Children’s Privacy Code – What you need to know about your privacy

This page is for young people and those who care for them. It shares information about our Children’s Privacy Code. We developed this Code to ensure that organizations, such as businesses, design products and services with the protection of young people in mind. The Code also helps organizations understand how to protect children and youth under Canadian privacy law.

You have a right to privacy. In fact, privacy is a fundamental right. The Code includes information about what organizations should do to respect that right, and what they should not do when they collect, use or share your personal information online.

Organizations are expected to:

1. Make sure you understand what you are consenting to. Organizations must make sure that they are asking if you are okay with what they are collecting and doing with your personal information before they collect it. They must ask in language that is understandable to you so that you can agree or not. This is called obtaining “meaningful consent”. They should also make sure that they are only asking you to agree to things that are necessary to use their website or app.
2. Do a privacy impact assessment. Organizations should have your privacy in mind. They should evaluate how their product or service can put you at risk and find solutions to keep you safe. 
3. Make high privacy settings the norm. Organizations should make sure that your privacy settings are safe from the start. Organizations should make it easy for you to find and change your privacy settings.
4. Limit how much data they collect about you. Organizations must only collect information about you that is necessary to use their website or app. For instance, for a video game, they might need to collect your username, but they likely do not need to collect your location. 
5. Be clear about what they do with your data. Organizations should explain plainly how they are collecting, using and sharing information about you. Organizations should share clear reminders about how they use your information and what you agreed to if they update their product or service.
6. Give you more control of your information. Organizations must let you fix information about you that is wrong and should let you delete information you no longer want to share. They should also make it easy for you to contact them about your personal information.
7. Avoid making profiles about you. Profiling is the collection and use of personal information to assume characteristics about a person, such as their personal preferences, interests, behaviours, health status, etc. It can sometimes be used to influence behaviour, such as with advertising. Organizations should avoid using your information for advertising or for profiling in ways that could be harmful to you. If an organization needs to make profiles about you, they need to make sure your safety comes first.

Organizations cannot:

1. Design things to confuse you. Organizations should not make it difficult for you to make good privacy choices, such as reviewing your privacy settings or limiting what you share. They should not encourage you to make poor privacy choices, either, such as making an “accept all cookies” button larger than the “decline” button so that you are more likely to click it. This is called “deceptive design”.
2. Manipulate you to share information about yourself. Organizations should not make you think that you need to agree to share more personal data than they need for you to use their website or app. This is another example of “deceptive design”. For instance, a gaming app should not make you upload your phone’s contacts to get rewards or points.
3. Take advantage of your age. Organizations should apply privacy protections appropriate to your age. They should not use information about your age to do things that could harm you, such as make consent or privacy settings very complicated when it would not be reasonable to understand for someone your age.
4. Take advantage of how you are feeling. Organizations should not make assumptions about how you are feeling to collect more information about you, to ask you to spend more time on their website or app, or to create profiles about you.

If you think that an organization has done something with your personal information that makes you feel unsafe, you can tell an adult you trust or contact the Office of the Privacy Commissioner of Canada for more information on how to stay protected.