Rules
PIPEDA and teen social media: what a Canadian parent can request
PIPEDA and teen social media: what a Canadian parent can request from a platform, what the reply must contain, and where provincial commissioners step in.
What to take away
- PIPEDA gives a Canadian parent the right to ask an organization for the personal information it holds about their teenager, and to ask for corrections.
- The request goes to the privacy officer, not to a help centre, and the reply is due within 30 days.
- A compliant answer lists the data held, the purposes behind it, and the parties that received it.
- A refusal without a valid exception can go to the Office of the Privacy Commissioner of Canada, and the Federal Court can order changes and award damages.
- British Columbia, Alberta and Quebec run their own private-sector regimes, so naming the right regulator comes first.
Where PIPEDA applies and where the provinces step in
PIPEDA is Canada's federal private-sector privacy law. It covers organizations that collect, use or disclose personal information in the course of commercial activity. A social platform serving Canadian users sits inside that scope, and so does the advertising business behind it.
Who Regulates the Platform
Federal
- Law
- PIPEDA
- Regulator
- OPC Canada
- Who it covers
- Commercial activity
- Complaint route
- Federal OPC
BC / AB / QC
- Law
- Provincial PIPA
- Regulator
- Provincial commissioner
- Who it covers
- Provincially regulated orgs
- Complaint route
- Provincial form
The Office of the Privacy Commissioner of Canada publishes an overview of PIPEDA that sets out the access and correction rights a person can exercise. Those rights belong to the account holder, which for a 14-year-old is the 14-year-old. A parent acting for a minor exercises them on the child's behalf.
Age sets one limit. age-by-age guidance laws explain how thresholds such as 13 and 16 are written into statute, and where they change what a company may collect.
British Columbia, Alberta and Quebec have private-sector laws the federal government treats as substantially similar. Organizations regulated in those provinces answer to their own commissioner.
What a platform must tell you when you ask
A request should ask for the personal information held, the purposes it was used for, and the parties it was disclosed to. Say in the first line that you write on your teenager's behalf, and offer proof of guardianship.
What Your Request Must Cover
- State you write for your teenager
- Offer proof of guardianship
- Ask for personal information held
- Ask the purposes it was used for
- Ask the parties it was disclosed to
- Ask if data left Canada
The reply should name the categories of information and, where practical, produce the actual data. It should identify third parties that received the information and say whether any of it was transferred outside Canada.
Settings that decide what a parent can see change without much notice, and parental controls changes list what to re-check each term.
An answer that only points at a privacy policy is not the record you asked for. Ask again, name the access right, and set a date for the response.
What happens if a company refuses or ignores you
A refusal without one of the limited exceptions can become a complaint to the Office of the Privacy Commissioner of Canada. The Commissioner can investigate, demand records, and publish findings.
From Refusal to Court Order
- Company refuses or ignores
- Complaint to the OPC
- Commissioner investigates and demands records
- Findings published
- Federal Court order and damages
Serious cases can reach the Federal Court, which can order an organization to change its practices and award damages to the complainant. The concrete outcome of non-compliance is a court order and a payment, not an apology.
The OPC's access to personal information page describes how to file. One timing rule matters. The Commissioner may decline a complaint made more than a year after you learned of the problem.
Records to keep through a request
Keep one dated folder:
- A copy of the request you sent, with the date
- The platform's privacy policy as it read that month
- Every reply, including any written extension notice
- Notes from phone calls, with names and dates
- Your teenager's account identifiers and creation date
A complaint built on a dated sequence is stronger than one built on memory. The family agreements checklist covers the household terms worth writing down before a request is needed.
Where the rules differ across Canada
Provincial coverage is uneven. Each province with a substantially similar law runs its own commissioner and its own complaint form. Quebec's amendments added duties on retention and breach reporting that apply to organizations the province regulates.
Private-sector law
- Federal
- PIPEDA
- British Columbia
- Personal Information Protection Act
- Alberta
- Personal Information Protection Act
- Quebec
- Act respecting the protection of personal information in the private sector
Regulator for complaints
- Federal
- Office of the Privacy Commissioner of Canada
- British Columbia
- Office of the Information and Privacy Commissioner for BC
- Alberta
- Office of the Information and Privacy Commissioner of Alberta
- Quebec
- Commission d'acces a l'information du Quebec
The scope of PIPEDA stops where a substantially similar provincial law begins, so the structure of the platform decides the route. Schools sit outside all of this. provinces ban cellphones in class to different degrees, and those rules come from education ministries rather than privacy commissioners.
