Collecting Data From Minors: Website Privacy Obligations for Ontario Businesses

A surprising number of Ontario businesses collect information from children or teenagers without quite meaning to — a school-supply retailer with a sign-up form, a gaming app popular with younger users, a summer-camp registration page. Collecting data from children through a website or app raises the bar for what counts as valid consent under Canadian privacy law, and getting it wrong is one of the more reputationally costly privacy mistakes a business can make.

Canada does not have a dedicated children's-privacy statute the way some other countries do. Instead, the existing framework under PIPEDA simply gets harder to satisfy the younger your users are. This article explains why, and what that means in practice for a website or app.

Why Children's Data Gets Extra Scrutiny Under PIPEDA

PIPEDA requires organizations to obtain meaningful consent before collecting, using, or disclosing personal information. Meaningful consent depends on the person understanding, in a real sense, what they are agreeing to. A young child generally cannot meet that bar on their own — which means a business collecting information from a young child typically needs to obtain consent from a parent or guardian instead, and explain things in a way that parent can genuinely understand and act on.

As a user gets older, their own capacity to understand and consent generally increases, but there is no simple bright-line age that automatically flips a business from "get parental consent" to "the teenager can consent alone" under Canadian law. This is a contextual, fact-specific judgment — the nature of the information, the sensitivity of the use, and the maturity implied by the context all matter. Because guidance in this area can be updated, confirm the current federal privacy guidance before relying on any specific age benchmark.

What This Means for Your Website or App in Practice

If your website or app is likely to be used by children or teenagers — whether because it is aimed at them or simply popular with them — a few practical questions follow:

• Do you actually know your audience's age profile? A business that has not thought about this is not in a strong position to say its consent practices are appropriate.
• Is your privacy policy written in language a parent — or, depending on age, the young user — can actually understand? Dense legal boilerplate does not satisfy a meaningful-consent standard for this audience.
• Are you collecting only what you need? Data minimization matters everywhere under PIPEDA, but it carries more weight where children are involved — collecting a birthdate or location "just in case" is harder to justify.
• Do you have a real mechanism for parental consent, not just a checkbox a child can click through unsupervised?

Special Categories: Schools, Kids' Apps, and Marketing

A few situations deserve particular care:

• School-related tools and services. Where a business's product is used in a school setting, there are often layered obligations involving both the business's own privacy practices and the school board's data-handling policies. Treat these as a joint compliance question, not just your own.
• Apps and games aimed at children. Where the target audience is children, consent, advertising, and in-app-purchase practices all deserve heightened attention — including whether any behavioural advertising or profiling is happening at all.
• Marketing to minors. Using a child's or teenager's personal information to build a marketing profile, rather than simply to operate the service they signed up for, raises the sensitivity of the use and should be approached cautiously.

Building a Compliant Approach

• [ ] Identify whether your website or app is likely to be used by children or teenagers, even if it is not designed for them
• [ ] Write (or rewrite) your privacy policy in plain language appropriate to your actual audience
• [ ] Build a real parental-consent mechanism where young children are involved, not just a self-declared age gate
• [ ] Limit data collection to what the service genuinely needs
• [ ] Avoid using minors' data for profiling or targeted advertising unless you have specifically addressed the consent implications
• [ ] Review current federal privacy guidance on consent and minors periodically, since this is an evolving area

Frequently asked questions