On October 20, 2026, the Office of the Privacy Commissioner of Canada released its Children’s Privacy Code for organizations subject to PIPEDA that offer online services directed at, or likely to be accessed by, people under 18. The Code explains the regulator's interpretation of existing privacy obligations rather than introducing a new Act. Organizations are expected to account for children's evolving capacity, obtain parental consent for children under 13 and use explicit opt-in consent for non-essential data uses.
The guidance also calls for protective default settings, clear age-appropriate explanations, practical correction and deletion controls, and safeguards against profiling children for advertising or automated decisions. Businesses should review how their digital services identify younger users and document their approach to privacy risks. The Office is accepting comments until January 20, 2027 and may revise the Code after consultation.