A registration form for children is almost always an adult form with a "parent's name" box bolted on. First name, date of birth, email, phone, allergies, photo permission, all on one page, often with an account created in the participant's name. When we handle website design for a day camp, a dance school, a sports club or a tutoring service, this is the page where Law 25 weighs the most, and the one that gets copied the fastest.
The rule for children under 14 fits in one sentence, and it turns on a question most forms skip: who is typing. This article follows that sentence through the form, field by field, whatever your sector.
The short answer, for the busy
In Quebec, section 4.1 of the Act respecting the protection of personal information in the private sector prohibits collecting personal information from a child under 14 without the consent of the person having parental authority or the tutor, unless collecting it is clearly for the child's benefit. For a registration form for a camp, a class or an activity, the practical consequence is simple: the parent fills in the form and gives consent, and the child appears only as a participant. The form asks only for what the activity needs (section 5). Allergies and health information are sensitive (section 12): explain what they are for, limit who can see them, and do not share them with a third party, beyond what you announced, without express consent. Photos and any publication need separate consent for each use (section 14). From 14 on, a teenager can consent on their own.
What section 4.1 actually says
The text is short: personal information concerning a minor under 14 years of age "may not be collected from him without the consent of the person having parental authority or of the tutor, unless collecting the information is clearly for the minor's benefit."
Three pieces matter. "Collected from him" targets collection directly from the child: the 11-year-old who fills in the soccer league's form on their own, or creates an account on a tutoring platform. "The person having parental authority or the tutor" is who consents in the child's place. And the exception, "clearly for the minor's benefit," is narrowed by its adverb. Our reading: it covers situations where waiting for a parent would harm the child, not a paid registration a parent can perfectly well complete.
Section 14 rounds it out. The consent of a minor under 14 is given by the person having parental authority or by the tutor; the consent of a minor 14 or over is given by the minor, the person having parental authority or the tutor. In its 2023 guidelines on consent, the Commission d'accès à l'information (CAI) puts it bluntly: consent given by a person under 14 is not valid.
Who fills in the form
The cleanest way to comply with section 4.1 is to never ask the child to fill in anything. The account belongs to the parent: their name, email and phone. The child is a participant record attached to that account. The copy speaks to the parent ("Does your child have any allergies?"), never to the child.
That choice also settles section 8: the information owed at the time of collection (the purposes, the means, the rights of access and rectification, the right to withdraw consent) goes to the parent, in clear and simple language.
For the consent itself, the CAI recommends favouring express consent, an active gesture such as ticking a box, and classes a pre-ticked box as implied consent. So: an empty box the parent ticks.
The same guidelines ask organizations to verify the capacity of the person consenting, with a level of certainty that is reasonable in context and without collecting more than needed to do it. For a dance class, a parent's declaration is enough, in our view. They also ask organizations to document consent, including the wording shown: keep the date, the version of the form and that wording. If the form changes mid-season, keep the old version.
Online booking tools are often built for an adult booking for themselves: check that yours separates the payer from the participant before you route children's registrations through it.
What the form asks for: necessity
Section 5 limits collection to the information necessary for the purposes determined before collecting it. Section 9 bars refusing a service to someone who declines to provide information, unless, among other cases, collecting it is necessary for the contract, and adds: "In case of doubt, personal information is deemed to be non-necessary."
Take each field and ask what breaks if you remove it. Age often decides which group a child joins; the birth year is sometimes enough, and the full date is not always needed. The school's name, the health insurance number, the participant photo "for our records," the parent's employer: some are justified for some activities, many are there because they were in the template you started from.
An optional field is a field the activity can do without. In our view, either remove it or tie it to a separate, announced purpose with its own consent box.
Allergies and health: a sensitive field
Section 12 defines as sensitive any information that, in particular because of its medical nature, "entails a high level of reasonable expectation of privacy." An allergy, a medication or a diagnosis qualifies.
Sensitive does not mean forbidden. According to the CAI, the express consent required for sensitive information is not needed when the use or communication is necessary for the primary purpose and announced at collection. Keeping an allergic child safe during the activity is exactly that kind of purpose. The form then has to say why it asks about allergies and who will see the answer.
The rest happens in the website more than in the wording. Security measures must be reasonable given the sensitivity of the information (section 10): in the admin area, a group leader sees the allergies of their own participants, not the whole staff and every group. In our view, the content of health fields does not belong in the notification email that lands in a shared inbox. And any unannounced communication to a third party requires, for sensitive information, express consent (section 13), unless the Act provides otherwise.
Finally, be wary of the big "other medical information" text box. It invites parents to write everything down, and you become responsible for all of it.
Photos, lists, results: one box per use
Section 14 requires consent given for specific purposes and requested for each of them. The CAI calls this granular consent: accepting several purposes as a bundle is not free consent.
On the form, that means one box per use: the group photo on the home page, the video of the end-of-session show, the participant list shared with other parents for carpooling, competition results published with the child's name. None of these boxes blocks registration. Section 14 also says consent is valid only for the time needed to achieve its purposes: the season, this summer's camp, not "forever."
Once a photo is published, civil law adds its own rules to Law 25. That side is in our article on photo consent, and checkbox wording is in our consent form examples.
The account a teenager creates alone
From 14 on, section 4.1 no longer applies and the teenager can consent personally: an online course platform can let a 15-year-old sign up alone, as long as it speaks in words they understand.
Under 14, the path has to fork. If the page asks for age and the answer is 12, the logical next step is to send the request to a parent. In a private-sector example from the CAI, a connected toy for children aged 5 to 8 records their answers, and the parent is the one who consents, by ticking a box on a web portal. An age question can be lied to, of course, and on verifying who consents, the CAI speaks of reasonable certainty, not infallibility. But a page designed so that a 10-year-old can sign up alone in three clicks will struggle, in our view, to pass as a reasonable effort.
Two general rules weigh more here. Section 9.1 requires the privacy settings of a technological product or service offered to the public to provide the highest level of confidentiality by default: a student profile that starts out private, for example. And section 8.1 governs technology that can identify, locate or profile a person. An advertising pixel on the confirmation page of a child's registration raises exactly that question; our guide to cookies and forms covers the implementation.
After the season
Once the purposes are achieved, section 23 requires destroying or anonymizing the information, subject to any preservation period provided for by an Act. Last summer's health records do not, in principle, need to wait in the platform for next summer: a re-registration can start from the parent's contact details.
The registration platform is a vendor holding this information on your behalf: see the contract Law 25 requires with every vendor. If it hosts the data outside Quebec, section 17 also requires a privacy impact assessment. For fields whose status is less obvious, see the edge cases your website collects. Daycares also have a sector-specific regulation, covered in our article on Law 25 in CPEs and daycares.
Where to start
Fill in your own form twice: once as the parent of an 8-year-old, once as a 15-year-old signing up alone. Note who is typing, what each field is for, and every consent box that hides several.
We build these forms in our website design projects, and bringing an existing site into compliance is part of our website security and compliance work.
→ Let's talk about your registration form
This article explains legal obligations to help a business ask the right questions; it is not legal advice. The text of the Act respecting the protection of personal information in the private sector and the positions of the Commission d'accès à l'information prevail: for a specific situation, consult a lawyer.
Written byXavier Peich