In A.B. v. Bragg Communications Inc24, Abella, J. speaking for the court acknowledged the deep roots in Canadian law respecting the inherent vulnerability of children, recognizing the need for differentiated approaches as a general standard, not an individuated one, since “the law attributes the heightened vulnerability based on chronology, not temperament.” As the OPC points out, privacy regulators elsewhere have taken this a step further when it comes to designing digital environments that consider children’s evolving capabilities, as recognized in Article 5 of the UNCRC. The CBA Sections recommend the adoption in Canada of guidance like the UK Commissioner’s guidance on transparency under principle 4 of the UK Children’s Code Transparency25 and as further particularized in Annex B of that Code on children’s age and developmental stages 26
Guidance on transparency alone, however, will not provide a sufficient, timely or effective tool to correct course in Canada, since the OPC’s own research shows that over 96% of websites and apps use privacy policies that are overly lengthy, technical and confusing for adults and children alike. Legislative measures with enforceable sanctions and penalties are required to ensure that industry follows the required guidance as to practicing child privacy by design and designing intentionally with children in mind as potential end users. When school boards initiate multi-billion-dollar civil suits to recover system wide impacts of mental health costs and educational loss suffered by Ontario children because of the design choices of social media giants,27 and when Australian legislators act to ban social media use by children under sixteen,28 the chasm between youth and parental privacy expectations and industry and regulatory efforts to meet them looms large. Public guidance from regulators regarding these transparency practices needs to be accompanied by new legislated standards with robust enforcement mechanisms, particularly to sanction industry players who engage in deceptive practices or inappropriate targeted behavioral marketing, collection or use of children’s data about children’s online activities. Beyond legislation and enforcement measures, significantly more funding is required on public education to raise awareness among parents, children and youth of the online risks that children may face and provide meaningful guidance to assist in navigating the ever-increasing complexity of online platforms and services. Better outreach and funding for education, awareness and research activities by both government and non-profit organizations should be part of the public sector’s response.
When it comes to transparency about practice, no information should be presented strictly to parents/guardians (or trusted adults). Instead, the OPC should adopt an approach that follows the spirit of UNCRC art. 529, which requires that parents assist children in understanding and exercising their rights. To this end, all information should be made understandable by children as much as possible. Where it is too complex to be reasonably appreciated by the targeted age group, children should be instructed to have their parents read and guide children on how to use the product further.