Digital regulators are attempting to thread the needle between meaningful safeguards for children's online safety and giving minors freedom within their online presence. The Office of the Information and Privacy Commissioner of Ontario is among the global enforcers putting a priority on finding that equilibrium.
While the IPC wants companies that use children's data to be accountable, it has also spent recent years developing a collection of online safety initiatives and resources to support underage users. The aim is for the IPC to reach all stakeholders with its awareness campaign, educating organizations, parents and users under age 18 about data security risks and best practices.
Information and Privacy Commissioner Patricia Kosseim said her office is working "to try to balance enhanced protections of youth online but also empowering them to be active participants in the online digital world, so that they can grow and participate fully as digital citizens."
Organizational impact
The protection of children starts with regulatory compliance and required transparency. Kosseim said a clear window into how data is being handled and used is "fundamentally important" for kids, especially to maintain use for age-appropriate purposes.
Privacy impact assessments are also key, helping businesses to identify and mitigate risks within their own systems and those of any third-party providers they partner with.
But when compliance is not fully understood or met, regulators stand ready to act.
Kosseim highlighted Canadian enforcers’ joint resolution against deceptive design practices, which noted companies' increasing use of dark patterns to "manipulate or coerce users into making decisions that may not be in their best interests, particularly children."
"I think it's important for institutions, in the public or private sector, to be held accountable for the personal information that they collect, and that means securing it safely and adopting reasonable safeguards, including best practices on protecting that information from potential cyberattacks or avoiding at all costs that it be used for other purposes that were not intended originally," said Kosseim.
The IPC also advocated for Ontario's Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024. Bill 194 includes regulations for digital technology geared toward children and is currently awaiting final regulations for AI provisions.
The IPC issued recommendations for the bill which were not included in the final text, though Kosseim said the IPC will continue to be active "participants in the regulation-making process to make sure that those responsibilities are reflected."
IPC youth initiatives
Regulation keeps companies in check, but the IPC is also prioritizing child and parent outreach.
From a user perspective, many risks posed by noncompliant activities are avoidable if they can be identified. The IPC is bringing that educational component through its strategic priority, Children and Youth in a Digital World.
Kosseim said the IPC believes it can have a significant impact on children’s online safety by championing "the access and privacy rights of Ontario's children and youth by promoting their digital literacy and expansion of their digital rights but also holding institutions accountable for protecting the children and youth that they serve."
She also noted the importance for underage users to "understand the commercial risks to their information, particularly when they're dealing with tools, platforms, social media and websites." Financial fraud, predatory behavior and unwanted data collection on social platforms are among the potential hazards the IPC tries to highlight in its public awareness work.
The IPC keys in on the most pressing children's online safety issues through its Youth Advisory Council.
Launched in 2023, the council features 10 members under age 25 who guide the IPC on emerging digital issues impacting their demographic. The group aided the creation of the IPC's Youth Ambassador Toolkit, another IPC youth privacy resource compendium.
"They really do help us be more relevant and more effective," Kosseim said. "They serve as a sounding board for us, and so we run things by them. We solicit their ideas, their input, their feedback."
To expand digital literacy, the IPC introduced its Digital Privacy Charter for Ontario schools. According to the IPC, the charter "consists of twelve high-level commitments that codify current and emerging best practices, many of which are grounded in statutory requirements under the Municipal Freedom of Information and Protection of Privacy Act."
While educational institutions are required to comply with privacy regulations, the charter also helps schools keep privacy protections in mind when vetting educational technology providers.
"We urge schools and school boards to sign on in order to demonstrate their commitment to protect personal information of students," Kosseim said. "There's also commitments to help empower children and youth to be able to navigate the online world in an informed manner."
The IPC's efforts to engage with children in the classroom has also expanded with the use of its Privacy Pursuit lesson plans. Developed alongside nonprofit MediaSmarts, the lessons are geared toward developing a base knowledge for children in grades two through eight.
Kosseim said the adoption and circulation of these resources are a "way of showing leadership in their community, as a way of showing that they are serious about accountability and transparency, and as a way of building trust among their students, their parents, and the communities they serve."
Lexie White is a staff writer for the IAPP.
