Canada’s Office of the Privacy Commissioner (OPC) on Tuesday banned behavioral advertising targeting children and ordered platforms to reconfigure their default privacy settings to maximum protection — the most commercially disruptive provisions in the country’s first-ever Children’s Privacy Code, which Privacy Commissioner Philippe Dufresne formally launched October 20, 2026, in Gatineau, Quebec. The Code reaches every organization that collects, uses, or discloses personal information belonging to minors under Canada’s federal privacy law, covering platforms, app developers, game publishers, and any digital service accessible to children.

The Code is issued as guidance under Canada’s existing federal privacy statute, not as legislation — meaning no automatic fines attach to non-compliance today. But the document is widely understood by legal observers to be a platform for Bill C-36, the PPCDA, tabled by the federal government on June 15, 2026, which would replace the current statute and impose financial penalties of up to CAD $10 million (approximately $7.1 million USD) or 3 percent of gross global revenues for standard violations, and up to CAD $25 million (approximately $17.7 million USD) or 5 percent of gross global revenues for the most serious offenses. For advertising-dependent platforms that have long profiled Canadian minors alongside adult users, the Code draws a line the OPC expects them to start moving toward now — before Parliament makes crossing it expensive.

What Canada’s Children’s Privacy Code Requires Platforms to Do

The Code establishes six categories of obligations for any organization handling children’s personal data under Canada’s baseline privacy statute, PIPEDA — Canada’s federal private-sector privacy law, which until now contained no specific provisions for minors.

Verifiable parental consent for children under 13. For any child under the age of 13, organizations must obtain verifiable parental or guardian consent before collecting or processing that child’s personal information. For minors 13 and older, the Code requires opt-in consent for any data uses beyond what is strictly necessary for the service being offered. The age-13 threshold formalizes how the OPC has historically interpreted PIPEDA, but embedding it in a dedicated children’s code is itself a structural shift — it signals how Dufresne intends to interpret PIPEDA compliance going forward and provides a specific framework for the enforcement actions the OPC can bring through the Federal Court.

Age-appropriate communications. Privacy notices and consent flows must be written in language tailored to the developmental level of the audience. Terms-of-service documents that run thousands of words in legal language fail the Code’s standard.

Ban on behavioral advertising and AI profiling of minors. The Code explicitly prohibits profiling children for marketing purposes — including targeted and behavioral advertising — and bans the use of children’s personal data to drive AI-powered decisions about them. This is among the most commercially significant provisions: behavioral advertising toward minors has been a largely unchecked revenue stream for advertising-dependent platforms operating in Canada. A 2025 Global Privacy Enforcement Network (GPEN) sweep of 879 websites and apps found behavioral profiling occurring alongside self-harm content in 60 percent of reviewed platforms, and 72 percent bypassed age controls without verification.

Privacy by default. Location tracking, profile visibility, and third-party data sharing must all default to off. Users must affirmatively enable data collection, not affirmatively disable it. This inverts a longstanding industry practice in which the most data-extractive settings ship as factory defaults, capturing users — particularly younger ones — who never change what they did not know existed.

No dark patterns. Websites and mobile apps cannot use manipulative interface techniques — a design category known as dark patterns, a term coined by UX researcher Harry Brignull in 2010 — to pressure children into sharing more data than necessary or into weakening their own privacy protections. The Code specifically prohibits designs that “influence, manipulate, or coerce” minors, as well as any data practice that exploits children’s psychological vulnerabilities.

Rights to correct and delete. Children must have a practical path to correct inaccurate personal information and to delete their data entirely — a provision the Code frames as particularly important as minors grow older and evolve and their identities and views change.

Behavioral Ad Ban Targets Industry’s Most Profitable Child-Data Practice

The prohibition on behavioral advertising toward children is the provision platforms will feel most immediately in their revenue models. Behavioral advertising — the system of tracking users across sites and services to build profiles that inform targeted ad placement — is the engine behind the business models of every major social media platform. Canadian minors have been part of that engine.

An OPC investigation of TikTok, conducted jointly with the privacy regulators of Quebec, British Columbia, and Alberta and concluded in September 2025, found that approximately 500,000 underage accounts were banned by TikTok annually — a figure that demonstrates the platform’s age controls were failing at scale, not just at the margins. The platform relied on self-declared birthdays as its primary age gate; users who stated an age under 13 at signup were rejected, but the investigation found that weak verification meant many underage users simply entered a false birthdate and proceeded. The OPC found that TikTok’s data collection practices, including collection of biometric data, violated PIPEDA, and that Quebec’s default-privacy requirements had also been contravened.

The 2025 GPEN sweep reinforced how widespread the problem was beyond any single platform: 35 percent of 879 platforms reviewed contained content inappropriate for minors, and behavioral advertising systems were operating alongside that content without age-based restrictions in the majority of reviewed cases.

For platforms whose Canadian revenue depends on advertising served to all users regardless of age, the Code’s behavioral advertising ban imposes a structural obligation: implement age-differentiated ad systems, or stop serving behavioral ads to the Canadian user base in its entirety.

How Platforms Are Expected to Know Who’s a Child — and What That Costs Every User

Enforcing any age-based rule requires platforms to know, with some confidence, how old their users are. Canada’s Children’s Privacy Code does not specify a technical standard for age verification, but the OPC’s age assurance guidance — released by Dufresne at Privacy Awareness Week in May 2026 — addresses the question directly.

This is where the Code’s protections for children create a risk for adults. Every major method of age verification currently in commercial use involves collecting identity data from users to confirm their age — and that data collection applies to all users, not just minors.

Five primary age verification methods and their documented tradeoffs are: self-declaration (no data collected, no protection provided); credit-card-based verification (confirms a cardholder, not an age, and excludes unbanked users); government ID submission (high assurance, high privacy cost — collects document images); biometric or facial estimation (captures biometric data; accuracy gaps documented across demographic groups); and zero-knowledge proofs or attribute-based verification (a cryptographic method in which an identity provider confirms “user is over 13” to the platform without transmitting the underlying identity document).

The privacy-preserving alternative — zero-knowledge proof verification — is technically viable but not yet widely deployed at consumer scale. The OPC’s age assurance guidance specifically identifies it as a preferred approach where feasible, precisely because it can confirm an age-related attribute without exposing the underlying identity data.

The concern is not theoretical. Age verification companies themselves have become targets. In 2024, AU10TIX suffered a data breach — a major provider whose clients include TikTok, Uber, and X — that exposed driver’s licenses and other identity documents belonging to users who had submitted them for age verification. In 2025, Discord’s identity vendor Zendesk was breached, exposing approximately 70,000 ID photos submitted by users completing age verification for the gaming platform. Platforms that implement age verification in response to children’s privacy obligations are creating centralized repositories of identity documents that are attractive to attackers.

The U.S. Supreme Court upheld Texas’s age verification law in Free Speech Coalition v. Paxton by a 6-3 vote in 2025, establishing that age verification requirements on platforms are constitutionally permissible under a standard the Court described as one that only “incidentally burdens protected speech of adults.” But the dissent — authored by Justice Elena Kagan and joined by Justices Sotomayor and Jackson — argued that requiring adults to submit identity documents to access legal content imposes a concrete, ongoing chilling effect on First Amendment expression. Canada’s constitutional framework differs from the United States’, but the underlying tension — between protecting children and imposing surveillance infrastructure on every adult user of a platform — is the same.

For every organization that the Code covers: complying with the behavioral advertising ban and the consent requirements for minors effectively requires knowing which users are minors. The Code’s privacy-protecting obligations and its age-verification implications pull in opposite directions. The OPC’s preference for privacy-preserving age assurance is clear; Parliament’s willingness to require it specifically, or to prohibit identity-based alternatives, will depend on how Bill C-36 is written.

Three Years in the Making: How Canada Built Its First Children’s Privacy Code

The Code’s launch on Tuesday is the culmination of a process Dufresne began formally in May 2025, when he announced the consultation at IAPP Toronto on a potential children’s privacy framework at the IAPP Canada Privacy Symposium. The OPC ran that consultation from May through August 2025, receiving 37 submissions and four roundtables — including one held directly with youth.

Dufresne, who took office as Privacy Commissioner in 2022, listed advancing children’s privacy as one of his three strategic priorities from the start — alongside updating Canada’s privacy framework and promoting privacy as an economic enabler. His track record on the first priority is substantial: he opened a joint investigation into OpenAI’s data collection and use of personal information in March 2024, co-investigated with the Quebec, Alberta, and British Columbia privacy regulators, and has repeatedly advocated for OPC order-making and penalty powers — the kind of enforcement authority the Federal Court pathway cannot currently provide on its own.

At Privacy Awareness Week in May 2026, Dufresne announced the Code was under active development and simultaneously released the age assurance guidance — a signal that the OPC was treating age verification as part of the same policy cluster as children’s data protection, not a separate administrative matter.

The Code was developed collaboratively with the OPC’s own Youth Council — a panel of seven students aged 14 to 17, drawn from across the country — who helped shape both the main document and a simplified, youth-friendly version released alongside the Code Tuesday. The Council’s statement at the launch was direct: “Shaping the Children’s Privacy Code has allowed us to centre young people’s perspectives and priorities and empower youth to take charge of their online experiences.”

Young Canadians’ own stated concerns, surfaced in focus groups and a Youth Summit conducted during the development process, drove several of the Code’s specific provisions. Commissioner Dufresne identified three primary concerns reported by youth: a lack of control, lack of choice, and lack of age-appropriate information about how their data was being used.

How Canada’s Code Compares to the UK and California Frameworks

Canada is not building from scratch. The most significant international template is the United Kingdom’s Age Appropriate Design Code — also called the UK Children’s Code — which the UK Information Commissioner’s Office (ICO) brought UK Children’s Code into force on September 2, 2020. The UK code applies to providers of online products and services accessible to children, including websites, apps, games, and connected devices, and requires them to prioritize children’s best interests, apply default-high privacy settings, and provide age-appropriate privacy information. The UK ICO can impose fines of up to £17 million (approximately $21.4 million USD) or 4 percent of global annual turnover for violations.

California enacted its Design Code Act in 2022, with requirements taking effect in 2024 — a law explicitly modeled on the UK framework and the first U.S. state statute to impose UK-style children’s design code obligations. Several other U.S. states have since enacted children’s online safety legislation with overlapping requirements, creating a patchwork of state-level rules that platforms with U.S. operations must navigate alongside Canada’s federal standard.

Canada’s Code draws on both models, though legal observers note it is not a direct copy of either. The country’s federal structure adds complexity absent from the UK and California frameworks: Quebec has already enacted its own children’s privacy provisions through provincial legislation, and the OPC’s federal guidance applies only to private-sector organizations under PIPEDA — it does not reach provincially regulated sectors, meaning federally regulated entities and provincially regulated ones may face different standards.

On the international stage, Dufresne participated in a G7 Data Protection and Privacy Authorities roundtable in June 2026, at which the group specifically discussed strengthening international regulatory cooperation to protect children online. He has also participated in an OECD high-level roundtable on the same subject, co-organized by France’s CNIL. The Canadian Code is part of a coordinated global realignment, not an isolated national initiative.

What the Code Cannot Do Without Parliament: The Enforcement Question

The Children’s Privacy Code’s most significant limitation is also its most important context: it is guidance under PIPEDA, not legislation. That distinction has immediate practical consequences.

When the OPC receives a complaint or conducts an investigation under PIPEDA, the Commissioner can issue findings and recommendations — but cannot issue binding orders or impose financial penalties directly. If an organization refuses to comply with the OPC’s recommendations, the Commissioner’s remedy is to refer the matter to Federal Court, a process that can take years and requires the court, not the Commissioner, to order any corrective action. For an organization calculating whether to comply with the Code’s behavioral advertising ban, the absence of immediate financial consequences is a relevant variable.

The Canadian Bar Association, in its submission to the OPC’s exploratory consultation in 2025, put the problem plainly: guidance under PIPEDA cannot adequately achieve consistency across Canada or meet Canada’s enforcement obligations under the UN Convention on the Rights of the Child, and specific legislative provisions within new or existing laws are the appropriate vehicle for this reform.

The 5Rights Foundation, a children’s digital rights organization that has engaged extensively with the OPC throughout the Code’s development, welcomed Tuesday’s announcement but drew the same line. In a response to the launch, the group argued that Canada’s newly elected federal government must translate Code principles into law — making the protection of children’s digital rights a national legislative priority rather than a regulatory aspiration.

The legislative vehicle is Bill C-36, the Protecting Privacy and Consumer Data Act, tabled on June 15, 2026. C-36 would replace PIPEDA with a modernized privacy statute that includes administrative monetary penalties (AMPs) of up to CAD $10 million (approximately $7.1 million USD) or 3 percent of gross global revenues, and penal fines of up to CAD $25 million (approximately $17.7 million USD) or 5 percent of gross global revenues for the most serious violations. A companion bill, Bill C-34 (the Digital Safety Act), would further ban social media for users under 16 and require age-appropriate design standards specifically for social media platforms and AI chatbot services.

A predecessor bill, C-27, died on the order paper before the most recent federal election. Whether the new Parliament will move C-36 and C-34 through committee and to a vote on any particular timeline is uncertain. The Children’s Privacy Code may become a pressure point in that debate — Dufresne has been explicit that the OPC needs order-making and penalty powers to be an effective regulator, and Tuesday’s launch gives the Code’s principles a public record to which legislative debate can be anchored.

What Platforms Must Do — and by When

Pending legislation, organizations that operate platforms, apps, or digital services accessible to Canadian children now face a clear OPC expectation: begin aligning data practices with the Code’s six requirements.

The OPC is accepting public comment until January 2027, after which the document may be revised. Organizations can submit feedback by email to cpvp-opcconsultation1@priv.gc.ca. The consultation deadline is not a compliance deadline — the Code is in effect as the OPC’s interpretation of PIPEDA obligations now — but the comment period provides a formal channel for industry to raise implementation questions and flag technical challenges before the Code’s standards are potentially incorporated into Bill C-36.

For legal purposes, the Code signals how Dufresne will frame investigations and enforcement referrals to Federal Court. Organizations that can demonstrate they reviewed the Code, identified applicable provisions, and made good-faith implementation efforts are in a materially different position than organizations that treat the Code as irrelevant until legislation passes.

The practical starting point for most platforms is a data audit: mapping what personal information they collect from users who may be minors, what purposes that data currently serves (including behavioral advertising systems), what consent mechanisms are in place, and what default settings govern data-sharing. The Code’s requirement that all privacy-relevant settings default to off — covering location data, profile visibility, and third-party sharing — requires changes to product architecture, not just policy language.

(Exchange rate as of October 20, 2026; conversions are approximate.)

Frequently Asked Questions

Does Canada’s Children’s Privacy Code carry any penalties if platforms ignore it?

Not directly, not yet. The Code is OPC guidance issued under PIPEDA — the federal privacy statute — not a standalone law with automatic financial penalties. The OPC can investigate complaints and issue findings and recommendations, but enforcing those recommendations requires a referral to Federal Court if an organization refuses to comply. The proposed replacement statute, Bill C-36, would change that: it would establish the Digital Safety and Data Protection Commission of Canada (DSDPC) — a new body that replaces the OPC for private-sector enforcement and can impose administrative monetary penalties of up to CAD $10 million (approximately $7.1 million USD) or 3 percent of gross global revenues, and refer the most serious cases for penal fines of up to CAD $25 million (approximately $17.7 million USD). C-36 has been tabled but not yet passed. The Code is designed to operate now and slot into that enforcement architecture when Parliament acts.

What does the behavioral advertising ban actually require platforms to change about how they serve ads?

Platforms that currently run behavioral advertising — tracking-based, profile-driven targeted ad placement — to all Canadian users without distinguishing by age must either build an age-differentiated system that excludes minors from behavioral profiling, or stop serving behavioral ads to Canadian users altogether. The Code does not ban advertising to children; it bans targeted advertising that relies on children’s personal data to build profiles and make placements. Contextual advertising remains permitted — ads served based on the content of the page or app a user is viewing, rather than a profile built from tracking data.

I’m an adult using a Canadian platform. What does the Children’s Privacy Code change for me?

Directly, very little — the Code’s obligations run to organizations, not to adult users, and its specific protections apply to minors. But there is an indirect effect worth understanding: any platform that implements age verification to comply with the Code’s consent and behavioral advertising requirements will likely collect identity data from all users to determine who is a minor — not just from users who identify as children. The verification infrastructure is applied universally, and the third-party companies that provide age verification services have experienced data breaches exposing users’ identity documents. The OPC’s age assurance guidance specifically recommends privacy-preserving age verification methods — zero-knowledge proof systems that confirm an age attribute without transmitting identity documents — over identity-document-based approaches, per OPC guidance. Whether platforms follow that recommendation, or Parliament mandates it, will determine what compliance costs adult Canadians in terms of identity data exposure.

How does Canada’s Code differ from the UK’s Children’s Code, which has been in force since 2020?

Both require default-on privacy settings, ban behavioral advertising targeting minors, and demand age-appropriate design. The structural difference is enforcement: the UK ICO can impose fines directly — up to £17 million (approximately $21.4 million USD) or 4 percent of global annual turnover — without going through a court. Canada’s OPC currently lacks that power. The UK code also applies to a broader set of services (connected devices, streaming services, online games) with a single national legal framework, while Canada’s federally regulated services fall under PIPEDA and provincially regulated services fall under provincial law — meaning organizations with both federally and provincially regulated operations face overlapping requirements.