Canada’s Children’s Privacy Code Changes App Design
Matthew Leo · Published October 23, 2026 · Canada Tech
Canada’s privacy regulators have given online services a much clearer design brief when children are likely to use them: collect less, explain more and start with the safest settings.
The Office of the Privacy Commissioner of Canada published the country’s first Children’s Privacy Code on October 20. The code turns existing privacy principles into practical expectations for websites, apps, games and connected services used by people under 18.
It is important to describe the change precisely. This is guidance under existing Canadian privacy law, including the Personal Information Protection and Electronic Documents Act, rather than a new statute passed by Parliament. Even so, it gives organizations, parents and young users a much more concrete benchmark for what responsible design should look like.
High privacy should be the starting point
The code says services should use high-privacy settings by default. A child’s precise location, public profile and other non-essential sharing should not be switched on simply because that choice benefits the platform.
Organizations are also expected to limit collection to information that is necessary for the service and to delete data when it is no longer required. The code calls for meaningful consent, with parental consent generally required for children under 13, and for information to be written in language appropriate to a user’s age.
That changes the product question. A company can no longer treat privacy as a legal notice added after a feature is designed. It needs to decide which information the feature truly needs, how a young person will understand the choice and what happens when the safest option is selected.
Profiling and persuasive design get special attention
The code tells organizations to avoid using children’s information for targeted marketing or profiling that could cause harm. It also warns against deceptive design patterns that pressure users into sharing more information than they intended.
That matters in games and social apps, where privacy choices can be mixed into rewards, streaks, bright prompts and time-limited offers. A button can be technically optional while the surrounding design makes refusal confusing or costly. The code asks companies to consider that full experience, not only the wording on a consent screen.
The federal privacy commissioner’s announcement says the code was developed with provincial and territorial counterparts. Independent reporting by MLex also confirmed the national release.
What Canadian companies should review now
Audience: Determine whether children are likely to use the service, even when they are not the only intended users.
Defaults: Check whether location, profile visibility, behavioural advertising and contact discovery begin in the most protective state.
Consent: Separate uses that are necessary to provide the service from optional analytics, marketing and personalization.
Explanations: Test notices with the age groups expected to read them, rather than shrinking an adult privacy policy.
Deletion and correction: Make it practical for a young person or parent to see, correct and remove information.
For families, the code offers a useful checklist rather than an automatic guarantee. Parents can still review app permissions, disable precise location where it is unnecessary and revisit privacy settings after updates. Mapletechie’s guide to stopping apps from using precise location explains the device-level controls.
The enforcement question is still real
Guidance works best when companies build around it before complaints occur. The code does not create a new fine on its own, and its effect will depend on how organizations apply it and how regulators use existing law in investigations.
But it removes a common excuse: that broad privacy principles are too abstract to guide product work. Canadian services now have a published standard that connects consent, default settings, profiling and interface design to the best interests of young users.