By Esther Shainblum and Martin U. Wissmath

Canada Launches Consultation on Children’s Privacy Code to Enhance Online Protections

Canada’s federal privacy regulator is seeking feedback to develop a new code that would strengthen online privacy protections for children. On May 12, 2025, Privacy Commissioner Philippe Dufresne announced an exploratory consultation to inform the development of a children's privacy code aimed at strengthening the protection of young people's personal information in the digital world. This initiative seeks input from child advocacy groups, businesses, parents, educators, and other stakeholders to ensure the code reflects the best interests of children.

The proposed code aims to provide clear, practical guidelines for organizations handling children's personal information, ensuring products and services are designed with high privacy standards and empowering children to exercise their privacy rights. Feedback can be submitted via email to cpvp-opcconsultation1@priv.gc.ca until August 5, 2025.

Commissioner Dufresne emphasized that championing children's privacy is a strategic priority for his office, with the ultimate goal of creating a safer, more transparent online environment for children. This initiative aligns with the OPC’s broader strategic priorities: protecting and promoting privacy with maximum impact; addressing and advocating for privacy amid technological change; and championing children's privacy rights.

Organizations that engage with children or families online should anticipate heightened expectations for privacy protections. The forthcoming code may influence how charities and not-for-profits design digital platforms, collect data, and communicate with young users. Proactively aligning practices with the code's principles can help these organizations maintain trust and demonstrate their commitment to safeguarding children's privacy.

More information on the exploratory consultation for the children’s privacy code is available on the Office of the Privacy Commissioner’s website.

Alberta Court of King’s Bench Rules Alberta PIPA is Partially Unconstitutional

In our January 2025 Charity & NFP Law Update, we reported on the B.C. Supreme Court’s decision in Clearview AI Inc. v. Information and Privacy Commissioner for British Columbia, which upheld a privacy order against a U.S.-based company that sells facial recognition services. The Alberta courts have now rendered a decision regarding the same controversial entity. In Clearview AI Inc v Alberta (Information and Privacy Commissioner), 2025 ABKB 287, released May 8, 2025, the Alberta Court of King’s Bench (the “Court”) held that sections 12, 17 and 20 of Alberta’s Personal Information Protection Act (PIPA) and PIPA Regulation 7(e) violated Clearview’s freedom of expression under section 2(b) of the Canadian Charter of Rights and Freedoms (link). 

In February 2021, in a joint report with the privacy commissioners of BC and Quebec, the Alberta Information and Privacy Commissioner (the “Commissioner”) determined that Clearview’s activities breached privacy statutes in BC, Alberta and Quebec. Clearview collected personal information – including facial images and biometric data – without consent by scraping images from the internet for purposes that were not reasonable under PIPA. In December 2021, the Commissioner issued an order requiring Clearview to stop offering facial recognition services in Alberta, to stop collecting, using, and disclosing the personal information already collected from individuals in Alberta and to delete what it had already obtained (the “Order”). Clearview challenged both the Commissioner’s jurisdiction and the constitutionality of the underlying legislative provisions.

The Court found that the way PIPA works is “constitutionally problematic”. This is because PIPA’s “belt and suspenders approach”, imposes both a consent requirement for collection, use and disclosure of publicly available personal information as well as a prohibition on collection, use and disclosure except for purposes that are reasonable. The PIPA Regulation also defines “publicly available” very narrowly, limiting the exception to magazines, books, newspapers and similar media.  The Court found that the combined effect of these provisions was that

“…an organization that intends to use personal information that is publicly available on the internet for purposes that are reasonable may not do so without the consent of the individual …Where obtaining individual consent is impractical, this amounts to a complete prohibition on collection, use, and disclosure of personal information publicly available on the internet even for purposes that are reasonable”.

PIPA and the Regulations were therefore overbroad and could limit use of publicly available personal information by regular search engines, for which there was no justification.

The Court’s remedy for the unconstitutionality was (after finding that the list of publicly available publications listed in PIPA Regulation 7(e) was outdated and too restrictive,) to strike down the words “including, but not limited to, magazines, books, and newspapers”. As the Court stated at paragraph 149,

This leaves the word ‘publication’ to take its ordinary meaning which I characterize as ‘something that has been intentionally made public.’ Personal information and images posted to the internet without being subject to privacy settings are publications and use of such personal information and images is not subject to a consent requirement.

In other words, personal information posted online without privacy settings qualifies as “publicly available” and thus consent is not required for collection, use or disclosure under PIPA, provided that such collection, use, and disclosure of personal information are for purposes that are reasonable. Ultimately upholding the Commissioner’s characterization of Clearview’s conduct as unreasonable and the Order as enforceable, the Court ordered Clearview to report back within 50 days on the good faith steps it takes to comply with the Order.

The decision confirms that even publicly available data must be used for a reasonable purpose under Canadian privacy laws. For charities and not-for-profits, this highlights the importance of maintaining a clear, current privacy policy that explains not just how data is collected, but why. A well-crafted policy helps demonstrate lawful, purpose-aligned data use, which is important to ensure compliance and to preserve public trust.

​Read the May 2025 Charity & NFP Law Update