Which topic would you like to know more about?
What is the legal age of adulthood/ majority in your jurisdiction? Are all persons below this age considered a child/ minor?
In Canada, the age of majority is determined by each province and territory as per section 92(13) of the Constitution Act, 1867.
The age of majority is 18 in Alberta, Manitoba, Ontario, Prince Edward Island, Quebec, and Saskatchewan.
The age of majority is 19 in British Columbia, New Brunswick, Newfoundland and Labrador, Nova Scotia, Northwest Territories, Nunavut, and Yukon.
For activities that fall under the jurisdiction of the federal government, the age of majority is 18 (e.g., eligibility for military service and voting).
Has the UNCRC been directly incorporated into national law in your jurisdiction?
No.
Canada ratified the UNCRC in 1991, although the UNCRC has not been directly incorporated into domestic law. Therefore, strictly speaking, the rights set out in the UNCRC cannot be directly relied upon by children before domestic courts. However, its principles guide the interpretation of children’s rights under the Charter of Rights and Freedoms, legislation and the common law.
Some federal laws reference the UNCRC when defining “minors” (Bank Act, Canada Cooperatives Act, Cooperative Credit Associations Act, Insurance Companies Act and Trust and Loan Companies Act) or “infants” (Canada Business Corporations Act).
Additionally, other federal laws as well as certain provincial and territorial laws reference the UNCRC.
Is there an ombudsperson/ commissioner for children in your jurisdiction?
Yes.
In Canada, there is no federal human rights institution for children (i.e., a national children’s commissioner). However, The Canadian Council of Child and Youth Advocates has recommended that Canada establish a “federal Children’s Ombudsperson” to monitor and protect children’s UNCRC rights at the federal level.
Several provinces and territories have established an independent advocate, representative, or ombudsperson for children. For example, on May 29, 2024, the Quebec government adopted the Act respecting the Commissioner for Children’s Well-Being and Rights, which establishes the Commissioner for Children’s Well-Being and Rights. Other provinces with a dedicated office solely for children’s advocacy include British Columbia, Alberta, Saskatchewan, Manitoba, Ontario, New Brunswick and Newfoundland and Labrador.
If there is an ombudsperson/ commissioner for children in your jurisdiction, do they have any responsibility for upholding children’s rights in the digital world or does the relevant regulator have sole competence?
No.
Where a province has a dedicated office solely for children’s advocacy, they are generally responsible for upholding children’s rights. While they are not explicitly tasked with upholding children’s rights in the digital world, some offices are beginning to focus on concerns relating to the digital world and children’s rights online.
The authority of these provincial offices generally extends only to investigations and complaints taken against public bodies as such complaints relate to adverse treatment of a child. As such, they do not have authority as regards the investigation of such complaints against private entities.
Is there any standalone requirement to collect the consent of one or both parents when processing a child’s personal data (irrespective of any other obligations, e.g. the requirement to have a legal basis for processing)?
No. (except Quebec)
Yes. (in Quebec)
(The federal private sector privacy legislation governs the collection, use and disclosure of personal information in the course of commercial activities. To the extent that any collection/use/disclosure of personal information occurs within the provincial boundaries of British Columbia, Alberta or Quebec, then the private sector privacy legislation of the respective province applies. There can be concurrent jurisdiction of the provincial and federal privacy legislation to the extent that the processing of personal information occurs both within and outside one of these three provinces.
The privacy legislation of British Columbia and Alberta is aligned with the federal private sector privacy legislation and therefore the answers provided only refer to the federal legislation and the Quebec legislation (to the extent the Quebec legislation differs from the federal legislation).
The federal private sector privacy legislation provides that the consent of an individual is only valid if it is reasonable to expect that the individual would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting. The practical effect of this clause is that the collection, use and disclosure of children’s personal data would require the consent of at least one parent when processing a child’s personal data.
In non-legally binding guidance, the federal privacy commissioner has stated that in all but exceptional cases, consent for the collection, use and disclosure of personal information of children under the age of 13 must be obtained from their parent or guardians.
Article 14 of the Quebec Act respecting the protection of personal information in the private sector provides that the consent of a minor under 14 years of age must be given by a person having parental authority or by a tutor (i.e., a person legally appointed by the court to ensure the protection of a person, similar to the concept of guardianship). The consent of a minor 14 years of age or over is given by the minor, by the person having parental authority or by the tutor.
At what age can children legally consent to the processing of their own personal data, such that parental permission/ consent is not required?
N/A (except Quebec)
14 (in Quebec)
The federal private sector privacy legislation does not specify an age at which children can legally consent to the processing of their personal data.
Article 4.1 of the Quebec Act respecting the protection of personal information in the private sector provides that consent of a minor 14 years of age or over can be given by the minor, by the person having parental authority or by the tutor.
Are there specific requirements in relation to collection and/or verification of parental consent/ permission concerning the processing of a child’s personal data?
No.
There are no specific requirements in relation to the collection and verification of parental consent.
Are there any particular information or transparency requirements concerning the processing of children’s personal data?
No.
Canadian private sector privacy legislation does not specify transparency requirements for processing children’s personal data. However, the legislation requires that organizations make reasonable efforts to ensure individuals are advised of the purposes for which information will be used. To make consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed. In guidance documents, the federal privacy commissioner sets out additional more detailed transparency requirements for processing personal data. The transparency requirements apply to all personal data, including that of children.
Can children directly exercise their rights in relation to their personal data without the involvement of their parents?
Yes.
Canadian private sector privacy legislation does not explicitly restrict the ability of children to directly exercise their rights in relation to their personal data without involvement of their parents and there are no laws specifying the age at which children can do so.
However, the non-legally binding guidance of the federal privacy commissioner regarding consent of children may impact a consideration of whether children can directly exercise such rights.
- The federal privacy commissioner has stated that in all but exceptional cases, consent of the collection, use and disclosure of personal information of children under the age of 13, must be obtained from their parent or guardians.
- At the same time, in non-legally binding guidance, the federal privacy commissioner has noted that organizations have to account for the fact that young people may wish for privacy from their parents, or children may disagree with privacy-related decisions made by their parents for them.
Can children make complaints on their own behalf directly to your national data protection/ privacy regulator(s)?
Yes.
There is no restriction regarding the age at which an individual can make a complaint on their own behalf.
Are there any particular requirements/ prohibitions related to:
a. processing specific types of children’s personal data;
b. carrying out specific processing activities involving children’s personal data; and/ or
c. using children’s personal data for specific purposes.
No.
Under Canadian private sector privacy legislation, there are no particular requirements or prohibitions relating to these issues as they concern children’s personal data.
However, Canadian private sector privacy legislation provides as follows:
- an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances (regardless of consent); and
- an organization should generally seek express consent when the information is likely to be considered sensitive.
Further to the second bullet point above, in non-legally binding guidance, the federal privacy commissioner has identified personal information of children and young people as “particularly sensitive”. He has also indicated that data retention policies should be acknowledge that “children’s actions and experiences should not follow them into adulthood”.
Has there been any enforcement action by your national data protection/ privacy regulator(s) concerning the processing of children’s personal data? In your answer, please include information on the volume, nature and severity of sanctions.
Yes.
There have been limited cases in which the federal privacy commissioner has undertaken an investigation relating to the processing of children’s data. Due to the absence of any penalties in the current federal private sector privacy regime, these cases only involved recommendations and no fines or orders to take specific action.
Are there specific rules concerning electronic direct marketing to children?
No.
Canada’s anti-spam legislation (CASL) does not include provisions that are specific to children. However, consent is required to send commercial electronic messages. It is expected that the federal age of majority would be relevant in defining what constitutes consent under CASL.
Are there specific rules concerning the use of adtech tracking technologies, profiling and/or online targeted advertising to children?
No.
There are no specific rules on this point. However, the principles set out in Canadian private sector privacy legislation are relevant in determining whether the use of adtech tracking technologies, profiling and online targeted advertising to children is permitted. In particular, under the legislation, an organization can only process personal information for an appropriate purpose regardless of consent. Additionally, the legislation requires that organizations make reasonable efforts to ensure individuals are advised of the purposes for which information will be used.
To make consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed. These principled requirements could operate to limit the use of adtech tracking technologies, profiling and/or online targeted advertising to children.
The Quebec Act respecting the protection of personal information in the private sector provides specific rules concerning:
- The collection of personal data using technology that includes functions allowing a person to be identified, located or profiled. Any person using such technology must first inform the person concerned (i) of the usage of such technology; and (ii) of the means available to activate the functions that allow a person to be identified, located or profiled. Profiling means the collection and use of personal data to assess certain characteristics of a natural person, in particular for the purpose of analysing that person’s work performance, economic situation, health, personal preferences, interests or behaviour.
- The collection of personal data through technology means having privacy setting. Any person carrying on an enterprise who collects personal data when offering to the public a technological product or service having privacy settings must ensure that those settings provide the highest level of confidentiality by default, without any interventions by the person concerned. This requirement does not apply to privacy setting for strictly essential cookies.
These rules under the Quebec legislation apply to all personal data, including that of children.
Are there specific rules concerning online contextual advertising to children?
No.
There are no specific rules on this point. However, the principles set out in federal private sector privacy legislation would be relevant in determining whether the collection/use/disclosure of personal information used to inform the contextual advertising placement is permitted.
In particular, the following principles would be relevant:
- requirement to obtain meaningful consent for the collection/use/disclosure of children’s information; and
- restriction of processing information for an appropriate purpose.
Has there been any regulatory enforcement action concerning advertising to children? In your answer, please include information on the volume, nature and severity of sanctions.
No.
We have not identified any enforcement action specifically concerning advertising to children.
At what age does a person acquire contractual capacity to enter into an agreement to use digital services?
The Quebec Civil Code provides that a minor may, within the limits imposed by his age and power of discernment, enter into contracts to meet his ordinary and usual needs. Therefore, each situation requires a case-by-case analysis.
In each other province and territory, contractual capacity is determined at common law. In general, minors do not have capacity to enter contracts. However, there are exceptions (i.e., contracts to provide for the necessities of life).
Consumer protection legislation does not specify the age at which a person acquires capacity to enter into an agreement to use digital services. However, in various provinces and territories, consumer protection legislation will consider age as a factor when determining whether a specific act or practice – such as a digital services agreement – was unfair or unconscionable.
Do consumer protection rules apply to children?
Yes.
Under provincial and territorial consumer protection legislation, the definition of “consumer” does not include any age requirements. Therefore, such legislation applies to children.
The Québec Consumer Protection Act not only regulates advertising intended for children under the age of 13 years but also (i) regulates contracts, including setting out mandatory requirements and pre-sale disclosure, prohibits the inclusion of certain provisions; (ii) makes provisions for basic and legal guarantees on all goods and services; (iii) makes provisions for specific protection related to certain types of contracts (including online/ distance contracts); (iv) determines the fields of commercial activity in which the issuance of a permit is required; and (v) prohibits certain business practices, such as making false and misleading representation, falsely ascribing special advantages to goods or services or falsely invoking price reduction.
Are there any consumer protection rules which are specific to children only?
Yes.
Subject to limited exceptions, the Québec Consumer Protection Act (under Sections 248 and 249) prohibits commercial advertisements directed at children under 13 years old. To determine whether an advertisement is directed to children under 13, the context of its presentation must be considered, particularly: (a) the nature and intended purpose of the advertised goods; (b) the manner of presenting such advertisement; (c) the time and place it is shown.
Has there been any regulatory enforcement action concerning consumer protection requirements and children’s use of digital services? In your answer, please include information on the volume, nature and severity of sanctions.
No.
We have not identified any regulatory enforcement actions concerning consumer protection requirements and children’s use of digital services.
Are there any age-related restrictions on when children can legally access online/ digital services?
Yes.
Various laws impose restrictions on the age at which children can legally access certain goods and services (e.g. gambling, alcohol/cigarettes/e-cigarettes; pornography). To the extent that these goods and services are accessed online by children, these restrictions also apply.
Are there any specific requirements relating to online/ digital safety for children?
No.
The Québec privacy regulator issued recommendations in its 2022 report, Mieux protéger les renseignements personnels des jeunes à l’ère numérique (Better Protecting Youths' Personal Information in the Digital Age), and more recently as part of a government-initiated special commission, the Commission spéciale sur les impacts des écrans et des réseaux sociaux sur la santé et le développement des jeunes (CSESJ) (Special Commission on the Impacts of Screens and Social Media on the Health and Development of Young People).
These non-binding recommendations include, notably:
- explicitly prohibit the collection, use, or disclosure of a minor's personal information for the purpose of commercial advertising, influencing their behavior or decisions in a commercial context, or for any other purpose that is presumed or effectively harmful;
- explicitly prohibit the sale of personal information concerning a minor, even with consent;
- enshrine the best interests of young people within personal information protection laws, among other principles;
- impose a special duty of protection on businesses regarding minors;
- require that the assessment of projects involving minors’ personal information consider the potential effects on their other fundamental rights; and
- further regulate the design of digital products and services.
Are there specific age verification/ age assurance requirements concerning access to online/ digital services?
No.
There are no explicit statutory provisions that establish a specific requirement to implement age assurance/ age verification measures for access to online/digital services.
Are there requirements to implement parental controls and/or facilitate parental involvement in children’s use of digital services?
No.
There are no requirements to implemental parental controls and/or facilitate parental involvement in children’s use of digital services.
Has there been any regulatory enforcement action concerning online/ digital safety? In your answer, please include information on the volume, nature and severity of sanctions.
No.
We have not identified any regulatory enforcement actions concerning online / digital safety.
Are there any existing requirements relating to children and AI in your jurisdiction?
No.
N/A
Are there any upcoming requirements relating to children and AI in your jurisdiction?
No.
N/A
Has there been any other regulatory enforcement activity to date relevant to children’s use of digital services? In your answer, please include information on the volume, nature and severity of sanctions.
No.
We have not identified any regulatory enforcement activities to date relevant to children’s use of digital services.
Are there any other existing or upcoming requirements relevant to children’s use of digital services?
Yes.
There is federal draft legislation titled the Online Harms Act. The draft legislation addresses online protection for children, including enabling law enforcement to act more expeditiously in protecting children from serious harm in circumstances of child exploitation. This Act would also establish a “Digital Safety Commission of Canada” and a “Digital Safety Ombudsperson of Canada”, and each would be supported administratively by the “Digital Safety Office”.
Bill C-27 in Canada proposes to replace existing federal privacy legislation in Canada. This draft federal privacy legislation provides that information relating to minors is deemed to be sensitive.
In September 2024, the Québec government established a special commission, the Commission spéciale sur les impacts des écrans et des réseaux sociaux sur la santé et le développement des jeunes (CSESJ), or Special Commission on the Impacts of Screens and Social Media on the Health and Development of Young People. This commission may lead to the introduction of new requirements or prohibitions specifically aimed at enhancing online and digital safety for children.
Additionally, privacy regulators from across Canada have issued a joint resolution calling for action on the growing use of deceptive design patters, particularly as these impact children.
Contributors
Ruth Promislow
Bennett Jones
