The OPC Children's Privacy Code: what it expects

On October 20, 2026, Privacy Commissioner of Canada Philippe Dufresne launched Canada's first Children's Privacy Code. The document sets out what the Office of the Privacy Commissioner (OPC) expects from organisations whose online services are directed at children or likely to be accessed by them: parental consent under 13, the most protective settings by default, no behavioural advertising. The OPC is accepting comments until January 20, 2027.

What the sources say

The Code's status. It is not a new law. The Code "builds on" the Personal Information Protection and Electronic Documents Act (PIPEDA) "by interpreting how its protections apply to children", and it "reflects the OPC's views on organizations' obligations under PIPEDA with respect to children's privacy". The obligations remain PIPEDA's; the Code says how the OPC reads them when a child is involved. It was developed after an exploratory consultation and with the OPC Youth Council, made up of 7 students aged 14 to 17.

Who is covered. Any organisation subject to PIPEDA that collects, uses or discloses personal information in a commercial activity involving an online service (website, application, platform, digital tool) that is directed at children or likely to be accessed by them. All children under 18 are covered. The Code applies even when children are not the intended audience, and an organisation that concludes otherwise "should document the decision and the reasons for it."

Consent. Under 13, in all but exceptional circumstances, consent comes from a parent or guardian. From 13 to 18, the organisation assesses whether the child understands what they are consenting to, particularly for sensitive information. Non-essential uses require express opt-in consent, with a separate choice for each. Consent cannot be inferred from inaction or continued use, declining must not degrade the core service, and withdrawing must be as easy as giving.

Defaults. The most protective setting, unless there is a compelling, documented reason: location off, profile private and not indexed by search engines, third-party sharing off, profiling off.

Minimisation, transparency, correction. Collect only what is necessary, feature by feature; set retention periods; explain in plain, age-appropriate language, in both official languages; offer a simple way to correct or delete. A privacy impact assessment (PIA) is strongly encouraged before launching or changing a higher-risk service.

Profiling and prohibited practices. Organisations should not use children's information to deliver targeted or behavioural advertising to them, or share their profile data with third parties for marketing. Finally, the Code lists practices that "cannot be justified by demonstrating a legitimate purpose, mitigated through enhanced safeguards or allowed by obtaining consent": deceptive design, manipulative consent processes (consent obtained that way is not valid), engagement mechanisms such as streaks used to expand collection, and inferring a child's emotional state to obtain more information. The OPC ties them to subsection 5(3) of PIPEDA.

Why it matters

The "likely to be accessed by children" test widens the scope considerably: games, social media, education tools, and also general audience services that teenagers use. Not targeting children is no longer enough; you have to have assessed it and written it down.

Quebec is different. According to the OPC, organisations subject to a substantially similar provincial law, such as Quebec's, are generally exempt from PIPEDA for what happens within the province, but personal information that crosses provincial or national borders remains subject to PIPEDA. Quebec's Act respecting the protection of personal information in the private sector sets the threshold at 14. Its section 4.1 provides that personal information about a minor under 14 "ne peuvent être recueillis auprès de celui-ci sans le consentement du titulaire de l'autorité parentale ou du tuteur, sauf lorsque cette collecte est manifestement au bénéfice de ce mineur" (cannot be collected from the minor without the consent of the person having parental authority or the tutor, unless clearly for the minor's benefit). Section 14 gives consent for a minor under 14 to the person having parental authority or the tutor. Section 9.1 already requires that a technological product or service offered to the public have its privacy settings at the highest level by default, cookies excepted. The Code itself cites these 3 sections as an example of provinces moving in the same direction.

A Quebec business that also serves users elsewhere in Canada therefore faces 2 thresholds: 14 under Quebec law, 13 in the federal Code.

What we think at Sentrix

1. Run and document the "likely to be accessed" test. Research on your users, advertisers, content that appeals to children, comparable services: record the conclusion and its reasons, even when it is negative. That decision belongs in your PIPEDA program.
2. Use the stricter threshold. If you serve Quebec and cannot tell where a user is, apply 14 everywhere. One rule is easier to maintain and satisfies both regimes, see our Law 25 page.
3. Inventory your defaults. Location, profile visibility, indexing, third-party sharing, profiling: each one off at the start, or justified in writing.
4. Separate the essential from the optional. For each feature, list the information needed for the core service, then offer a separate choice for the rest. Declining must not break anything.
5. Turn off behavioural advertising on children's accounts. Review ad tags and the agreements with third parties that receive profiles.
6. Run a PIA before your next launch. The Code lists what it should cover: the necessity of each collection, age-appropriate consent, retention, safeguards, profiling. Our article on the privacy impact assessment describes the process.
7. Reread your consent flows. Pre-selected options, misleading labels, artificial urgency: the Code names them, and consent obtained that way is worthless.

The next step

List your online services and note, for each one, whether children are likely to access it, which age threshold applies and which settings are on by default. The empty cells are your priorities before January 20, 2027. If you want to do this exercise with us, contact us.