Children's Privacy Code: Canada Bans Behavioral Ads to Kids

Children's Privacy Code rules launched in Canada this week give tech platforms their toughest privacy homework yet: stop profiling kids to sell ads. The new framework, unveiled by privacy chief Philippe Dufresne, reaches every app, game, and platform that handles the personal information of minors, and it orders companies to rebuild their default settings around maximum protection, according to reporting on the launch by TechTimes.

The Code is Canada's first dedicated children's privacy rulebook, and it lands at a moment when regulators say self-policing has clearly failed. A joint investigation of TikTok concluded in September 2025 found that the platform was banning roughly half a million underage accounts every year, a sign that its age gates were failing at scale rather than at the margins. Users who stated an age under thirteen at signup were rejected, but investigators found that weak verification meant many simply typed in a false birthdate and kept scrolling, while the platform's data collection, including biometric data, violated federal privacy law.

Six Categories of Rules Platforms Must Follow

The new expectations fall into six buckets. For children under thirteen, organizations must obtain verifiable parental consent before collecting any personal information. For minors thirteen and older, companies need opt-in consent for any data use that goes beyond what is strictly necessary to run the service. Privacy notices and consent flows must be written in language matched to the reader's age, a standard that thousands of words of legal boilerplate will not meet.

The headline provision is the outright ban on behavioral advertising aimed at minors, paired with a ban on using children's personal data to drive automated decisions about them. Location tracking, profile visibility, and third-party data sharing must all default to off, so users have to affirmatively turn data collection on rather than hunt for the off switch. Manipulative design tricks meant to push children into sharing more data, the practice known as dark patterns, are prohibited, as is any interface that exploits young users' vulnerabilities. Finally, children get a practical path to correct wrong information about themselves and to delete their data entirely, a right the Code frames as especially important as young people grow older and their views change.

The scale of the problem the rules are meant to fix is sobering. A 2025 sweep by the Global Privacy Enforcement Network examined 879 websites and apps and found behavioral profiling running alongside self-harm content on sixty percent of the platforms reviewed. Seventy-two percent of the sites bypassed age controls without any verification, and thirty-five percent carried content inappropriate for minors. The findings suggest that unchecked ad tech and child safety failures were not isolated incidents but the default operating mode.

Guidance Today, Fines Tomorrow

There is an important catch: the Code is guidance under Canada's existing federal privacy statute, not legislation, so no automatic fines attach to breaking it today. But legal observers read it as a warm-up act for Bill C-36, the proposed new federal privacy law tabled in June 2026, which would carry penalties of up to twenty-five million Canadian dollars or five percent of gross global revenues for the most serious violations. The regulator expects platforms to start moving toward compliance now, before Parliament makes crossing the line expensive.

Whether or not the fines materialize, privacy advocates say the Children's Privacy Code already matters as a baseline: courts, platforms, and eventually lawmakers will now treat its six categories as the standard every service aimed at young Canadians must meet.

The United Kingdom's Age Appropriate Design Code has been in force since the fall of 2020, with fines reaching up to seventeen million pounds or four percent of global turnover. California followed two years later with its own design code statute modeled on the British approach, with requirements taking effect in 2024. Canada's version borrows from both models but adapts them to a federal system where provinces like Quebec already run their own children's privacy provisions, meaning companies may face different standards in different jurisdictions.

The Verification Dilemma

The thorniest problem sits underneath the rules: enforcing age-based protections requires knowing how old users are, and every commercial method of age verification involves collecting identity data from everyone, not just minors. Self-declared birthdays collect nothing and protect no one. Government ID checks work but create centralized stores of sensitive documents. Biometric age estimation captures sensitive data and carries documented accuracy gaps. The privacy-preserving alternative, in which a cryptographic check confirms a user is over thirteen without transmitting any underlying document, is viable but not yet widely deployed.

The risk is not theoretical. An age-verification vendor used by TikTok, Uber, and X suffered a breach in 2024 that exposed drivers' licenses and other identity documents. A year later, a breach at an identity vendor used by Discord exposed about seventy thousand ID photos submitted by users completing age verification. In the United States, the Supreme Court upheld a Texas age-verification law in a six-to-three decision in 2025, while the dissent warned that forcing adults to hand over identity documents chills free expression. Canada's constitutional framework differs, but the tension between protecting children and building surveillance infrastructure for every user is identical.

The Code itself was three years in the making. Dufresne announced a public consultation in May 2025, which drew thirty-seven submissions and four roundtable sessions, including one held directly with young people. At Privacy Awareness Week in May 2026, the commissioner released separate guidance on age assurance. The final document was shaped with the regulator's Youth Council, a panel of seven students aged fourteen to seventeen from across the country, which also helped produce a simplified version for teens. Their message at the launch was direct: the work let them "centre young people's perspectives and priorities."

For young readers, the story is personal. The youth consulted during the process said their three biggest concerns were a lack of control, a lack of choice, and a lack of clear information about how their data was being used, and those worries drove several of the Code's specific provisions. Whether the rules bite will depend on what Parliament does next, but the direction is unmistakable: the era of treating underage users as just another ad audience is ending, one regulation at a time.

Related reading: a separate campaign urged Parliament to pass the Safe Social Media Act, ChatGPT added PIN-locked chats for private threads, and Anthropic studied a quarter million chats to map how people actually use AI.

Sources: TechTimes coverage of the launch, the official statement summarized by MLex, and Law360 Canada's legal news briefing.