Canada: Clarifying compliance - Canadian enforcement trends in youth privacy and age assurance

In brief

Canadian privacy regulators are increasing scrutiny on social media and digital platforms, focusing on how they handle minors’ personal data and younger users who bypass age restrictions. This heightened oversight is likely to raise expectations for youth-focused design in services and platforms that younger users tend to use.

Age assurance and children's privacy have emerged as key priorities, highlighted in the Office of the Privacy Commissioner’s 2024 stakeholder consultation and embedded in its 2024-2027 strategic plan. Platforms have been clearly signaled that regulators will now apply a children’s privacy lens to youth-related investigations and data breach assessments to drive compliance and raise awareness. However, what this lens entails, remains undefined. While consultations have explored broader regulatory themes like accountability and risk-based approaches, the absence of detailed guidance leaves platforms uncertain about whether current practices meet developing regulatory expectations.


Contents

Recent investigations in 2025 have begun to outline regulator expectations with certain privacy practices now being clearly stated as insufficient to comply with regulator expectations. These actions serve as implicit guidance on the standards and considerations necessary to respond to developing regulatory trends.

A key regulatory principle emerging is the application of a children’s privacy lens to existing platform practices. Recent investigation findings suggest this lens involves a contextual analysis, one that considers not only user demographics, but also whether the collection and use of minors’ data aligns with the organization’s stated purpose. Platforms with significant youth engagement are increasingly expected to implement tailored safeguards. Where data is used for purposes such as targeted advertising or content personalization, robust age assurance mechanisms and youth-friendly privacy communications are becoming prerequisites for appropriate collection and use. Regulators have now clearly flagged several practices as insufficient, signaling where platforms must strengthen safeguards to meet compliance expectations.

  • On platforms with a significant youth user base, relying solely on easily bypassed self-declared age gates is inadequate for age assurance and may lead to inappropriate data collection from minors, triggering potential enforcement.
  • On platforms with a significant youth user base, consent practices for users aged 13 to 17 must be tailored to their cognitive maturity. Using generic, adult-oriented language risks invalidating consent altogether.

Proactive measures for consideration

With enforcement already outpacing formal direction, regulatory action is setting the standard, prompting platforms to respond proactively in anticipation of clearer guidance. Recent investigations have made it clear that platforms popular with minors, especially those that are easily accessible and lack tailored privacy communications, should reassess their practices. Key areas for consideration include:

  • Layered age assurance mechanisms
    • Evaluate whether multiple layers of age assurance (e.g., self-declaration, AI-based estimation, parental controls) are contextually appropriate given current data collection practices. This may help mitigate risks of incidental profiling or targeting of minors.
  • Youth-appropriate privacy communications
    • Review whether privacy policies and consent mechanisms use plain, age-appropriate language that aligns with the cognitive development of minors.

Copyright © 2025 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.