Help us make digital spaces safe for children and young people.
Canada introduces landmark Children’s Privacy Code, but gaps in accountability remain
The Canadian Children’s Privacy Code marks a significant step towards protecting children’s rights and privacy in the digital world. While the Code sets out strong expectations for digital services, its limited enforceability highlights the need for further action.
In 2024, the Office of the Privacy Commissioner of Canada (OPC) found that 99% of websites and apps embed manipulative design to maximize engagement by exploiting children’s developmental vulnerabilities. As a result of widespread commercial exploitation, invasive profiling, and relentless data harvesting, regulators across five continents under the OPC’s leadership found earlier this year that children face greater privacy risks today than a decade ago.
Building on international best practices, the OPC has taken a decisive step to address tech companies’ failure to design with children in mind by launching its landmark Children’s Privacy Code. Following years of 5Rights engagement, including leading a joint submission with more than 40 Canadian experts and organisations to call for comprehensive protections against the commercialisation of children’s data, the Code sets out how tech companies are expected to fulfil their duty to respect children’s privacy.
Welcoming the Code’s introduction, 5Rights Head of International Affairs Marie-Ève Nadeau said:
“Building on best practices such as the UK’s Age-Appropriate Design Code or Brazil’s ECA Digital, the Code sets a high bar to hold tech companies accountable for children’s privacy. Canada now has an opportunity to build on this milestone by requiring tech companies to design with children’ privacy, safety and rights from the outset.”
What the Code gets right
The Code reflects global progress towards several priorities raised in 5Rights advocacy, including data minimisation, high privacy settings by default and safeguards against harmful profiling and manipulative design.
Reflecting the global consensus that children’s privacy should be protected through the design of digital services rather than left to children to manage themselves, the Code applies to all digital products and services likely to be accessed by children — not just those specifically designed for them.
What’s still missing
While the Code provides regulatory guidance on how existing privacy legislation should be applied to children’s data, it cannot introduce new binding requirements.
Digital Futures for Children centre research demonstrates that when laws are not robustly enforced, tech companies revert by-design changes and instead dodge accountability by implementing cosmetic changes.
Five years after the adoption of UNCRC General comment No. 25, Canada has taken a key step in ensuring its meaningful implementation and contributing to international best practice. To fully deliver on the obligation to protect children’s rights in the digital world, Canadian policymakers must now adopt stronger, enforceable laws that allow children to explore, connect and learn online without surrendering to commercial exploitation.
