Canada's privacy commissioner publishes a Children's Privacy Code that covers profiling and AI

The Office of the Privacy Commissioner of Canada published a news release dated 20 October 2026, in Gatineau, saying Privacy Commissioner Philippe Dufresne launched Canada's first Children's Privacy Code that day. The release says the Code sets expectations for organisations that handle children's personal information, and that it helps organisations understand how to protect children under Canadian privacy law. It says the Office is accepting comments until 20 January 2027, after which the document may be updated. Comments go to the email address named on the release, cpvp-opcconsultation1@priv.gc.ca.

The release's list of expectations includes obtaining meaningful consent, including parental consent for children under 13 and opt-in consent for non-essential uses; age-appropriate privacy information; a practical way to correct personal information and an option to delete it; avoiding profiling of children for marketing, including targeted or behavioural advertising, or for AI-driven decision-making; and privacy by default, with location tracking, profile visibility and third-party data sharing off. It also says websites and mobile apps cannot use deceptive design to push children to provide more personal information than they need, or use children's information to exploit their vulnerabilities.

The Code page, also dated 20 October 2026, has a section headed "Profiling within AI". It says AI technologies should not encourage children to share more personal information than is necessary to run the service, and should not infer characteristics from children's activities on the system in order to make age-inappropriate recommendations or biased responses. A later part of the profiling section says that where organisations use automated systems to make or significantly inform decisions about children based on profiling, the best interests of the child should be the primary consideration. It says that, where profiling is necessary to run the service and is shown to be in those interests, children should be told in clear and age-appropriate language when automated decision-making is being used and what effects it may have.

What it means for business: this is the privacy commissioner's code, not a new Canadian AI statute. Comments are open until 20 January 2027, and the release says the document may be updated after that. An organisation that handles children's personal information in Canada can read the code as the commissioner's expectations on profiling, including in AI systems. This describes the release and the code. It is not advice on a particular product.