1. The shape of the bill
Bill C-34 — short title: the Safe Social Media Act — enacts two laws at once:
- The Digital Safety Act, which imposes duties on "regulated social media services," "regulated chatbot services" and other "regulated online services"; and
- The Digital Safety Commission of Canada Act, which creates a new federal regulator to enforce the first law.
If the structure feels familiar, it should: the duty-of-care core closely follows Part 1 of the previous Parliament's Bill C-63 (the Online Harms Act, which died on the Order Paper). What's new in C-34 is the under-16 social media ban, the age-verification mandates, and the regulation of AI chatbots.
2. Who is regulated
A "social media service" is any website or app accessible in Canada "the primary purpose of which is to facilitate interprovincial or international online communication among users … by enabling them to access and share content" s. 2(1). A service becomes regulated when it crosses a user-count threshold — but that threshold is not in the bill; it will be set later by regulation s. 6. Smaller services can also be swept in individually by regulation if cabinet sees fit.
Hold on to that thought: as written, the law applies to no one. Every service it covers will be chosen after the fact, by order of cabinet. Professor Michael Geist put it bluntly the day after tabling: "to what social media services does the law apply? The answer for the moment is none."
3. The duty of care — the part worth keeping
Operators of regulated social media services owe a "duty to act responsibly" ss. 31–41:
- implement measures "adequate to mitigate the risk" that users are exposed to seven defined categories of harmful content ss. 32–33 — the categories are intimate images shared without consent (including AI deepfakes), child sexual victimization content, content inducing a child to self-harm, content used to bully a child, content that foments hatred, content inciting violence, and terrorism or violent-extremism content s. 2(1);
- give users tools to block other users and flag harmful content ss. 35–36;
- label synthetic (AI-generated) content and bot-amplified content ss. 37–39;
- designate a human "resource person" users can actually reach s. 40;
- make child sexual abuse material and non-consensual intimate images inaccessible in Canada quickly once flagged, with a complaint path to the regulator if the platform fails to act ss. 43–47, 68; and
- publish a "digital safety plan" — a public accounting of risks and mitigations s. 42.
Operators of all regulated services additionally owe a "duty to protect children" through age-appropriate "design features" to be set by regulation ss. 20–21 — things like defaults, recommendation-system settings, and reporting tools.
Our position: this architecture is sound. It regulates systems and design, not individual speech; it targets the worst content categories through takedown only where the law has always drawn hard lines (child abuse material, non-consensual intimate images); and it leaves private messaging alone. This is what child-safety experts and civil society asked governments to do for years. Pass it.
4. The age mandates — the part that breaks it
The under-16 account ban (ss. 26–29)
For every regulated social media service that cabinet designates by regulation, the operator must "implement adequate age-verification or age-estimation measures designed to prevent a person under the age of 16 from being able to have an account" s. 27(1).
Read that carefully. You cannot verify that some users are under 16 without checking all of them. The mechanism of an under-16 ban is, necessarily, an age check on every Canadian who opens an account — by government ID, by face-scan "estimation," or by data-mining methods the bill leaves to the regulator's judgment of what is "effective" s. 27(2)(a).
The Commission may exempt a platform that shows its safeguards for children are sufficient s. 29 — an exemption process whose criteria, again, do not yet exist.
The pornography age-gate (ss. 22–23)
Separately, any operator with "reasonable grounds to suspect" that its service "provides access to pornographic content" must age-gate that service s. 22(1). This is not limited to pornography sites. Any large general-purpose platform — a social network, a forum, an image host — "provides access to" some pornographic content as a matter of arithmetic. The suspicion standard puts every major platform within the mandate's reach, and with it, every adult user behind an age check.
Why "age verification" means surveillance infrastructure. Every method on offer requires users to hand something sensitive to somebody: a government ID, a biometric face scan, a credit record, or behavioural data. The Electronic Frontier Foundation, after a decade of studying these systems, summarizes the record plainly: every scheme "forces users to reveal sensitive personal information to third parties simply to access the web," and once that data is collected it "becomes an immediate target for leaks, hacks, and misuse." The bill's data-destruction rules (below) reduce this risk; they cannot eliminate it, and they do nothing for the deeper injury — that anonymous access to the public square disappears.
5. The scanning door — s. 12(2)
Section 12(1) makes a welcome promise: nothing in the Act requires an operator "to proactively search content … in order to identify harmful content." No general monitoring obligation — good.
Then s. 12(2) opens a door through the promise: "Despite subsection (1), regulations … may require the operator of a regulated service to use technological means to prevent content that sexually victimizes a child or revictimizes a survivor from being uploaded to the service."
Today, that power is confined to child sexual abuse material — the one category where upload-screening against known-content databases is longest established. But understand what the subsection does: it lets cabinet, by regulation, order private companies to build automated content-scanning into their upload pipelines. Signal's president Meredith Whittaker has said of such architectures that there is "no way to implement client-side scanning … safely and privately. No, there is no technology there" — and Signal has told governments it would leave markets rather than build it. Scanning infrastructure, once mandated and built, is a capability awaiting new categories. The history of communications surveillance is the history of exactly that expansion.
6. The blank cheque to cabinet
Count what the bill defers to regulations: which services are regulated ss. 5–8; which platforms the under-16 ban covers s. 27(5); what age-assurance measures are required ss. 23, 28; the design features owed to children s. 21; the upload-screening power s. 126(1)(i); and dozens more. Professor Geist counts "19 distinct decision points reserved for the Governor in Council and a further 31 separate heads of regulation-making power" — roughly fifty consequential choices made after Parliament votes, by cabinet order and by a Commission that, as he notes, "does not yet exist, has no members, no chair, no staff, and even no funding model."
The Canadian Civil Liberties Association's verdict, the day after tabling: "A blank check for federal power is the wrong answer to a real problem." When Parliament cannot know what it is voting for, parliamentary scrutiny of a speech-affecting law happens only once — and not in Parliament.
7. The Commission and its powers
The new Digital Safety Commission can:
- compel testimony and documents "in the same manner and to the same extent as a superior court of record" s. 73, while it is itself "not bound by any legal or technical rules of evidence" s. 74;
- designate inspectors who may enter places (with a warrant, or with consent) to verify compliance — including "remotely by a means of telecommunication," with power to examine and copy documents and to use any computer system found there ss. 77–80;
- issue compliance orders s. 81; and
- impose administrative monetary penalties up to the greater of $10 million or 3% of gross global revenue s. 88, with prosecution-based fines up to the greater of $20 million or 5% for obstruction or breach of orders s. 107.
These powers aim at companies, not individual users — that distinction is real and we make it. But pair the penalty ceilings with the vague duty to mitigate "harmful content" (a list that includes contested categories like "content that foments hatred"), and the predictable corporate response is over-removal: when the fine for under-blocking is 3% of global revenue and the cost of over-blocking is zero, lawful speech is what gets traded away. The CCLA warns the obligations are "so alarmingly broad that providers … will be tempted to over-comply at the expense of users' freedom of expression and privacy rights."
8. The chatbot rules
C-34 is also the first Canadian bill to regulate AI chatbots directly ss. 48–58: operators must mitigate the risk of chatbots communicating harmful content, implement crisis-intervention measures when a user expresses suicidal intent, mitigate defined harmful behaviours, and publish digital safety plans. These provisions raise their own questions (the categories are set by regulation, again), but they follow the duty-of-care model rather than the identification model — there is no chatbot age-verification mandate in the bill as tabled. We flag them for completeness and watch the regulations.
9. The safeguards that are real
An honest reckoning requires listing what the drafters got right, because amendments should preserve these:
- Private messaging is excluded from all operator duties s. 11.
- Age-assurance privacy rules: measures must not collect or use personal information beyond age purposes, must destroy it once verification is complete, and must protect it until destroyed ss. 22(2), 27(2).
- Expression caveats: the age provisions "do not require the operator to implement measures that unreasonably or disproportionately limit users' expression" ss. 22(3), 27(3) — though note this merely declines to require such measures; it does not prohibit them.
- Preservation is narrow: content-preservation duties apply only to violence-inciting and terrorist content an operator has already removed, for one year, after which destruction is mandatory s. 41.
- Researcher access, not police access: Part 2's data-access regime serves accredited research organizations, with confidentiality conditions ss. 60–64.
- No imprisonment under the Act, full stop s. 111.
- Mandatory review of the minimum-age sections within three years s. 129 — an implicit admission that even the drafters aren't sure the ban is right.
These safeguards tell you the drafters heard the criticism of past bills. They also tell you the fight over C-34 is winnable: a government that wrote s. 27(3) can be persuaded to write the age mandates out entirely.