The Privacy and Access Council of Canada (PACC) is pleased to have contributed to the Joint Submission to Canada’s Office of the Privacy Commissioner (OPC) in response to its Exploratory Consultation regarding the development of a Children’s Privacy Code.
We welcome the OPC’s leadership in developing a children’s privacy code that extends online protections to all children in Canada, and which applies broadly to all digital products and services that are used by, directed at, intended for, likely to impact, or likely to be accessed by children.
As Canadians’ personal data is being collected, shared, and monetized at an unprecedented pace and scale, Canada can seize this critical opportunity to lead the way in holding technology companies accountable to genuinely respect individuals’ privacy, rights, and best interests in the digital world.
Unlike so many legislative and other efforts that focus on requiring that individuals identify themselves to prove their age, PACC joins 40 experts and organizations from Canada, the UK and EU in calling on the OPC to develop a children’s privacy code that shifts the onus for online safety away from individuals. Holding the technology companies that design digital products and services accountable for embedding privacy as the default has proven to be necessary because:
- Tech companies routinely shift the burden of ensuring privacy onto children and their families, expecting them to navigate complex privacy settings and deliberately opaque, lengthy terms and legal complexities that outline how data is collected, processed, and exploited.
- Tech companies have acknowledged that they are aware individuals seldom read ‘privacy policies’ and they are therefore in violation of privacy laws by knowingly collecting personal information without having obtained informed consent.
- Consent is rarely informed or freely given, particularly when access to education, social life, entertainment, or government services is conditional on agreeing to privacy-invasive data practices.
- Consent, especially when obtained through a performative and meaningless ‘click-through’ exercise that children neither fully grasp nor freely choose, is meaningless.
- The currently-accepted consent model is deeply flawed, and allows published terms to serve as a proxy for compliance.
- Presenting information in age-appropriate formats, using clear, concise language, accessible visuals, and interactive elements is essential for transparency, but not sufficient alone to ensure meaningful data protection.
The Joint Submission calls on the Children’s Privacy Code to include clear and enforceable legal provisions to obligate organizations to minimize data collection, avoid manipulative practices, ensure genuinely privacy-protective settings from the outset, and respect children’s rights and best interests by design and by default.
Clear legislative measures that champion rights-respecting innovation to build a digital world Canadians rely upon and have reason to trust is essential to reaffirm democratic values, ensure accountability, and protect children and their families.
