Canada says age checks must be privacy-protective

Access the original blog from here

Canada’s privacy regulator has opened a public consultation on how websites and online platforms should use age checks to protect children online, while warning that age assurance systems themselves can create new privacy risks if deployed without safeguards. The consultation will remain open until August 4, 2026.

Philippe Dufresne, Privacy Commissioner of Canada, launched the guidance on May 4 during the International Association of Privacy Professionals (IAPP) Canada Symposium in Toronto as part of Privacy Awareness Week 2026. The Office of the Privacy Commissioner of Canada developed the framework after conducting an earlier public consultation on age assurance technologies.

The regulator said organizations should not make age assurance “the default condition for accessing the Internet” and should use it only where the law requires it or where children face a specific risk of harm.

When platforms may need to use age checks: The document identifies two broad situations where platforms may need to differentiate users by age: when they restrict access to certain services or content, and when they change platform features or data practices for younger users.

The guidance says companies blocking access based on age should be able to show either that the law requires them to do so or that children face a clear risk from accessing the service. Examples mentioned include pornography, gambling, dating services, and products with age restrictions.

At the same time, the regulator warned against excessive data collection in the name of child safety. It said platforms must ensure that any age assurance system collects information that is “proportional to the risk being addressed.”

Concerns over profiling and data collection: The guidance also highlights risks linked to modern online platforms, including detailed profiling, behavioural advertising, unrestricted private messaging, and systems that…

Source