--- title: "Gen(Z)AI | Forum Report: AI & Data Privacy" authors: julian-lam, helen-hayes, fergus-linley-mota, alexander-martin, madeleine-case, nonso-morah date: 2026-03-01 pdf: /files/publications/genzai-ai-data-privacy_2026.pdf permalink: https://mediatechdemocracy.com/en/publications/genzai-ai-data-privacy_2026/ --- GEN Z AI. YOUTH PRIVACY VANCOUVER, BC 02.20.26 — 02.22.26 Youth voices, Al futures "As AI systems become increasingly embedded in everyday digital platforms, the collection and use of personal data is expanding rapidly, often without clear transparency or meaningful safeguards. Young people encounter these systems constantly, yet many feel they have little control over how their data is collected, shared, or used. Our third forum focused directly on these issues. Drawing from their lived experiences, participants reflected on the need for stronger safeguards and clearer accountability around how AI systems handle personal data. This forum builds on the momentum of Gen(Z)AI and continues its youth-led work to inform emerging conversations on AI governance and data protection." ## **-Julian Lam** *Report Author and Lead Youth Fellow, Gen(Z)Al Forum on Al & Data Privacy* The Centre for Media, Technology and Democracy is an interdisciplinary research organization housed at the Max Bell School of Public Policy at McGill University. Its work is dedicated to understanding and responding to the social, political, and policy challenges posed by the evolving information ecosystem and digital technologies. The Dialogue on Technology Project (DoT) is the SFU Morris J. Wosk Centre for Dialogue's flagship initiative on technology and artificial intelligence. Drawing on the Centre's deep expertise in design, facilitation, consensus building, and conflict engagement, DoT brings together diverse stakeholders—community members, researchers, policymakers, industry, and civil society—to better understand and shape how AI and related technologies are transforming our lives and societies. # **Report Author** Julian Lam # **Project Leads** Helen Hayes Fergus Linley-Mota # **Contributors** Alexander Martin Madeleine Case Nonso Morah # **Operations Lead** Sequoia Kim # **Illustrator** Ibrahim Rayintakath # **Cover Design** Mathilde Robert # **Layout Designer** Sequoia Kim # **Special Thanks** Anna Jahn Taylor Owen ## **License** This work is licensed under a [Creative Commons Attribution NonCommercialSharealike 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/deed.en) [International License.](https://creativecommons.org/licenses/by-nc-sa/4.0/deed.en) You are free to share, copy and redistribute this material provided you give appropriate credit; do not use the material for commercial purposes; do not apply legal terms or technological measures that legally restrict others from doing anything the license permits; and if you remix, transform, or build upon the material, you must distribute your contributions under the same license, indicate if changes were made, and not suggest the licensor endorses you or your use Images are used with permission and may not be copied, shared, or redistributed outside of this material without the permission of the copyright holders. Gen(Z)AI was founded on the premise that young people deserve to have a meaningful role in shaping the future of artificial intelligence in Canada. As AI systems become increasingly embedded in everyday digital environments, the generation most directly affected by these technologies has too often been excluded from the policy conversations that determine how they are designed and governed. Gen(Z)AI was created to change that. This report summarizes the third chapter of Gen(Z)AI's national process, which was held in Vancouver, British Columbia on February 20-22, 2026. At this forum, which focused on AI and data privacy, young Canadians examined how artificial intelligence systems are reshaping the collection, use, and governance of personal data across digital environments. Participants described a digital ecosystem where data collection practices are often opaque and difficult to understand. For young people who interact daily with AIenabled technologies—from chatbots to algorithmically curated social media feeds—consent regimes are frequently complex, unclear, and difficult to meaningfully challenge. Participants emphasized that this lack of transparency undermines informed consent and their ability to control how their personal information is collected, used, and shared. This discussion made clear that, in a digital environment where pervasive data collection can make privacy invasion feel inevitable, participatory spaces like Gen(Z)AI can help young people feel heard and empowered to take back their agency and autonomy in digital ecosystems. This process is a reminder that real, empowering democratic engagement can happen when people are trusted to co-design governance mechanisms that reflect their lived realities. We look forward to working with Gen(Z)AI participants to present their final policy recommendations from all four forums in Ottawa in April 2026. At a moment when Canada is seeking to develop robust legislation on AI and online harms, it is absolutely essential that young people be treated as active partners in, and not only subjects of, this governance. *—Helen A. Hayes & Fergus Linley-Mota* Gen(Z)AI is a first-of-its-kind youth assembly that focuses on artificial intelligence (AI), bringing together 100 young Canadians aged 17-23 from across the country to contribute directly to discussions on the future of AI governance in Canada. The initiative is jointly organized by the [Centre for Media,](https://www.mediatechdemocracy.com/) [Technology and Democracy](https://www.mediatechdemocracy.com/) and the [Dialogue on Technology](https://www.sfu.ca/dialogue/what-we-do/initiatives/dot.html) [Project](https://www.sfu.ca/dialogue/what-we-do/initiatives/dot.html), in partnership with [Mila](https://mila.quebec/en), Quebec's AI Institute. This report outlines the purpose, methodology, and key findings of the third Gen(Z)AI forum, held in Vancouver and focused on AI & Data Privacy. The Vancouver forum was one of four regional forums, alongside sessions on chatbots, information integrity, and age assurance. Over three days, participants engaged with expert speakers, took part in workshops, and deliberated on policy challenges and opportunities related to AI and data privacy. A consolidated final report, which will outline the policy recommendations from each forum, will be released on April 30, 2026, following the completion of all four regional forums. ## **Forum Focus: AI & Data Privacy** Data privacy focuses on who is authorized to collect, process, and share an individual's data, and the degree to which that individual can meaningfully control such access. Data privacy has become a central concern in Canadian policy discussions on AI. A [2025 study](https://www.priv.gc.ca/en/opc-actions-and-decisions/research/explore-privacy-research/2025/por_ca_2024-25/) by the Privacy Commissioner of Canada found that 9 in 10 Canadians are concerned about their personal information being used to train AI systems. AI tools, in turn, ranked third among the most worrisome technologies for Canadians in terms of privacy. Among youth, data privacy in AI contexts is an especially pressing but largely overlooked concern. Youth rights in the digital age often lie at the periphery of national AI policymaking processes. A [UNICEF review of 20](https://www.unicef.org/innocenti/media/2516/file/UNICEF-Global-Insight-national-AI-strategy-) [national AI strategies](https://www.unicef.org/innocenti/media/2516/file/UNICEF-Global-Insight-national-AI-strategy-) found that relatively few nations meaningfully engage with AI's unique impacts on youth, including risks related to data protection and privacy. Canada's AI Strategy omits any reference to youth, and proposed federal privacy reforms fail to incorporate their distinct vulnerabilities. Participants at the Vancouver forum expressed deep concern that contemporary AI systems operate through opaque data practices that undermine their ability to express informed consent, to feel individual agency online, and to maintain a sense of community well-being. Across discussions, participants highlighted how they perceive the technology as intensifying surveillance and profiling, which often lack clear safeguards. A common feeling was that youth users are expected to make privacy decisions without meaningful transparency, which, in turn, results in apathy or resignation about data loss. Participants also acknowledged a deep tension between the personalization AI offers and, to some degree, the power imbalance it creates. Values such as accountability, stewardship, justice, and community repeatedly surfaced during discussions, suggesting a shared desire for governance frameworks that protect sensitive data and mitigate disproportionate harms to vulnerable groups, such as younger youth and the elderly. The third Gen(Z)AI forum on AI and data privacy combined expert briefings, preparatory resources, interactive workshops, and deliberative policymaking sessions. Participants engaged with perspectives on privacy regulation, child-centric platform design, and global policy approaches to AI systems and data before working collaboratively to identify priority concerns and policy directions. Ultimately, participants emphasized that governance models must ultimately work to restore trust and agency and also encourage collective responsibility in an increasingly datadriven society. **Participants identified two core issues of concern, captured in the following issue statements:** - **1. The way that AI systems collect user data and disclose that collection is deliberately opaque,** making it difficult for users to provide informed consent about how their data is being used and sold. This may disproportionately affect vulnerable groups, including children and the elderly. - **2. AI systems are not subject to adequate and enforceable safeguards for the collection, storage, and sharing of user data.** This may lead to (un)intended harms, including, but not limited to, excessive surveillance and profiling. **In response, participants developed policy recommendations to address harms related to AI & Data Privacy, which fell into the following broad categories:** ## **1. Reactive policy mechanisms:** These include policy tools that establish clear reporting pathways, remedies, and institutional responses when harm is caused by opaque consent mechanisms, data misuse and privacy violations related to AI systems. **2. Design and system-level mechanisms:** these approaches focus on addressing risks in the design of AI systems and platforms by embedding safeguards and limits on deceptive or manipulative practices before harms occur. This forum was the third of four national Gen(Z)AI engagements. Our last forum in Halifax will focus on age assurance. Following each forum, youth-developed policy recommendations will be shared with thousands of young Canadians through Make.org's civic dialogue platform to support broader deliberation and consensus-building. Once all four forums are complete, participants will reconvene in a hybrid setting in Ottawa on April 30, 2026, to present their final recommendations to government officials, policymakers, civil society organizations, and other relevant stakeholders. Gen(Z)AI engages 100 young Canadians aged 17 to 23 in a national program focused on artificial intelligence and its growing influence on Canada's social and democratic landscape. The program is jointly led by the [Centre for Media, Technology](https://www.mediatechdemocracy.com/) [and Democracy](https://www.mediatechdemocracy.com/) and the [Dialogue on](https://www.sfu.ca/dialogue/what-we-do/initiatives/dot.html) [Technology Project,](https://www.sfu.ca/dialogue/what-we-do/initiatives/dot.html) in collaboration with [Mila,](https://mila.quebec/en) Quebec's AI Institute. Data privacy focuses on who is authorized to collect, process, and share an individual's data, and the degree to which that individual can meaningfully control such access. Data privacy has become a central concern in Canadian policy discussions on AI. While often associated with personal data, the concept is broader in scope and includes any data that, if accessed by other people, may be seen as ["infringing on one's right to a private](https://hai.stanford.edu/assets/files/2024-02/White-Paper-Rethinking-Privacy-AI-Era.pdf) [life and personal autonomy.](https://hai.stanford.edu/assets/files/2024-02/White-Paper-Rethinking-Privacy-AI-Era.pdf)" As AI tools and systems proliferate across social media, education, health, and everyday digital services, questions about who can collect, process, and share data have become pronounced in policy debates in Canada and globally. For youth, these concerns are especially acute and yet under-addressed. Young people are extensively interacting with AI-driven applications, ranging from chatbots to social media feeds, operating under opaque consent regimes they struggle to understand. In a [study](https://www.viurrspace.ca/items/50acefbd-d593-412b-a7e8-3fadfad28b43) funded by the Office of the Privacy Commissioner (OPC) that examined public perceptions of AI and privacy, a significant proportion of youth respondents were skeptical about sharing their data with AI systems, and many reported limited awareness of how their data was being collected, processed, and used. These findings suggest that meaningful consent is often missing for young users interacting with such systems. Despite growing evidence of privacy risks posed by AI-enabled systems inherent in pervasive data collection practices, youth-specific privacy protections in Canada remain underdeveloped. Federal reform efforts, including proposed updates to private-sector privacy law and the failed [Artificial Intelligence and Data](https://ised-isde.canada.ca/site/innovation-better-canada/en/artificial-intelligence-and-data-act-aida-companion-document) [Act \(AIDA\)](https://ised-isde.canada.ca/site/innovation-better-canada/en/artificial-intelligence-and-data-act-aida-companion-document) did not establish clear standards that accounted for the distinct rights and heightened vulnerabilities of young people in digital environments. Several global approaches have sought to meaningfully protect youth, such as child-centred data protection regimes and age-appropriate design codes (as seen in the [EU](https://gdpr-info.eu/art-8-gdpr/) and [UK](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/introduction-to-the-childrens-code/)), yet Canadian responses have been comparatively cautious and piecemeal. Within this context, there lies an urgent need for a more coherent and coordinated national approach to AI and youth data privacy that genuinely protects and empowers young people within datadriven systems. # **The third Gen(Z)AI forum on data privacy aimed to:** - 1. Identify key issues and concerns held by young Canadians related to data collection and consent practices, algorithmic profiling, data misuse and purpose creep in relation to AI systems. - 2. Elevate lived experiences and involve youth directly in discussions on AI and data privacy. - 3. Develop youth-driven recommendations to strengthen data privacy in relation to AI systems for Canada. To ensure participants entered the process with the foundational knowledge needed to engage meaningfully, they were provided with a policy package in advance of the forum. This included a logistics and welcome guide outlining how a citizen's assembly works and what to expect over the three-day forum, including how participant input would shape the final outcomes of the Gen(Z)AI project. Participants also received a resource pack containing a technical overview of the topic, a short literature review, a scan of the Canadian policy landscape and relevant international approaches, and an introduction to core policymaking concepts and policy tools. These materials were designed to be accessible and digestible, laying a shared foundation for learning and informed discussion. **As with all four Gen(Z)AI forums, the third forum followed a hybrid participation model. On the first day, all 100 participants gathered virtually to hear from four expert speakers:** - **▪ Teresa Scassa**, Canada Research Chair in Information Law and Policy, University of Ottawa Law - **▪ Kris Klein**, President of IAPP Canada and founder of nNovation LLP - **▪ Sara Grimes**, Wolfe Chair in Scientific and Technological Literacy, McGill University - **▪ Riley McNair**, Senior Advisor, Information and Privacy Commissioner of Ontario Together, the speakers traced how evolving privacy laws, AI-driven data practices, and regulatory gaps shape the everyday digital experiences of children and youth in Canada. Drawing on a range of perspectives, ranging from legal and academic to professional and regulatory, their contributions illuminated the risks and opportunities of datafication of AI systems and the risks to youth privacy that they entail. **Teresa Scassa**, through a legal lens, examined how Canada's existing privacy framework struggles to protect young people amid pervasive data collection and AI-driven platforms. Key takeaways included that: - Canada's core private sector privacy law, the Personal Information Protection and Electronic Documents Act ([PIPEDA](https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/)), has not kept pace with online platforms and contemporary data practices. The government continues to frame governance as a tradeand-commerce issue rather than through a human-rights lens. - Weak enforcement powers and low penalties levied by privacy commissioners, combined with limited attention to children's data at the federal level, leave significant gaps in accountability and redress. - Recent reform efforts, such as Bill C-27, only partially address - youth privacy, largely codifying protections commissioners were already applying in practice. - Stronger safeguards would include privacy-by-design and by default, explicit recognition of children's data as especially sensitive, and more robust enforcement mechanisms to deter harmful corporate practice. **Kris Klein** highlighted how legacy privacy laws and consent-based models are ill-suited to today's datasensitive, AI-driven information ecosystem. Key takeaways included that: - Privacy frameworks built in the 1990s have not kept up with the scale and granularity of data collected by search engines, social media platforms, and AIdriven systems. - Relying primarily on individual consent and data minimization is increasingly inadequate, underscoring the need for ethical frameworks that guide what is acceptable to do with people's data. - The integration of AI and machine learning across consumer platforms enables highly personalized experiences that can be convenient but also enable intrusive targeting and profiling. - High-profile cases, such as retailers inferring pregnancy status from shopping habits to send targeted coupons, illustrate the risks of inferencebased marketing in the absence of stronger normative and legal constraints. **Sara Grimes** focused on children's digital rights, emphasizing how young people understand privacy and how current industry practices and regulatory responses often sideline their interests. Key takeaways included that: - UN consultations for General Comment No. 25 reveal that children have complex views on privacy and increasingly see it as a top priority, even as they remain uncertain about who is collecting their data and why. - Age-appropriate design approaches that set high privacy defaults and limit harmful content can protect children while also improving digital environments for everyone. - Many young people display strong digital literacy and a sense of resignation, doubting that they or existing legal frameworks can meaningfully protect their privacy in datadriven environments. **Riley McNair** outlined how Ontario's privacy regulator is responding to emerging risks in education technology and AI. This served as a case study for policy responses for AI systems affecting children and youth. Key takeaways included that: - New EdTech tools offer pedagogical benefits but also create tensions between business models and public education, including heightened risks of intrusive data collection, profiling, and biometric surveillance in schools. This lesson can also be applied to youth-facing AI systems. - Principles for responsible AI (valid, reliable, safe, privacyprotective, human rightsaffirming, transparent, and accountable), along with youthoriented resources like toolkits and guides, are central to strengthening youth privacy and agency This expert speaker day, combined with the accompanying resource package, provided participants with relevant background information to support informed discussion throughout the forum. During days two and three of the forum, 25 participants gathered in Vancouver at SFU's Wosk Centre for Dialogue for in-person deliberations. These sessions included a range of engagement activities, such as values mapping, Q&As, workshops, breakout groups, and deliberative policymaking exercises. All activities were facilitated by the Centre for Media, Technology and Democracy's Youth Fellows and led by Gen(Z)AI co-leads, Helen Hayes and Fergus Linley-Mota. On the third day, an additional 75 participants from across Canada joined through hybrid engagement sessions. Full-group discussions brought together all 100 participants and ensured that those joining remotely were included in key moments of the forum and able to engage meaningfully with their peers. Youth Fellow-facilitated virtual breakout groups gave online participants space to review prioritized issues and recommendations, ask questions, and offer feedback. Remote participants were also given time to reflect independently and submit written input, ensuring that perspectives from those participating virtually were fully incorporated. Following the conclusion of the third forum, the issue statements and policy recommendations developed by participants were shared with thousands of young people nationwide through Make.org's civic dialogue platform, providing additional insights. This national engagement process is ongoing and will remain publicly accessible until April 2026. # **The key issues identified by participants were summed up in the following issue statements:** - 1. The way that AI systems collect user data and disclose that collection is deliberately opaque, making it difficult for users to provide informed consent about how their data is being used and sold. This may disproportionately affect vulnerable groups, including children and the elderly. - 2. AI systems are not subject to adequate and enforceable safeguards for the collection, storage, and sharing of user data. This may lead to (un)intended harms, including, but not limited to, excessive surveillance and profiling. By identifying pressing AI and data privacy issues that most mattered to them, participants then turned to developing a set of accompanying policy recommendations. These recommendations were deliberated upon by all 100 participants and will be further considered and written by thousands of other young Canadians through [Make.org's civic dialogue](https://panoramic.make.org/en/partner/mila/event/gen-z-ai/dialogue) [platform](https://panoramic.make.org/en/partner/mila/event/gen-z-ai/dialogue). There was a strong consensus among participants that the current approach to data collection and governance in AI systems does not adequately protect users or provide meaningful transparency, especially for young users. Participants frequently emphasized that opaque data practices and complex platform design make it difficult for individuals to understand how their information is collected, used, and shared, thereby undermining the possibility of genuine informed consent. Many voiced concerns about the growing normalization of surveillance and data commodification, as well as the repurposing of data in harmful, unconsented ways. Participants ultimately gravitated toward calling for stronger accountability mechanisms, clearer safeguards governing the collection and use of personal data and greater transparency of where data flows and who controls it. Across discussions, there was a clear desire for governance approaches that prioritize user agency, community well-being and stewardship. This was all in view of ensuring individuals, especially youth, have the knowledge and tools necessary to make informed decisions about their participation in AImediated systems. The final recommendations from the forum will be shared publicly in April 2026, following the completion of the project and the remaining forum. Findings will be presented to the government, policymakers, civil society, and other key stakeholders. # **In general, participants applied two broad policy mechanisms to address harms related to AI & Data Privacy:** - Reactive policy mechanisms: These include policy tools that establish clear reporting pathways, remedies, and institutional responses when harm is caused by opaque consent mechanisms, data misuse, and privacy violations related to AI systems. - Design and system-level mechanisms: these approaches focus on addressing risks in the design of AI systems and platforms by embedding safeguards and limits on deceptive or manipulative practices before harms occur. This forum was the third of four national Gen(Z)AI forums. The next forum will take place in Halifax, with a focus on AI and age assurance. Each forum follows the same overall structure, combining in-person regional participation with hybrid cross-regional engagement to support collaborative discussion among young people from across Canada. Once all four forums are complete, the recommendations and findings will be brought together into a publicly available report. Participants will then reconvene in a hybrid setting in Ottawa in April 2026 to present their final recommendations to government officials, policymakers, civil society organizations, and other relevant stakeholders. This process underscores the importance of ensuring that young people have a meaningful role in shaping Canada's AI policy. As a generation that has grown up using digital platforms and systems, youth bring lived experience that is directly relevant to how AI affects everyday life, making this perspective invaluable. Canada is at a point where choices about AI governance will have long-term implications. Including youth as active contributors in this process is necessary to support policies that balance innovation, accountability, and public trust. **Teresa Scassa**, *Canada Research Chair in Information Law and Policy, University of Ottawa Law* Teresa Scassa is the Canada Research Chair in Information Law and Policy at the University of Ottawa Faculty of Law. Her research primarily focuses on privacy, data governance, AI regulation and open government. Scassa is one of Canada's leading legal scholars on digital policy. She frequently advises governments and international organizations on technology law and policy, and her work and advisory insights have played a key role in shaping Canadian debates on privacy reform and the legal frameworks needed to govern data-driven technologies. ## **Kris Klein**, *President of IAPP Canada and founder of nNovation LLP* Kris Klein is a leading Canadian privacy and technology lawyer and the President of the Canada Advisory Board of the International Association of Privacy Professionals (IAPP). He is also the founder of nNovation LLP, a technology law firm that focuses on privacy, data governance, artificial intelligence, cybersecurity, and emerging technology regulation. Klein advises organizations across the public and private sectors on compliance with Canadian and international privacy frameworks, including data protection, digital identity, and responsible AI deployment. He is widely recognized for his work advancing professional standards in privacy law and for contributing to the development of Canada's privacy governance ecosystem through the IAPP and broader policy engagement. ## **Sara Grimes**, *Wolfe Chair in Scientific and Technological Literacy, McGill University* Sara M. Grimes is the Wolfe Chair in Scientific and Technological Literacy in the Department of Art History and Communication Studies at McGill University. Her research focuses on the social, cultural, and policy dimensions of digital technologies, with particular attention to children and youth in digital environments. Grimes is internationally recognized for her work on digital media, privacy, platform governance, and the commercialization of children's data. She is the author of Digital Playgrounds: The Hidden Politics of Children's Online Play Spaces and has advised governments and international organizations on youth digital rights, children's privacy protections, and platform regulation. Her research bridges communication studies, policy, and critical technology studies to better understand how digital systems shape young people's experiences online. ## **Riley McNair**, *Senior Advisor, Information and Privacy Commissioner of Ontario* Riley McNair is a Senior Advisor at the Office of the Information and Privacy Commissioner of Ontario (IPC), where he works on privacy protection, digital governance, and emerging technologies. In this role, McNair contributes to policy development, research, and public engagement initiatives that address evolving privacy challenges across artificial intelligence, data governance, and digital public services. The IPC plays a key role in overseeing compliance with Ontario's privacy and access to information legislation, and McNair's work supports the office's broader efforts to promote transparency, responsible data practices, and the protection of individual privacy rights in an increasingly data-driven environment. Ask Me Anything speaker — **Oline Twiss**, *Deputy Commissioner, Information and Privacy Commissioner of British Columbia* Oline Twiss is the Deputy Commissioner, Information and Privacy Commissioner of British Columbia (OIPC BC), where she plays a senior leadership role in advancing privacy protection and access to information in the province. Twiss oversees key areas of the Commissioner's mandate, specifically around policy development, investigations and public education related to privacy rights and data governance. # GEN ZAI.