October 20, 2026 · Children’s privacy
The Privacy Commissioner published Canada’s first Children’s Privacy Code.
It addresses organizations subject to PIPEDA whose online services are directed at, or likely to be accessed by, children under 18. It explains expectations for consent, default privacy settings, data collection and age appropriate privacy information. The Code interprets existing privacy obligations. Comments are accepted until January 20, 2027, after which it may be updated.
Children’s Privacy Code, Office of the Privacy Commissioner of Canada
October 8, 2026 · Customer data and biometrics
The Privacy Commissioner updated guidance on recording customer calls.
It is for businesses subject to PIPEDA that record customer calls, including through outsourced providers. The update clarifies that voiceprints used to identify customers are sensitive biometric information and that express consent may be required. Businesses must explain the purposes of recording and must ensure that outsourced call handlers follow the same rules. This is updated guidance under existing privacy law.
Guidance, Office of the Privacy Commissioner of Canada
October 1, 2026 · Federal cyber security
New federal direction sets out cyber security actions for the frontier AI era.
Effective October 1, this direction applies to federal organizations covered by the Policy on Government Security. It sets out actions for asset inventories, vulnerability remediation, identity protection, layered defences, monitoring and recovery. Organizations must submit a prioritized list of critical services by November 30, 2026. These are federal government policy requirements; they do not apply generally to Canadian businesses.
Security Policy Implementation Notice, Government of Canada
