Canada's Privacy Commissioner publishes a non-binding Children's Privacy Code that expects organisations to avoid profiling children for AI decisions

Key takeaways

• The Code is open for comment until 20 January 2027, after which the OPC says it may be updated.
• It interprets existing PIPEDA obligations for children; the OPC release does not describe a new statute, fine or penalty.
• On AI, the release says organisations are expected to avoid profiling children "for the purposes of AI-driven decision-making".
• The Code also says privacy settings such as location tracking and profile visibility should be off by default.

What did the Privacy Commissioner launch, and is it binding?

On 20 October 2026 Commissioner Philippe Dufresne launched what the OPC calls Canada's first Children's Privacy Code. The release says the Code sets out "clear, practical expectations" for organisations that handle children's personal information and helps them understand how to protect children under Canadian privacy law.

It is not a new statute. The Code's executive summary says it builds on the Personal Information Protection and Electronic Documents Act (PIPEDA) by interpreting how its protections apply to children, and its statutory framework section says it reflects the OPC's views on organisations' obligations under PIPEDA. The OPC is accepting comments until 20 January 2027, "after which the document may be updated". The release says it was developed with input from an exploratory consultation and with the OPC Youth Council, seven students aged 14 to 17. The Code covers children under 18. It says it will be complemented over time by more targeted guidance for specific sectors or risk areas. The release and Code state no penalty or effective date.

What does the Code expect on consent, defaults and correction?

The release lists the expectations. Organisations are expected to obtain meaningful consent, "including parental consent for those under 13, and opt-in consent for non-essential data uses". They are also expected to communicate privacy information in a clear, age-appropriate way and to give children a practical means of correcting inaccurate or incomplete information, as well as the option to delete it entirely. The release adds that privacy by default means settings such as location tracking, profile visibility and third-party data sharing are automatically off.

The Code goes further than the release. For children under 13 it says consent from a parent or guardian should be obtained in all but exceptional circumstances, and that exceptions should be narrow and clearly defined. For ages 13 to 18 it says organisations should assess whether the child has enough capacity to understand what they are consenting to. It also says organisations are strongly encouraged to conduct a privacy impact assessment, particularly for higher-risk products or services. Our article on Quebec Law 25 covers a separate provincial rule on automated decisions.

What does the Code say about profiling and AI?

The AI element is narrow but specific. The release says organisations are expected to "Avoid profiling children for marketing purposes, including targeted or behavioural advertising, or for the purposes of AI-driven decision-making". The Code's "Summary of expectations" states the position that organisations should not use children's personal information to build profiles on them or for purposes that could harm them. Where profiling informs automated decisions about children, it says, the best interests of the child should be the primary consideration.

A subsection headed "Profiling within AI" asks for special consideration of profiling within AI systems and says AI technologies should not encourage children to share more personal information than the service needs, or infer characteristics from children's activity to make age-inappropriate recommendations or biased responses. The Code also says profiling should be off by default unless the child has explicitly opted in and it is in the child's best interest. That exception does not cover marketing: under "Profiling for marketing purposes" the Code says organisations should avoid profiling children for marketing and should not use children's personal information to deliver targeted or behavioural advertising, infer characteristics from their activity that can be used to target them commercially, or share their profile data with third parties for advertising or marketing. It adds that profiling should only be used if the organisation can clearly demonstrate that any use of automated decision-making is consistent with children's best interests and is not driven by commercial or other inappropriate purposes. If profiling is necessary to run a service and shown to be in the child's best interests, the Code says organisations should tell children in clear language when automated decision-making is used, explain how the profile was assembled and conduct a privacy impact assessment. In our reading, the Code treats AI profiling as one application of a wider rule on profiling, not as a separate AI regime. For adult-facing automated decisions see our piece on the OPC submission on federal privacy law reform.

What does it say about deceptive design and other limits?

The release says the Code describes certain data practices as fundamentally incompatible with children's best interests, which "would be considered inappropriate". As an example it says websites and mobile apps cannot use deceptive design practices to influence, manipulate or coerce children into providing more personal information than they need, or use children's information to exploit their vulnerabilities. The Code's prohibited-practices section says such practices cannot be justified by a legitimate purpose, enhanced safeguards or consent. It also lists emotional analytics: it says organisations are not to use children's personal information to infer emotional states or vulnerabilities in order to exploit them to obtain more personal information. Some passages use firmer wording than the release, but the Code as a whole is framed as the OPC's interpretation of PIPEDA, and we found no statement of an enforcement consequence.

What should operators serving Canadian minors do now?

Treat the Code as the OPC's stated view of what it will expect, and decide whether to comment before 20 January 2027.

• List every feature that profiles, personalises or recommends content to users who are, or may be, under 18, including AI-driven ones, and note what personal information each uses.
• Check defaults for location, profile visibility and third-party sharing against the Code's default-off position, and record the reason for any less protective default.
• Review consent flows for under-13 users (parental consent) and for non-essential uses (opt-in).
• Review interface choices that nudge children to disclose more, against the Code's deceptive-design section.
• Consider a privacy impact assessment for higher-risk services, which the Code strongly encourages.

Which dates and thresholds does the Code set?

The release and Code give the following dates and age thresholds. No penalty or effective date is stated.

What we did not verify

What we opened: the OPC news release of 20 October 2026 and the full text of the Children's privacy code page on the OPC website, both on 2026-10-25.

What we did not open: the youth-friendly version, the exploratory consultation record, the footnoted sources, the "directed at children" and "likely to be accessed by children" indicator lists in detail, and any OPC statement on enforcement. We did not compare the Code with the UK, Irish or Australian codes it cites.

What we refuse to claim: that the Code is binding law, that non-compliance carries a stated penalty, that it has an effective date, or how the OPC would apply it in an investigation.

Related briefings

• AI Regulation News hub
• North America AI regulation tracker
• Quebec Law 25 and automated decision transparency
• OPC submission on Privacy Act modernization and automated decisions
• OPC guidance on third-party providers and AI training data diligence
• Iowa SF 2417 on conversational AI services and minors