Overview

These best practices are for public sector organizations that support children and youth who use digital technology. This includes:

  • school boards
  • Children’s Aid Societies, including Indigenous Child and Family Well-being Agencies

They complement Ontario Regulation 52/26 under the Enhancing Digital Security and Trust Act, 2024 and are voluntary. They do not create legal requirements or replace applicable laws, regulations, directives or policies.

While these best practices are intended for public sector organizations, the information may also be helpful to parents, caregivers, educators and others who support children and youth.

Help children and youth build digital literacy

Understanding digital risks is an important part of helping children and youth stay safe online. Children, youth, parents, caregivers and the people who work with them all play a role in building digital literacy.

For additional resources on cyber security best practices for children and youth, visit Cyber Security Ontario’s K-12 Zone.

Recommended actions

  • Learn how technology can affect children's development, well-being, privacy and rights.
  • Teach digital literacy skills so children and youth can use technology safely, responsibly and confidently.
  • Advocate for and reinforce a culture of cyber awareness and secure practices across schools and their communities.
  • Include children and youth in decisions that affect their digital experiences. Encourage them to share their perspectives and help shape digital policies and practices that affect them.
  • Raise awareness of online harms, including cyberbullying, deepfakes and other harmful online experiences.
  • Learn about distinctions-based Indigenous data governance protocols and engage with Indigenous organizations when selecting or using technology that affects Indigenous children and youth.

Protect personal information and reduce privacy risks

Children and youth often need to share personal information to use digital tools and services. As their use of technology grows, so do the risks to their privacy. Strong privacy practices can reduce risks while allowing them to benefit from digital technology.

Build privacy awareness and understanding

  • Give children and youth tools and resources to help them understand their privacy rights and make informed choices about their personal information.
  • Explain privacy practices in plain language, including what information is collected, why it is collected and how it will be used. Where possible, provide information in languages used by the child's community.
  • Share terms of use, privacy notices and end-user licence agreements so children, youth, parents, guardians and caregivers can understand how personal information is handled.

Protect privacy by default

Use strong privacy and security settings by default on digital tools, applications (apps) and services used by children and youth. This includes:

  • keeping location tracking off unless it is needed for a specific purpose
  • notifying users when their location is being tracked
  • using generic or depersonalized accounts where possible
  • turning off Wi-Fi, Bluetooth, cameras and microphones when they are not needed

Assess and manage privacy risks

Review how digital tools collect, use, store and share personal information before introducing them. This may include:

  • conducting a Privacy Impact Assessment (PIA) when introducing or making changes to a system that collects, uses or discloses personal information
  • using the PIA to regularly review how personal information is managed and protected

Strengthen vendor or service provider accountability

  • Include privacy and data protection requirements in contracts with third-party vendors.
  • Consider requiring vendors to:
    • allow children and youth to access and correct their personal information
    • collect only the information needed to provide the service
    • provide easy-to-use privacy tools such as options to view, download or delete personal information

Prepare for and respond to online harms

  • Create a process for responding to privacy incidents and technology-related harms, such as cyberbullying or deepfakes.
  • Notify parents, guardians and caregivers when appropriate.
  • Encourage children and youth affected by online harms to access mental health or other support services when needed.

Respect Indigenous data governance

Respect Indigenous approaches to data governance. First Nations, Inuit and Métis communities should lead decisions about the management of data related to their communities, lands, people and resources.

Use devices, apps and digital services safely

Digital tools and services can support learning, creativity and communication. However, some digital products are designed to influence user behaviour and encourage people to spend more time using them.

Children and youth may be more vulnerable to these design features and online marketing practices. Understanding these risks can help organizations, parents, caregivers and educators make informed decisions about the technologies that children and youth use.

Review technology use

  • Review digital policies regularly and update them when new technologies or risks emerge.
  • Confirm that a digital tool or service is necessary before purchasing, implementing or renewing a digital product or service.

Choose age-appropriate and child-centred technology

  • Use digital tools, apps and services that are appropriate for a child's age, stage of development and individual needs.
  • Choose apps and digital services that do not display advertising to children and youth.
  • Avoid technologies that use manipulative design features that encourage users to share more information, make purchases or spend more time online than intended.

Reduce risk to children’s health and well-being

  • Learn how features such as infinite scrolling, personalized recommendations and frequent notifications can affect the health and well-being of children and youth.
  • Reduce exposure to predatory marketing by limiting the personal information shared with digital services and using anonymous or generic accounts where possible.

Strengthen privacy requirements for procurement

Consider privacy-protective procurement practices when selecting educational technologies. For more information, refer to the Office of the Privacy Commissioner of Canada’s resolution, Protecting the privacy of children and youth through responsible use of educational technologies in the classroom.

Review privacy, security and child safety risks throughout the technology lifecycle, including:

  • planning
  • vendor selection
  • contracting
  • agreement management
  • service termination

Use artificial intelligence safely and responsibly

Artificial intelligence (AI) is used in many tools and services that children, youth and organizations use every day. AI can support learning, automate routine tasks and improve access to information. However, it can also create privacy, safety and accuracy risks if it is not used carefully.

Helping children and youth understand how AI works can support safer and more informed use. Organizations should also consider the legal, ethical, privacy and safety risks associated with AI use.

Recommended actions

  • Set clear expectations for safe and responsible AI use for children and youth, including:
    • the risks of using AI
    • when AI should not be used
    • how to protect personal information when using AI
  • Develop and regularly review AI policies to address risks. Get input from children, youth, parents, caregivers, educators and communities where appropriate.
  • Teach children and youth how AI works and what it can and cannot do.
  • Help children and youth check whether AI-generated content is accurate, reliable and trustworthy.
  • Check and manage risks before giving children and youth access to AI tools.
  • Consider potential impacts on privacy, safety, fairness and well-being.
  • Use approved or trusted AI tools that meet your organization’s safety, privacy and quality requirements.