; Limiting collection; Limiting use, disclosure, and retention

Profiling is the collection and use of personal information to assess or infer a person’s characteristics such as personal preferences, interests, behaviour, health and/or socio-economic status with the goal of informing practices such as marketing, automated-decision making and targeted messaging.^{Footnote 26} Profiling presents particular risks for children as they are especially susceptible to the influence of automated decision-making, sponsored advertising and targeted messaging.^{Footnote 27} For instance, personal information collected from children that undergoes automated-decision making to build profiles about them can shape their online experience and influence their choices and behaviours. Importantly, until late adolescence and early adulthood, children have not fully developed their ability for critical thinking, and they have a tendency for greater risk-taking behaviours. As a result, the use of these profiles to target children with advertising and personalized content exploits developmental vulnerabilities that children cannot reasonably be expected to recognize.

Profiling should only be used if an organization can clearly demonstrate that any use of automated decision-making is consistent with children’s best interests and is not driven by commercial or other inappropriate purposes described in the following subsections.

Profiling for marketing purposes

Organizations should avoid profiling children for marketing purposes.

Online behavioural advertising involves tracking individuals across website and over time to build profiles of inferred interests and deliver targeted advertising. Because it depends on sustained cross-site data collection, detailed profiles and often opaque algorithmic inferences, the privacy implications of this practice are significant for all users, and in particular children. Children cannot reasonably be expected to understand the scope of risks and consequences of these activities.

Children are vulnerable and susceptible to behavioural advertising due to difficulty distinguishing advertising from organic content, their heightened responsiveness to social validation, and their limited understanding of how their personal information will be used to influence them.^{Footnote 28} This means that marketing-driven profiling is rarely compatible with their best interests.

Organizations should not:

• use children’s personal information to deliver targeted or behavioural advertising to them;
• infer characteristics from children’s digital activities that can be used to target them commercially; or
• share children’s profile data with third parties for advertising or marketing purposes.

Profiling within AI

Special consideration should be provided to profiling within AI systems, given their significant impact on the current generation of children.^{Footnote 29} The development and use of these technologies must account for children’s vulnerabilities. AI services use recommender systems that engage in pervasive data collection and have the potential to exercise negative influence on children’s thoughts, feelings and behaviours.^{Footnote 30} Children should be able to benefit from AI technology safely and free from fear that they may be targeted, manipulated, or harmed.

AI technologies should not:

• encourage children to share additional personal information than that which is necessary for the running of their service; or
• infer characteristics from children’s activities on the system to make age-inappropriate recommendations or biased responses to queries.

Profiling for other inappropriate purposes

For any other purpose where organizations use automated systems to make or significantly inform decisions about children based on profiling, the best interest of the child should be the primary consideration. For example, content personalization could be used if it is necessary to provide the safest and most fulfilling experience for children with a sensory or intellectual disability or for compliant age verification strategies. However, it would not be in the best interests of children to use profiling for auto-suggestions of other services or products in hopes of extending their time on an app or for other harmful purposes. If profiling is necessary for the running of their service and shown to be in the best interests of the child, organizations should ensure that:

• children are informed, in clear and age-appropriate language, when automated decision-making is being used and what effects it may have on them;
• they explain how the profile was assembled and what personal information was used; and
• a PIA is conducted to show how the profiling mitigates risks to children.

Prohibited practices

Certain practices are incompatible with the protection of children’s privacy and their best interests. These practices cannot be justified by demonstrating a legitimate purpose, mitigated through enhanced safeguards or allowed by obtaining consent.

The OPC has previously identified data practices that a reasonable person would consider inappropriate under subsection 5(3) of PIPEDA, regardless of whether consent was obtained. Below are several examples of deceptive design and practices that introduce or amplify privacy harms that the OPC would consider to be inappropriate.

Deceptive design

Deceptive design patterns are used on websites and mobile apps to influence, manipulate, or coerce users to make decisions that are not in their best interests. This includes the exploitation of children’s psychological or behavioural characteristics through engagement mechanisms. Organizations must not use deceptive design patterns to deceive children into disclosing more personal information than they would otherwise choose to share or undermine their ability to exercise meaningful privacy choices.

The following subsections describe examples of deceptive design that organizations should not engage in.

Manipulative interface design

Organizations must not design interfaces that structurally disadvantage privacy protective choices. This includes:

• pre-selected options that default to maximum data sharing or broader consent than the service requires; and
• misleading labels or visual misdirection that cause children to misunderstand what they are agreeing to.

Manipulative consent processes

Organizations must not structure consent processes in ways that exploit children’s levels of understanding to obtain agreement that is not genuine. This includes artificial urgency, threat of loss or social pressure embedded in consent processes.

Consent obtained through any of these practices will not be considered as valid and cannot be relied upon by an organization to justify the collection, use or disclosure of a child’s personal information.

Exploitative engagement techniques

Organizations must not use engagement mechanisms as a vehicle for expanding data collection beyond what children would otherwise consent to. This includes:

• encouraging children to keep using a service through points, streaks^{Footnote 31} or in service rewards, specifically for the basis of data collection and profiling;
• leveraging social pressure or peer visibility to induce children to share personal information that they would not otherwise disclose; and
• deploying engagement systems that are optimized to extend data collection opportunities by increasing the time children spend on a platform, in particular where that optimization is not in the child’s best interests.

Data practices that introduce or amplify privacy harms

Not all privacy harms to children result from deliberate choices by organizations or from design features that are inherent to a product or service. Privacy harms can also arise from data practices that, regardless of intent, create conditions in which children’s personal information is exposed to risks that they may not understand or be able to anticipate.

Organizations should take particular care where their data practices rely on information about a child’s age, developmental stage, behaviour, emotional state or other characteristics to make decisions about how the child’s personal information is collected, used or disclosed. Organizations should not use such information to exploit a child’s vulnerabilities or to expand the collection or use of their personal information in ways that are inconsistent with their reasonable expectations or best interests.

Examples of practices that can introduce or amplify privacy harms include:

• creating consent processes that assume a level of maturity or understanding that a child does not have, including by presenting complex consent requests that the child cannot reasonably understand;
• generating inferences about sensitive characteristics that a child has not disclosed, including their health, mental or emotional state, sexual orientation, gender identity or family circumstances, based on behavioural, location or interaction data; and
• inferring a child’s emotional state from their behaviour, interactions or use of a product or service, particularly where those inferences are then used to influence the collection, use or disclosure of their personal information.

Exploiting developmental stage

Where an organization has sufficient information to reasonably conclude that a user is, or is likely to be, a child, it should apply privacy protections appropriate to the child’s age and developmental stage. Organizations should not use information about a child’s age, developmental stage or level of maturity to exploit their reduced capacity to understand or assess privacy risks.

This includes:

• using indicators of younger age or lower developmental maturity to expand or intensify the collection, use or disclosure of personal information;
• designing consent requests on the assumption that a child has a greater capacity to understand complex privacy implications than is reasonable given their age and developmental stage; and
• using information about a child’s developmental stage for commercial purposes unrelated to providing or improving the product or service, particularly where doing so could exploit the child’s vulnerabilities.

Emotional analytics

Organizations must not use children’s personal information to infer emotional states or vulnerabilities for the purpose of exploiting those vulnerabilities to obtain additional personal information or to encourage behaviours that may increase privacy risks. This includes:

• using inferred emotional states to prompt or manipulate a child into disclosing additional personal information^{Footnote 32}; and
• using personalization or recommendation systems driven by a child’s known or inferred emotional state to influence the child to provide consent or otherwise expand the scope of the collection, use or disclosure of their personal information.