On October 20, 2026, the Office of the Privacy Commissioner of Canada (OPC) released its Children’s Privacy Code (“the Code”). It is not new legislation, but that does not make it optional. The Code lays out how the OPC reads the Personal Information Protection and Electronic Documents Act (PIPEDA) when children’s personal information is involved online, and it is a clear preview of what the regulator will look for in complaints and investigations.

Who is covered?

The Code applies to organizations subject to PIPEDA that handle personal information in the course of commercial activity through websites, apps, platforms or other digital tools. It covers anyone under 18, and it reaches services that are directed at children and services that are likely to be accessed by them.

An organization cannot sidestep the Code by saying its service was not designed for kids if children are using it in practice. If an organization concludes children are unlikely to use its service, the OPC expects that decision and its reasoning to be documented.

Key expectations

• Age-appropriate consent. For children under 13, the OPC expects parental or guardian consent in all but exceptional circumstances. For those 13 to 17, organizations should assess whether the child understands what they are agreeing to. Non-essential uses should be opt-in.
• High-privacy defaults. Location sharing should be off by default, profiles should be private, and third-party sharing and profiling should be off unless a child or parent has opted in.
• Data minimization. Collect only what is demonstrably necessary and delete it when it is no longer needed.

The Code also calls for plain-language privacy information that suits the child’s age and appears when it is relevant. It discourages profiling children for marketing and asks for special care with AI systems. Further, it identifies practices the OPC says can not be justified even with consent, including deceptive design and engagement mechanics that drive data collection.

What This Means in Saskatchewan

Saskatchewan has no private-sector privacy statute of its own, so PIPEDA, and with it the Code, applies directly to commercial activity in the province. Schools and other public bodies fall under separate public-sector statutes, and the position of non-profits depends on whether they engage in commercial activity. Youth sports registration platforms, ed-tech vendors, retailers with loyalty apps and agricultural or community organizations with youth programs should each ask whether children are among their users.

Looking Ahead: Bill C-34

Bill C-34, the Safe Social Media Act, is currently at second reading in the House of Commons, with debate most recently occurring on October 21, 2026. If passed, it would create a Digital Safety Commission, impose child-protection duties on social media and AI chatbot services, and restrict social media accounts for users under 16, with key details left to regulation. It is not yet law, but it overlaps with the Code on safety-by-design, AI and age assurance. We will be watching Bill C-34 closely, particularly the regulations that would define which services are covered and what age assurance must look like in practice.

Practical Steps for Organizations

1. Assess whether the Code applies by reviewing your user base, marketing and features for signs that children may be accessing your service.
2. Document your reasoning. If you conclude children are not likely to use your service, record why. The OPC expects it.
3. Map your data flows for younger users: what you collect, why, who receives it, and how long you keep it.
4. Review how you ask for consent and set up your services. Make sure the most privacy-protective choice is the default, and that children (and their parents) can easily understand and change their settings.
5. Consider a privacy impact assessment, regardless of your organization’s size. It is a practical way to spot risks to children early.

Our privacy team at McKercher LLP can help you assess how these developments apply to your products and services. Visit our Cyber Security and Date Privacy webpage to learn more.

This post is for information purposes only and should not be taken as legal opinions on any specific facts or circumstances. Counsel should be consulted concerning your own situation and any specific legal questions you may have.

About the Authors:

Katie M. Newman is an associate in the McKercher LLP Saskatoon office and maintains a general civil litigation practice with a primary focus on insurance defence and health law.  As part of her practice, Katie has a particular focus in privacy law, advising clients from a broad range of industries on information privacy, access to information, data sharing, privacy law interpretation and compliance.

About McKercher LLP:

For 100 years, McKercher LLP has grown deep roots across Saskatchewan, serving the community from offices in Saskatoon and Regina. Now, as one of the province’s largest and most established full-service law firms, we proudly carry on this legacy – following a client-first philosophy as we provide legal services and real solutions for the people who rely on us.

Related Articles:

McKercher LLP lawyer, Katie M. Newman, named to 2026 Best Lawyers: Ones to Watch in Canada™ for Saskatoon in the areas of Alternative Dispute Resolution & Privacy and Data Security Law

Plain Language, Stronger Protections: Lessons from the TikTok Privacy Investigation