On October 20, 2026, in Gatineau, Privacy Commissioner of Canada Philippe Dufresne launched Canada's first Children's Privacy Code and opened comments until January 20, 2027. Operators of websites and mobile apps directed at children in Canada, social and gaming platforms offering services to Canadian minors, adtech and marketing firms that profile Canadian children for targeted ads or AI decision-making, and edtech providers serving Canadian schools and families must map products that collect Canadian children's personal information against the Code's expectations and send comments to the OPC by January 20, 2027, or practices outside the Code can be treated as inconsistent with PIPEDA meaningful consent and appropriate purposes, leading to an investigation finding, recommendations, and a possible Federal Court application.
The October 20, 2026 news release sets the expectations: parental consent for children under 13 and opt-in consent for non-essential uses; privacy information that is clear and age-appropriate; a way to correct inaccurate information and an option to delete it; no profiling of children for marketing, including targeted or behavioural advertising, or for AI-driven decision-making; and privacy by default, with location tracking, profile visibility and third-party sharing off unless the user turns them on. Deceptive design that pushes a child to give more personal information than the service needs, or that exploits a vulnerability, is treated as incompatible with children's best interests. Comments go to [email protected]. The OPC says the text may be updated after the window. The Code is an OPC set of expectations. It is not Bill C-36 and it does not amend the Personal Information Protection and Electronic Documents Act (PIPEDA, SC 2000, c 5).
What does the Children's Privacy Code expect organizations to change?
It expects consent, notice, correction, a bar on marketing and AI profiling, privacy by default, and a bar on deceptive design, as practical expectations rather than as a new statute.
The text is the Children's Privacy Code linked from the release. The OPC built it with stakeholders from an earlier exploratory consultation and with its Youth Council of seven students aged 14 to 17, who also helped write a youth version. The release says the Code is similar in approach to codes in some European countries and American states. The expectations open for comment are the Canadian ones in the table.
| Expectation in the October 20, 2026 release | What to map |
|---|---|
| Parental consent under 13, opt-in for non-essential uses | Child collection flows and extra uses |
| Clear, age-appropriate privacy information | Notices shown to children and parents |
| Correction, and an option to delete | Paths to fix a record and to erase it |
| No profiling for marketing, behavioural ads, or AI decisions | Segments, models and automated decisions |
| Privacy by default: location, visibility, third-party sharing off | Defaults, including SDKs that share data |
| No deceptive design that extracts extra data | Prompts and patterns aimed at children |
Who must act on the Children's Privacy Code, and by when?
Operators of child-directed websites and apps in Canada, social and gaming platforms that offer services to Canadian minors, adtech and marketing firms that profile those children, and edtech providers that serve Canadian schools and families must file comments by January 20, 2027.
Exposure follows the market, not the place of incorporation: a platform or SDK provider outside Canada is in scope when the product is directed at Canadian children or profiles them. The Code is an OPC instrument under PIPEDA. This release does not amend Alberta's PIPA, British Columbia's PIPA or Quebec's Law 25.
What should privacy and product teams do before January 20, 2027?
They should test live products against the expectations in the release and send a written comment before the window closes.
- List every product, app, site and SDK that collects personal information from a person the service treats as a child in Canada.
- Mark parental consent for a child under 13, and any non-essential use that still runs on a default rather than an opt-in.
- Confirm that location tracking, profile visibility and third-party sharing start off.
- Identify profiling used for marketing, behavioural advertising or an AI-driven decision.
- Review patterns that ask a child for more personal information than the service needs, and confirm a child or a parent can correct a record and delete it.
- Send comments to [email protected] before January 20, 2027. The OPC says the Code may be updated after the window.
What happens if a practice sits outside the Children's Privacy Code?
The OPC can treat a practice outside the Code as inconsistent with PIPEDA meaningful consent and appropriate purposes, and can move from a finding and recommendations to a Federal Court application.
The October 20, 2026 release does not publish a new fine schedule. The consequence of this consultation is an investigation under PIPEDA, recommendations, and a possible Federal Court application. A comment filed by January 20, 2027 is the route the OPC has given to shape the text before that update. Continuous, per-jurisdiction monitoring surfaces an OPC code of this kind the day the release is published, so privacy counsel sees the comment window with the expectations.
Before January 20, 2027, confirm whether any live product collects personal information from Canadian children, map it to the table, and brief privacy, product and adtech owners. File the comment to [email protected] if the mapping shows a gap, and watch for the OPC update after the window.
