Privacy expectations for online services marketed to children, parental consent, behavioural advertising, and school technology.
This page provides legal information, not legal advice. Consult a qualified privacy lawyer or CIPP/C-accredited privacy professional before taking action on access requests, breach response, complaints to a Privacy Commissioner, or Federal Court applications.
Last verified: September 2026
TL;DR
Online services marketed to children must get meaningful parental consent for under-13 users (under-14 in Quebec) and must limit collection to what is necessary. Behavioural advertising and profiling of children is increasingly restricted. School tech vendors must also meet provincial public-sector privacy standards.
Marketing and data collection from children
Organizations targeting children must:
Obtain meaningful parental consent before collecting personal information from under-13 users.
Provide age-appropriate notices in language children can understand.
Minimize data collection and retention.
Avoid tracking and behavioural advertising aimed at young people, and turn tracking off by default (a 2023 joint resolution of Canada's privacy commissioners; guidance, not a statutory rule outside Quebec).
Schools and ed-tech
Schools must vet ed-tech vendors to ensure equivalent privacy protection under the applicable provincial public-sector law.
Cross-border data transfers require additional assessment under Quebec's Law 25.
Children's images online
Posting images of identifiable children online generally requires parental consent. Quebec's de-indexing rights are particularly strong for children.