On October 20 the Office of the Privacy Commissioner of Canada launched a Children's Privacy Code, setting out what it calls clear, practical expectations for organizations that handle children's personal information. It reads like a story about social platforms. It is not, and the businesses most likely to be caught out by it are the ones that would never describe themselves as handling children's data.
What the Code expects
- Meaningful consent, including parental consent for children under 13 and opt-in consent for non-essential uses of the data.
- Transparency suited to the child's age. Privacy information should be clear and accessible to the person it concerns, which rules out pointing a twelve-year-old at your standard privacy policy.
- Control. Children should have a practical way to correct inaccurate or incomplete information and, as they mature, the option to delete it entirely.
- No profiling for marketing. Organizations should avoid profiling children for marketing, including targeted or behavioural advertising, and for AI-driven decision-making.
- Privacy by default. Settings like location tracking, profile visibility and third-party data sharing should be automatically off.
- No deceptive design, meaning no interface pressure to hand over more information than is needed, and no using children's information to exploit their vulnerabilities.
Status, stated plainly
This is a code of expectations, not a regulation with a compliance date. The OPC describes it as helping organizations understand how to protect children under existing Canadian privacy law, and it is open for comment until January 20, 2027, after which it may be updated. Some coverage has described it as a ban on behavioural advertising to children, which overstates what a code does. The accurate read is that the regulator has now written down how it interprets existing obligations when the data subject is a child, which is what it will measure you against if a complaint arrives.
Who this actually applies to
Think about which small businesses hold information about children. Tutoring and test-prep services. Dance, music and martial arts schools. Hockey and soccer clubs. Summer camps. Daycares. Children's clothing and toy retailers. Pediatric, dental and orthodontic practices. Children's photographers. Any of these runs a booking or registration system holding names, birthdates, addresses, medical notes, sometimes photographs, and almost none of them have examined it against a privacy standard.
Two specific collisions are worth naming. First, the profiling expectation and your advertising pixels. If your site serves families and you run Meta or Google remarketing, you are building audiences from behaviour that includes children's activity. Second, photographs. Recital videos, team photos and camp galleries posted to social media are a collection, use and disclosure of a child's personal information, and the consent you have for them is usually a line on a form signed years ago.
What to actually do
- Work out whether you hold children's data at all. Registration forms, medical notes, emergency contacts, photo galleries. Write the list down.
- Fix the consent to be explicit for under-13s, obtained from a parent or guardian, and separate from the general terms. One checkbox covering everything is the pattern the Code pushes against.
- Separate the nice-to-have uses. Running the program is essential. Putting a child's photo in next year's marketing is not, and it needs its own opt-in.
- Review your remarketing. Decide whether behavioural advertising belongs on pages aimed at families. This is the item most likely to require an actual decision rather than a form change.
- Turn the defaults off. If your booking platform shares data with third parties or exposes profiles by default, change it.
- Set a retention period. Most of these businesses hold records for children who left years ago. Decide how long, then delete, which is the discipline in records retention.
- Write a short, readable notice a parent and a teenager could both follow. Two paragraphs beats two pages.
The takeaway
Nothing here demands a legal department. It asks you to know what you hold about children, to get consent that is real rather than bundled, to stop advertising at them, and to delete what you no longer need. Businesses serving families will find most of the work is in the booking system and the marketing pixels, and both are fixable this month while the Code is still in consultation rather than after it hardens.