Canada’s Office of the Privacy Commissioner has issued guidance for websites and online services on when and how to use age assurance, setting a proportionality framework for organizations that need to restrict access, tailor services for children or comply with legal obligations. The OPC is accepting comments on the guidance until August 4, after which it will decide whether changes are needed.
The document tells organizations to first determine whether age assurance is necessary. A service seeking to block access should be able to point to a legal requirement or a specific potential harm to children. A service seeking to adjust privacy practices for child users should assess whether its own data practices create potential harm, whether a non-trivial number of children are likely to use the service and whether less intrusive alternatives are available.
If age assurance is justified, the OPC says organizations must consider the sensitivity and volume of personal information collected by the chosen method. The guidance also urges services to limit age checks to specific age-restricted content or features where possible, provide user options and appeal mechanisms, and avoid using age assurance results for unrelated purposes or to link repeat visits by the same person.
The guidance places Canada in a wider policy debate over age checks and privacy-preserving identity tools. Australia’s privacy regulator recently set a proportionality bar for age assurance, Brazil’s data protection authority published child-protection age assurance guidance, and BSI has pointed to an ISO framework for privacy-focused age assurance systems.
The Canadian document does not mandate a specific technology. Its effect is to push organizations toward a risk-based choice among methods such as self-declaration, account-based signals, document checks, age estimation or credential-based approaches. For identity providers, the guidance favors systems that minimize personal data collection, separate age checks from broader tracking and let users challenge or repeat the process when an age decision is wrong.
The guidance also gives online services a reason to document their decision-making before choosing a vendor. A company adopting age estimation, document verification or wallet-based proof would need to show why that method fits the risk, what data is collected, how long it is retained and how users can correct errors.
Sources: Office of the Privacy Commissioner of Canada
–
By the ID Tech Editorial Team
