Would a Flock-type surveillance network fly under Canadian privacy laws?

INTRODUCTION

The system operated by Flock Safety in the United States has been in the news A LOT recently.  I’m going to break down why this would not fly in Canada, thanks to our federal and provincial privacy laws.

This hasn’t been tested by any Canadian courts yet, but my views are based on some pretty strong authorities.

I am not a US lawyer, so I’ll assume that what Flock Safety does in the US is consistent with American laws. What I plan to do in this episode is to apply a Canadian legal and privacy lens to examine whether such a system is consistent with Canadian laws.

In the YouTube version of this episode, I’ll have bookmarks so you can jump to different parts of this discussion in case there are aspects of this discussion you’re most interested in.

So could a company like Flock operate the same kind of surveillance network in Canada?

My conclusion is that the business model would run into some very serious problems with Canadian privacy law. And that's not because automated licence plate recognition is illegal in Canada. It isn't.

It's because our privacy laws place fundamental limits on the collection, retention, use, and disclosure of personal information. And those limits don't disappear just because the information was collected in a public place.

Let's get into it.

HOW ALPR SYSTEMS AND FLOCK SAFETY WORK

First, a little background.

Automated licence plate recognition, or ALPR, isn't particularly new.

It's been used by Canadian police departments for years.

The technology uses cameras and software to recognize licence plate numbers. In traditional police applications, those numbers are compared against a list of vehicles that police are interested in.

For example, a stolen vehicle, a vehicle associated with a missing person, or a vehicle registered to someone whose licence has been suspended.

If the system finds a match, that's called a hit.

If there's no match, that's called a non-hit.

The distinction between hits and non-hits is going to be very important in a few minutes.

Flock takes this technology and builds a much bigger business around it.

It sells subscriptions to its camera systems, cloud software, data storage, and investigative tools.

The customers aren't exclusively police departments.

A shopping mall might put cameras at the entrances to its parking lots. A business park might install them on its property. A residential community might put them at neighbourhood entrances.

And police departments can install them at intersections and along public roads.

The cameras photograph vehicles and produce searchable records including their licence plates, the time, the location, and other information about the vehicle.

All of this is managed through Flock's cloud platform.

Flock says that each customer owns its information and controls whether that information is shared with other organizations. It also says there isn't one single national database containing everything collected by its customers.

So a company that owns shopping centres can install cameras at its dozens of shopping centres and can use the data to investigate organized shoplifting rings. That company can choose whether the data from their cameras, located on their private property is shared only within the company or is shared more widely with local or national law enforcement.

That's an important distinction, but it doesn't change the privacy law implications overall, at least in Canada.

Customers making their information available to police agencies through a common searchable network is a disclosure of personal information for privacy law purposes.

In the United States, that can mean a police department searching information collected by cameras belonging to another police department thousands of kilometres away. Or information originally collected by a private organization.

One value of Flock's network is that it allows police to search historical information about where vehicles have been. Instead of asking whether a particular vehicle is wanted right now, police can potentially ask where that vehicle was yesterday, last week, or on some particular date. I don’t doubt that this has investigative utility.

But it does bring us to one of the big problems, at least in Canada.

PUBLIC INFORMATION IS STILL PERSONAL INFORMATION

There's a very common misconception about privacy law.

Some people assume that if something happens in public, it's fair game.

If I can see your licence plate when you drive past me, why shouldn't I photograph it?

And if I can photograph it, why shouldn't I put it in a database?

And if I can put it in a database, why shouldn't I share that database with the police?

Well, Canadian privacy law doesn't work that way.

The starting point is the definition of personal information.

Under the federal Personal Information Protection and Electronic Documents Act, or PIPEDA, personal information is information about an identifiable individual.

We have similar definitions under provincial private-sector and public-sector privacy laws.

Now, the definition doesn't say that the information has to be secret. It doesn't say the information has to be confidential. It doesn't say that it has to have been collected inside someone's home.

Information about an identifiable individual can be personal information whether it was collected in public or in private.

Take a photograph of me walking down the street.

That's personal information about me, even though I was standing on a public sidewalk.

If you record my name, that's personal information, even though my name might be publicly available.

And if you record my licence plate together with a time and location, and that information can reasonably be linked to me, that's personal information too.

I’ve done a number of episodes on photography and videography in public places.I’ll link to them below. If you’re an individual, in your personal capacity, you are free to take photos or record videos in public places to your heart’s content. But businesses and the state are subject to specific privacy laws.

There is some nuance in the case law concerning licence plates by themselves.

In a case called Leon’s Furniture Limited v. Alberta, the Alberta Court of Appeal concluded that a licence plate number collected by a furniture store wasn't personal information in the particular circumstances of that case.

But that doesn't mean licence plate information is categorically outside privacy law.

What matters is the context.

Is the information about an identifiable individual? Can it be linked to that person? What information is being collected along with the plate number?

A surveillance system deliberately designed to create searchable records of vehicle movements presents a very different situation from an isolated plate number written down by a store employee.

And that's precisely the distinction that the British Columbia Information and Privacy Commissioner made in an important investigation that we'll come to shortly.

There's another important distinction here.

Under section 8 of the Canadian Charter of Rights and Freedoms, whether someone has a reasonable expectation of privacy is fundamental to determining whether government conduct constitutes a search.

Information being exposed to public view is relevant to that analysis but it doesn't automatically settle the question.

The Supreme Court of Canada has repeatedly recognized that privacy is contextual and that technology can reveal information about people that goes far beyond what an ordinary observer might learn.

A single observation of your car on the street is one thing.

A detailed, searchable history of your movements is something else.

And under Canadian privacy legislation, the analysis doesn't even begin with the question of whether you had a reasonable expectation of privacy under section 8.

It begins with the statutory definition of personal information and the legal requirements for collecting, using, and disclosing it.

Publicly visible does not mean publicly available for every purpose. And publicly available does not mean unregulated.

PRIVATE BUSINESSES CANNOT CROWDSOURCE SURVEILLANCE

Let's begin with the private-sector side of Flock's business model.

Imagine a shopping mall in Canada installs Flock cameras at every entrance to their parking lots.

The cameras automatically collect licence plate numbers and information about vehicles entering and leaving the parking lot. Maybe the mall wants to deter theft. Maybe it's concerned about vehicle break-ins.

I’ll concede these are legitimate security concerns.

But now imagine that the mall contributes all of those records to a system that makes them searchable by police departments across Canada.

That's where Canadian private-sector privacy law becomes a major obstacle.

Under PIPEDA, and similar privacy legislation in provinces such as British Columbia, Alberta, and Quebec, organizations are generally required to obtain consent for the collection, use, and disclosure of personal information, unless a statutory exception applies.

Consent is not simply a one-time permission to do whatever the organization wants.

The individual has to understand the purposes for which their information is being collected, used, and disclosed.

And there are limits on what an organization can do, even with consent.

So let's return to our shopping mall.

When someone drives into the parking lot, have they consented to having their licence plate and movements recorded?

That depends on the circumstances, and there would have to be adequate signage letting everyone know what’s going on.

There may be situations where appropriate, limited video surveillance is justified for a legitimate security purpose.

But have they consented to having that information contributed to a national law enforcement surveillance network?

I would suggest that the answer is almost certainly no.

And simply putting up a sign saying that the property is under video surveillance doesn't necessarily solve that problem. All collection of personal information has to be limited and proportionate to the specific purposes for the collection, use and disclosure of personal information.

A reasonable person might understand that a security camera is recording activity in a parking lot.

That doesn't mean they understand that the information will be available for retrospective searches by police departments in other cities or provinces. Nor does the fact that an individual voluntarily drove into a parking lot mean that they consented to an unlimited range of secondary uses.

There are exceptions to the consent requirements, including certain disclosures for investigations and law enforcement purposes. But these are limited statutory exceptions. They are not a general licence for a private company to collect information about everyone who drives past and make that information continually available to government agencies.

Providing information in response to a properly authorized police investigation is one thing but creating a standing arrangement to supply police with access to information about everyone is another.

And there's a second legal obstacle.

A REASONABLE PURPOSE IS REQUIRED, EVEN WITH CONSENT

Section 5, subsection 3 of PIPEDA contains one of the most important provisions in Canadian privacy law.

It says that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

Think about that for a moment.

Even if an organization obtains consent, it still has to demonstrate that the purpose is appropriate.

The Office of the Privacy Commissioner of Canada has published guidance explaining how this test works.

Among other things, regulators consider whether the organization has a legitimate need for the information, whether the collection is effective in meeting that need, whether less privacy-invasive alternatives are available, and whether the loss of privacy is proportionate to the benefits.

Now apply that test to a networked, multi-user surveillance system.

Is preventing theft from a shopping mall a legitimate purpose?

Yup.

Could security cameras contribute to that purpose?

Yup.

But is it necessary to retain a searchable record of every vehicle that enters the mall?

Is it necessary to contribute those records to an interconnected surveillance network?

Is it proportionate to make information about thousands of innocent customers available to law enforcement agencies for investigations having nothing to do with the shopping mall?

I think Canadian privacy regulators would have some serious concerns.

And I would go further.

I don't think routine, indiscriminate collection of vehicle movement information for contribution to a nationwide surveillance network would satisfy the reasonable-purpose requirement.

The fact that some of that information might someday be useful in an investigation doesn't make collecting all of it reasonable today.

And that's really the problem with the crowdsourcing model.

Each individual business can reasonably collect information for its own security.

But the system creates an additional purpose: accumulating surveillance information for use by other organizations. That is a fundamentally different purpose.

And it's one that needs its own legal justification.

THE B.C. PRIVACY COMMISSIONER ALREADY CONSIDERED THIS

Now, we don't have to speculate entirely about how Canadian privacy regulators might approach this.

In 2012, the Information and Privacy Commissioner for British Columbia, Elizabeth Denham, published an investigation into the Victoria Police Department's use of automated licence plate recognition.

It's Investigation Report F12-04. I’ll link to it below.

And even though the report is more than a decade old, its reasoning is relevant to today's debate about Flock.

At the time, Victoria Police were using ALPR cameras mounted on patrol vehicles.

The cameras scanned passing vehicles and compared licence plates against information identifying vehicles of interest to police. The system operated in partnership with the RCMP.

The RCMP maintained the underlying alert database, and Victoria Police supplied information generated by its ALPR system. (In British Columbia, many municipalities like Victoria have their own police departments, and the RCMP acts as the provincial police department and is the police agency of jurisdiction where there is not a municipal force.)

One of the first questions the Commissioner considered was whether the information collected by the cameras was personal information.

The Victoria Police Department had suggested that it wasn't.

The Commissioner disagreed.

She concluded that licence plate numbers, associated photographs, and information about the time and place where a vehicle was observed constituted personal information.

The reason was straightforward.

Police could connect licence plate numbers to identifiable individuals through motor vehicle and other law enforcement databases. That’s one factor that distinguishes this from the Alberta Court of Appeal decision in Leon’s: a retailer can’t connect a license plate to its owner. The police can.

The information collected by the ALPR system could reveal where someone's vehicle had been at a particular time.

And that made it information about an identifiable individual, because cops can make that connection.

So the Commissioner concluded that ALPR was collecting personal information.

But that didn't mean the police were prohibited from using the technology. In fact, she recognized that police could lawfully collect information to compare licence plates against a list of vehicles of legitimate law enforcement interest.

And here's where the distinction between “hits” and “non-hits” becomes crucial.

When the system scanned a licence plate and found a match with a legitimate police alert, that was a hit.

Police could investigate the hit and retain relevant information for an authorized law enforcement purpose.

But when the system scanned a licence plate and found no match, that was a non-hit.

And the Commissioner concluded that the police no longer had a lawful purpose for using that information once the comparison had been completed.

The police had collected the information to determine whether the vehicle was of interest. The comparison was complete. The vehicle was not of interest. End of story.

The Commissioner recommended that information relating to non-hits be deleted immediately after the system determined there was no match.

She also considered the disclosure of non-hit information by Victoria Police to the RCMP.

And her conclusion was that this disclosure was not authorized under British Columbia's Freedom of Information and Protection of Privacy Act.

This is especially important.

The fact that the recipient was another police agency did not automatically make the disclosure lawful.

The Commissioner distinguished between sharing information associated with legitimate law enforcement hits and sharing information about vehicles that were not of interest to police.

The first could be authorized. The second, in the circumstances she investigated, was not.

And that is about as direct a challenge to the Flock model as you could imagine.

Because what makes the Flock network valuable is precisely its ability to retain and search historical observations, including observations that were not connected to any identified law enforcement concern when they were collected.

The B.C. Commissioner was saying that police couldn't simply hold on to those non-hits for speculative future use.

And they couldn't send the information to the RCMP merely because the RCMP operated the central system. That’s a disclosure of personal information that has to be justified under BC’s privacy law.

WHAT ABOUT THE REST OF CANADA?

Now, this was a British Columbia investigation, and we need to be careful about that.

Canada doesn't have one uniform privacy statute that applies to every police department.

Municipal and provincial police are generally subject to the applicable provincial public-sector privacy legislation. The RCMP is subject to federal privacy law, including the federal Privacy Act.

The precise statutory wording and permitted disclosures vary.

So it would be too simple to say that one B.C. investigation is binding on every police department in the country. But the underlying principles are not unique to British Columbia.

All of our public sector privacy laws have provisions that limit collecting information to an authorized purpose, limiting its subsequent use, protecting it from unauthorized disclosure, and not retaining personal information indefinitely just because it might be useful someday.

And we have support for those principles from Ontario. In December 2024, the Information and Privacy Commissioner of Ontario updated its guidance on the use of ALPR systems by police services.

The guidance makes the same fundamental distinction between hits and non-hits.

It says non-hit information should only be collected or used briefly, to determine whether the plate matches a legitimate alert.

And once the system determines that the information is a non-hit, it should be deleted as soon as technologically feasible.

The Ontario guidance recognizes narrow circumstances in which police may need to preserve particular information while establishing whether they have lawful authority to use it.

But that's very different from indiscriminately retaining everyone's movements.

It's also worth acknowledging that some Canadian police services have adopted more permissive retention practices, which may not align with legal requirements.

For example, Toronto Police publicly report retaining non-hit records for seven days.

That illustrates an important point: Canadian police practices are not entirely uniform, and there are unresolved questions about whether every deployment complies with the applicable privacy rules.

But the approach taken by the B.C. Commissioner and reflected in Ontario's guidance is clear.

A legitimate police need to identify particular vehicles does not create a general authority to accumulate information about every vehicle.

If a police agency wants to create a historical database of everyone's movements, it needs to establish a lawful basis for that collection, retention, and subsequent use.

It cannot simply assume that because a licence plate was visible on a public road, everything about the vehicle's movements is available for unrestricted police use.

A MULTI-USER, NETWORKED SYSTEM IS THE BIG PROBLEM

There's another important issue with the Flock model.

Even if a Canadian police agency could lawfully collect particular ALPR information, that doesn't mean it can freely disclose that information to everyone else.

Suppose a police department in Halifax collects information about vehicles on Halifax streets.

The records are stored using software supplied by a private company. That alone isn't necessarily unlawful.

Police and other public bodies routinely use private contractors and cloud service providers to process and store information without any issues.

The question is whether the contractor is processing information on behalf of the police, subject to appropriate contractual and statutory safeguards, or whether the information is being made available to other organizations for their own purposes.

Those are two very different situations.

Now imagine the Halifax police department enables searches by police agencies in Toronto, Vancouver, Calgary, and hundreds of smaller communities.

And perhaps those agencies make their own information searchable in return. That is not simply outsourcing data storage. That is an arrangement for cross-agency access to personal information.

And Canadian public-sector privacy legislation regulates disclosures of personal information.

Police departments may disclose personal information for legitimate law enforcement purposes where legislation authorizes them to do so. There are provisions permitting police information sharing and cooperation. But those provisions are not unlimited.

The original collecting agency must have lawful authority for the disclosure, and the recipient must have lawful authority for its own collection and use.

Having a common commercial software provider doesn't create that authority. Neither does a data-sharing agreement. And neither does the assertion that the information might someday help solve a crime.

Remember the B.C. investigation. The Commissioner specifically found that Victoria Police were not authorized to disclose non-hit information to the RCMP under the arrangements she investigated.

And that's especially important because the RCMP was an actual law enforcement agency involved in operating the ALPR program. If that disclosure was not permitted, imagine the difficulty of justifying routine access to non-hit information by thousands of other organizations.

And don't forget the private-sector contributors.

Police receiving information from a shopping mall or a residential community need to consider the legal basis on which that information was obtained and disclosed. The Supreme Court of Canada in Bykovets said that the police needed a court order to collect an IP address from a private company. A license plate number and a specific location is more sensitive and more “biographical” than an IP address, and would inherently have a higher expectation of privacy than an IP address for Charter purposes.

An organization can't make an otherwise unlawful surveillance arrangement lawful merely by inviting the police to participate.

IT DOESN'T MATTER WHETHER THERE IS ONE DATABASE

Now, Flock makes an important point about its architecture. It says it doesn't simply combine everybody's information into one national database. It says its customers own their data and control who can access it.

That may be an important contractual and technical distinction.

But for Canadian privacy law purposes, it isn't the end of the analysis.

If police department A can search records collected by police department B, there has to be a lawful basis for that access.

The same applies if the records are held by one company on two different servers.

Or in two different customer accounts.

Or through a federated search system where the information stays in separate databases.

The issue isn't where the database sits. It's what information is collected, who can access it, and what they're allowed to do with it.

If you create a system that permits thousands of different organizations to search records of people's movements, calling it a network rather than a database doesn't change the underlying privacy issues.

Nor does saying that every participating organization owns its own records.

Privacy law doesn't stop applying when information is shared between organizations that have signed contracts with each other.

Again, that may be entirely consistent with US laws, but Canadian privacy laws are significantly different and present a real barrier to the adoption of a system like this.

DOES THIS MEAN CANADA CANNOT USE ALPR?

Absolutely not. ALPR can be a legitimate and useful law enforcement technology. That kind of system can be designed to comply with Canadian privacy requirements. The Information and Privacy Commissioners of British Columbia and Ontario said as much.

Police may also be able to retain and disclose information relating to legitimate investigations, subject to the applicable laws.

And there may be narrowly tailored investigative uses of historical information where police have specific legal authority, including judicial authorization where required. None of this means police have to abandon modern technology.

The question is whether the technology has been designed around a legitimate and authorized purpose.

What I don't think fits within our existing legal framework is the idea that a range of private businesses, shopping centres, residential communities, and police departments can contribute collected vehicle observations to a searchable surveillance system.

This is particularly the case where the records concern people who are not suspected of any wrongdoing.

There's an enormous difference between using technology to identify a stolen car and using technology to create a retrospective history of everyone's movements just in case that information might someday be interesting. That distinction is fundamental to Canadian privacy law.

CONCLUSION — THE DIFFERENCE BETWEEN SEEING AND SURVEILLING

Here's where I think the Flock debate reveals something important about privacy.

We often hear the argument that if you have nothing to hide, you have nothing to fear.

And that if you're driving on a public road, you can't really expect privacy.

But privacy isn't just about hiding things.

It's also about limiting the ability of others, including governments and private companies, to collect and assemble information about our lives. It’s about the right to be left alone to live your life without constant surveillance.

You might reasonably expect that someone could see your car parked outside a restaurant.

That doesn't mean you should expect a private company to maintain a searchable history of every restaurant you've visited.

You might expect that a police officer could observe your vehicle on a public street.

That doesn't mean the police should be able to reconstruct months of your movements without an appropriate legal justification.

Canadian privacy law recognizes that distinction.

Information about identifiable individuals remains personal information even when it is collected in public.

The fact that it is publicly visible may affect the level of privacy protection that applies, particularly under the Charter. But it doesn't turn that information into something that can be collected, used, retained, and disclosed without limits.

Our private-sector privacy laws impose requirements for consent, lawful purposes, and proportionality. Our public-sector privacy laws impose requirements for authorized collection, use, retention, and disclosure.

And the B.C. Information and Privacy Commissioner's investigation into ALPR shows that these principles aren't just theoretical.

I think those principles create formidable barriers to importing a Flock-type surveillance network model into Canada.

Just because you can see it doesn't mean you can surveil it.

 

 

What Canadian law says about smart glasses, and using them in public and semi-public places.

 

Here’s a simple question: Can you legally wear smart glasses and record people in public in Canada?

The short answer is: generally, yes.

But—because this is privacy law—the complete answer is a bit more complicated.

And I think smart glasses are particularly interesting because the technology is challenging some of our social norms about recording. But we need to remember that some of those norms include the ability to photograph and record what happens in public.

Before I went into law school, I collected two history degrees so I often like to think about these things in their historical context. I think we’re seeing a bit of a “moral panic” about smart glasses, and this is not without precedent. In 1888, Kodak introduced the world’s first “compact” camera. They were promoted as taking “candid” photos. Before then, some guy with a huge camera on a tripod wasn’t really sneaking up on people. That led to a real backlash about “Fiendish Kodackers” who would allegedly be lurking in the bushes, just waiting to take your picture.

If they had been banned, a huge amount of creative output would have been lost.

I also think about what happened when phones started to have built-in cameras. There was a general freak-out about privacy, and calls to ban them in certain places. The reality is that we somehow survived.

Smart glasses fit into the same category.

WHAT ARE SMART GLASSES?

What am I talking about? First, when I say “smart glasses,” I’m talking about things like the current generation of Ray-Ban Meta glasses and similar devices.

These look reasonably close to conventional glasses, but they can incorporate cameras, microphones, speakers and computer processing.

For example, the Ray-Ban Meta glasses have a camera and microphones and can take photos and record video with audio. They have a small outward-facing light that is supposed to indicate when a photo or video is being captured.

This is obviously not an entirely new idea.

Google Glass famously raised many of these questions more than a decade ago. I talked about Google Glass in my episode about recording conversations.

But the technology is getting much better and, importantly, much less conspicuous.

A person holding a phone out in front of them is obviously taking a picture or recording something.

Someone wearing glasses is just … wearing glasses.

And I think that difference explains a lot of the discomfort.

START WITH THE ORDINARY RULE FOR PHOTOGRAPHY

But let's start with the law rather than the discomfort.

I've previously done an episode about taking photographs and video in public places in Canada. I’ll link to it below: https://youtu.be/KQJuWrunUVs.

The general rule is pretty straightforward.

If you are lawfully in a public place, you can generally photograph or record what you can see from that public place. There isn't a general rule in Canadian criminal law that says you need somebody's permission before they can appear in a photograph or video taken in public.

That doesn't mean absolutely anything goes. You can't obstruct traffic to get your shot. You can't assault somebody. You can't trespass. You can't interfere with police carrying out their duties.

The only time you really need anyone’s permission is if you’re going to use their image commercially, like in an ad.

And there are important privacy-related exceptions that I'll get to.

But the starting point is that we live portions of our lives in public while other people are allowed to observe us. And generally they're allowed to photograph what they can observe. Smart glasses don't fundamentally change that.

If I can stand on a sidewalk and take a photograph with my Nikon camera, or an iPhone, the fact that the camera is now built into my glasses doesn't ordinarily turn the photograph into something illegal.

That is an important starting point.

BUT IT FEELS DIFFERENT

A hidden camera (or at least one that’s harder to detect) changes things. I think this is where the technology is challenging our norms.

If someone points a DSLR camera at you, you know you're being photographed.

If somebody holds up a phone, you generally know what's happening. Smart glasses make the recording device almost disappear. And that matters socially.

People behave differently when they know they're being recorded. They likely regard concealed or unobtrusive recording as sneaky or rude. It may be confrontational.

But “I don't like being recorded” and “it is illegal to record me” are two very different things.

Do we need a new law because the camera has gotten smaller? I don’t think so.

Cameras have been getting smaller for more than a century.

And there are good reasons why our law generally allows photography in public.

People record demonstrations. They record accidents. They record public officials. They record the police. They record misconduct. They record newsworthy events.

And, of course, most photographs are much more mundane than that. People document their vacations, their families, their pets and whatever they had for lunch. I watch a lot of YouTube videos, and it’s clear that many creators are using them for hands-on videos and demonstrations.

Recording what happens around us has become an ordinary part of modern life.

THEN THERE'S VOYEURISM

But there are also places where recording with smart glasses could become criminal very quickly.

Canada has a voyeurism offence in section 162 of the Criminal Code.

It applies to surreptitious observation or visual recording where the person being observed or recorded is in circumstances giving rise to a reasonable expectation of privacy, combined with one of the additional circumstances set out in the section concerning nudity, sexual activity or a sexual purpose.

The obvious examples are washrooms, changerooms and bedrooms.

I would expect a court would say that a camera that looks like glasses is almost by definition “surreptitious”.

And the Supreme Court of Canada has made it clear that “reasonable expectation of privacy” isn't simply another way of saying “private property.”

That's the important lesson from R. v. Jarvis.

Jarvis was a high-school teacher who secretly recorded female students using a camera concealed in a pen. The recordings were made in common areas of the school.

The Supreme Court held that the students could nevertheless have a reasonable expectation of privacy from that particular kind of recording.

The Court said you have to look at the whole context: where the person was, how the recording was made, whether they knew about it, what was being recorded, the relationship between the people involved, the purpose of the recording and a number of other factors.

That is particularly relevant to smart glasses.

The fact that another person can see you does not necessarily mean they can secretly make any kind of recording of you for any purpose.

In my earlier episode I made essentially the same point: privacy expectations can depend not only on where you are, but on the method and character of the observation.

CIVIL PRIVACY CLAIMS

The criminal law isn't the whole story either. Depending on the province, there can also be civil claims for invasion of privacy. Some provinces have statutory privacy torts. Some common-law provinces recognize causes of action such as intrusion upon seclusion, and courts have continued to develop privacy-related causes of action.

Again, context matters enormously.

It would ordinarily be difficult to argue that simply appearing incidentally in somebody's video as they walk down a public street amounts to a serious invasion of privacy.

But deliberately using inconspicuous technology to intrude into something that really is private can be an entirely different matter.

The question is not simply: “Could somebody see me?” It may also be: “What information were they deliberately capturing? How did they capture it? Where was I? What was I doing? And what was my reasonable expectation of privacy in those particular circumstances?”

Smart glasses make those questions more important, not less important.

PRIVATE PROPERTY IS DIFFERENT

Now let's move from a public sidewalk to a shopping mall. Or a restaurant. Or a grocery store. Or an office. Or a school. Or a hospital.

These may feel like public places because members of the public routinely go into them. But legally, many are private property.

And the owner or lawful occupier of private property gets to establish conditions on your permission to be there.

A restaurant can say no smoking. A store can say no pets. A concert venue can prohibit professional cameras. And a property owner can say: “No smart glasses.” Or: “You can wear them, but you cannot use the camera or recording functions.”

If you've been put on notice of the condition and refuse to comply, the issue can ultimately become one of trespass.

A whole lot of venues are turning their minds to it. At least one dance bar in Toronto has banned them from their premises.

That's exactly the same principle that applies to ordinary photography on private property, which I discussed in my earlier episode.

This is particularly important for places like schools.

A school may have extremely good reasons for regulating recording devices. Some schools in British Columbia have started prohibiting their students from using them on campus, citing both privacy and academic integrity concerns.

An employer may prohibit employees from recording meetings.

A hospital may restrict recording in patient-care areas.

A gym may prohibit smart glasses in changing facilities.

And none of this requires the underlying activity to be criminal.

Property owners and organizations can establish rules that are more restrictive than the Criminal Code.

WHAT IF THE GOVERNMENT BANS THEM?

Things get more complicated when the government gets involved.

Suppose a municipality says: “No smart glasses in municipal parks.” Or a police department says: “No cameras or recording devices anywhere on police property.”

Some are calling for a ban on such devices at public pools and change rooms in British Columbia. These are public places and the rule-maker is a government actor who is subject to the Charter.

A ban creates a Charter issue.

Section 2(b) of the Canadian Charter of Rights and Freedoms protects freedom of thought, belief, opinion and expression, including freedom of the press and other media of communication.

Photography and videography are expressive activities.

Restricting photography is restricting expression. On its face, it is a violation of section 2(b) of the Charter.

I did an entire previous episode about attempts by police departments to prohibit photography on police property. But there is an important qualification. The fact that property is government-owned doesn't automatically mean you have a constitutional right to engage in every expressive activity everywhere on that property.

The Supreme Court has said that when expression takes place on government-owned property, courts look at things like the historical and actual function of the place and whether allowing the expression there is compatible with the values underlying freedom of expression.

A public street is very different from a cabinet meeting room.

So I would be very skeptical of a general government prohibition on wearing or using smart glasses throughout ordinary public spaces. That would potentially prohibit an enormous amount of otherwise lawful photography and recording.

But a narrowly tailored restriction in a particular government facility where confidentiality, security or privacy is genuinely necessary presents a much more complicated Charter analysis.

And even where section 2(b) is infringed, section 1 allows governments to justify reasonable limits prescribed by law where the constitutional test for justification is met.

So context matters there too.

THE REAL ISSUE IS THAT THE TECHNOLOGY IS BECOMING INVISIBLE

And I think that's ultimately what makes smart glasses interesting.

The law is actually fairly familiar.

We know quite a bit about photography.

We know quite a bit about video recording.

We know quite a bit about audio recording.

We know quite a bit about reasonable expectations of privacy.

We know quite a bit about private property owners establishing conditions of entry.

What is new is putting all of those capabilities into something that looks like an ordinary pair of glasses.

The technology is becoming less visible.

And that changes the social signalling that historically accompanied recording.

When someone pointed a camera at you, you knew what they were doing. The signals are changing. It happened with the Kodak camera. It happened with camera phones and it’s happening with smart glasses.

Now you may not know what’s a camera and what’s not.

And I think we're going to spend the next few years negotiating new social norms around that.

Workplaces will create specific policies.

Restaurants and gyms put up signs.

Maybe manufacturers make recording indicators much more obvious. Governments may pressure them to do so.

But we should distinguish those emerging social norms from the underlying law.

Because one of our existing norms is also important:

When we are in genuinely public places, other people can see us.

They can remember what they see. They can write it down. And, subject to important exceptions, they can photograph or record it.

The arrival of a smaller and more convenient camera doesn't make that principle disappear.

One of the problems with smart glasses is similar to smart phones with quality cameras: the idiots who use them. There are idiots who use them to creep on women, and there are idiots who use them to create confrontations for clicks. These idiots are going to get a lot of attention. But not everyone is an idiot.

The technology may be new. The legal principles aren't. And those existing principles, combined with evolving social norms, will hopefully deal with the idiots.

Why Bill C-34’s Social Media Ban for Kids Is Unconstitutional

In my last episode about Bill C-34, the SafeSocial Media Act, I said that one provision jumped out at me as particularly constitutionally vulnerable: the rule that would keep people under sixteen from having accounts on social media services.

I said then that social media is fundamentally expressive. Teenagers have freedom of expression too. And telling a fifteen-year-old that the government will not allow them to have an Instagram account is very different from telling them they cannot buy a bottle of whisky.

Well, since then, something very interesting has happened in France.

France passed a remarkably similar law restricting social media use by young people. And on August 14, 2026, the French Constitutional Council struck down the core of that law as unconstitutional.

Canada is not France. The French Constitution is not the Canadian Charter of Rights and Freedoms. And the legal tests are not identical. But when you read the French decision, the reasoning sounds remarkably familiar to a Canadian constitutional lawyer.

Are there legitimate issues with social media, particularly for kids? Yes.

Is addressing this a “legitimate government objective”? Yes.

But a broad prohibition on young people using social media?

It is too blunt an instrument. It is too broad. And it is not sufficiently connected to the actual risks.

In Canada, I think we would reach much the same result under section 2(b) of the Charter and, particularly, the minimal impairment part of the Oakes test.

And today we’re going to do some constitutional law. Yippee!

Part One: What Bill C-34 Actually Does

First, let's be precise about what Bill C-34 says.

It does not literally say that every person under sixteen is forbidden from ever looking at social media.

Instead, section 27 says that operators of social media services selected by regulation have to use age verification or age estimation measures designed to prevent anyone under sixteen from having an account or otherwise being registered with the service. Section 28 allows the government to prescribe additional measures to accomplish exactly the same thing.

That distinction matters.

A fifteen-year-old might still be able to look at some publicly available material without an account.

But they cannot post. They cannot comment. They cannot participate through an account. They cannot use the platform in the way that social media is fundamentally designed to be used.

And there is an “escape hatch” that makes this less absolute.

Under section 29, the operator of a social media service can apply to the Digital Safety Commission for an exemption from the ban if the Commission concludes that the service provides “adequate safeguards” for children. The government can make regulations establishing the criteria, and the Commission can issue guidelines.

But notice what this exemption is not.

It is not an exemption for a particular fifteen-year-old.

It is not parental consent. (Parents have no say over any of this.)

It is not an assessment of whether this particular young person can safely use this particular service.

It is essentially a service-by-service exemption. The platform gets exempted, not the child.

Part Two: Section 2(b) of the Charter

The first Charter question is relatively straightforward.

Section 2(b) protects freedom of thought, belief, opinion and expression. It also includes freedom of “other media of communication.”

Fundamental freedoms

2 Everyone has the following fundamental freedoms:

(a) freedom of conscience and religion;

(b) freedom of thought, belief, opinion and expression, including freedom of the press and other media of communication;

(c) freedom of peaceful assembly; and

(d) freedom of association.

The Supreme Court of Canada has interpreted “expression” extremely broadly. The basic rule coming out of cases like IrwinToy is that an activity is expressive if it attempts to convey meaning.

Posting a video is expression. Writing a comment is expression. Participating in a political discussion is expression. Sharing your artwork is expression. Talking about your school, your community or your favourite hockey team is expression. And social media has become one of the principal places where people do all of those things.

If you just look at the definitions of “social media service” in the Bill, you can see that what makes a service “in scope” of the Bill is the fact that it enables accessing, sharing and communicating content. That is expression.

In fact, Bill C-34 itself recognizes the importance of freedom of expression but perhaps in more of a “window dressing” kind of way. One of the statutory purposes is to mitigate online harms while respecting freedom of expression, and another is to enable people in Canada to participate fully in public discourse and exercise their freedom of expression online.

The Bill even tells the Digital Safety Commission that when it makes regulations and guidelines, it has to take freedom of expression into account.

The social media ban for kids doesn’t take freedom of expression into account.

I don't think the government gets very far arguing that section 2(b) isn't engaged. It is clearly engaged.

The government is imposing a legal rule that prevents a class of people from obtaining the accounts they need to participate in major forums for expression. That is a restriction on expression, plain and simple.

Which takes us to section 1 of the Charter.

1 The Canadian Charter of Rights and Freedoms guarantees the rights and freedoms set out in it subject only to such reasonable limits prescribed by law as can be demonstrably justified in a free and democratic society.

Part Three: The Oakes Test

A violation of a Charter right is not necessarily unconstitutional.

Section 1 allows governments to impose reasonable limits on Charter rights if those limits can be demonstrably justified in a free and democratic society.

The test to determine if a government measure that limits a Charter can be demonstrably justified in a free and democratic society is called the Oakes test.

Very simplified, the government needs an important objective. The measure chosen by the government has to be rationally connected to that objective. It must impair the Charter right no more than is reasonably necessary. And, finally, the benefits have to justify the harm to the protected right.

I don't think the government is going to have much trouble at the first stage.

Bill C-34 expressly says one of its purposes is protecting children's physical and mental health.

There are legitimate concerns about young people and social media. There are legitimate concerns about harmful content, addictive or manipulative features, bullying and other risks. I am quite prepared to assume in this analysis that protecting children from those harms is a pressing and substantial objective.

I would probably give the government “rational connection” as well. If you keep children completely off a service, they obviously cannot be harmed by that service while they are off it. But that is far from the end of the analysis.

The really difficult question is: Do you have to keep them off the service altogether?

That's minimal impairment. And that is where I think this provision is in serious trouble.

Part Four: Minimal Impairment Does Not Mean “Anything That Works”

The Supreme Court does give governments some latitude here.

Minimal impairment does not mean that a judge gets to dream up some theoretically perfect alternative and strike down legislation because Parliament did not choose it. Governments are generally allowed a range of reasonable policy choices. But there is still a constitutional limit.

The question is whether the government can achieve its objective, in a real and substantial way, through a measure that interferes significantly less with the Charter right.

The Supreme Court's decision in RJR-MacDonald is particularly interesting. That case dealt with a broad prohibition on tobacco advertising. The majority emphasized that a complete prohibition on expression is more difficult to justify than a partial prohibition, particularly where the government has not demonstrated why narrower measures would be inadequate.

And in a case called Carter, the Court made essentially the same point in a very different context: an absolute prohibition was not minimally impairing where a carefully designed system of safeguards could substantially accomplish the government's protective objective. 

Now, the government has a very good case it will undoubtedly rely upon: Irwin Toy. That was the famous case involving Quebec's prohibition on commercial advertising directed at children under thirteen. The Supreme Court found a section 2(b) violation but upheld the restriction under section 1. 

But there is an enormous difference.

Irwin Toy restricted what advertisers could say to young children. It regulated commercial expression directed at a particularly vulnerable audience. Bill C-34 restricts what young people themselves can do.

It removes their ability to participate through an account in an entire medium of communication, including political, educational, artistic, cultural and ordinary social expression.

Those are very different Charter interests.

Part Five: And Then There Is France

This is where the French decision becomes really interesting.

First, a quick note about the French Constitutional Council: its mandate includes reviewing certain laws after they are passed by the legislature but before they are signed into law. It’s kind of like an automatic reference to the Supreme Court. I think that’s a cool protection for constitutional rights.

Back to the social media ban: The French Constitutional Council began by recognizing essentially the same thing that I was just talking about: online communication services have become important to participation in democratic life and the expression of ideas and opinions. It concluded that freedom of expression therefore includes the freedom to access and express oneself through those services.

Then it acknowledged the government's legitimate concern.

The legislature was trying to protect young people from risks associated with social networks. The Constitutional Council accepted that protecting children could justify some restrictions.

But then it looked at what the law actually did.

The prohibition was not sufficiently tied to the particular functions of a service, the content it offered, the dangers it presented or the adequacy of its protections. It could therefore apply to services where a risk to children's health or safety had not actually been established. And the law treated all children under fifteen alike.

There was no mechanism for a parent, properly informed about the risks and safeguards, to authorize access. There was no individualized consideration of the child's age, maturity or circumstances, or of the particular service involved.

The Constitutional Council therefore concluded that the general prohibition was not appropriate, necessary and proportionate to the objective.

And it struck it down.

Does that decide the Canadian question? Nope. But it is almost a textbook description of the minimal-impairment problem with Bill C-34’s social media ban.

Part Six: The Canadian Law Is Different — But Not Different Enough

There are some important differences between the French law and Canada’s Bill C-34..

The Canadian scheme is somewhat more targeted. The government has to specify the regulated social media services or classes of services to which the under-sixteen rule will apply. This is solely based on the number of users, so has nothing to do with specific risks to specific kids.

And Canada has the section 29 exemption for services with adequate safeguards. (Which will likely only come into effect years after the bill becomes law and the Digital Safety Commission gets its stuff together.)

Bill C-34 also deals with the privacy implications of age verification more explicitly than the French law did. It limits the purposes for which age-verification information can be collected and requires its destruction after verification or estimation is completed.

Those differences matter, but they don’t solve the central section 2(b) problem.

Once a service has been selected, the rule right out of the gate is still: if you are fifteen, you don't get an account.

It doesn't matter why you want the account. It doesn't matter whether you're using it to talk about politics, follow community organizations, publish your photography, participate in a school activity or just talk to your friends.

It doesn't matter whether your parents think you're capable of using it responsibly.

And it doesn't matter whether the particular feature you want to use has anything to do with the harm that Parliament is trying to prevent.

That is a very broad response to a much more specific collection of problems.

Part Seven: The Strangest Part Is That Bill C-34 Already Contains the Alternatives

And this is what I think makes the minimal-impairment argument especially powerful.

Bill C-34 itself contains a whole range of less intrusive tools for protecting children.

Section 21 allows age-appropriate design requirements. Section 32 requires social media operators to implement measures to mitigate exposure to harmful content. Other provisions require blocking tools. And the Commission's regulation-making powers expressly contemplate things like children's account options, parental controls and other age-appropriate design features.

In other words, Parliament has already written a menu of more targeted interventions into the same statute.

• Protective defaults.
• Parental controls.
• Age-appropriate account settings.
• Restrictions aimed at particular risky features.
• Measures aimed at harmful content.

Those approaches regulate the risk.

The under-sixteen ban regulates the person.

And that is exactly the question the government is going to have to answer in a Charter challenge: why aren't those less rights-infringing measures enough?

The government does not have to prove that no conceivable alternative exists. But it does have to justify the level of impairment it has chosen. And saying “social media can be harmful to kids” doesn't answer that question.

Conclusion

None of this means that social media is harmless.

And it doesn't mean that Parliament is powerless to regulate it.

The Charter does not require the government to sit on its hands while children are exposed to risks. It does, however, require the government to respond to those risks with some degree of precision.

Target the dangerous features.

Target the harmful content.

Require safer design.

Give parents useful controls.

Impose obligations on the platforms that are actually creating the risk.

But telling every fifteen-year-old that they cannot have an account on a designated social media service is something very different.

France's Constitutional Council has now confronted essentially the same constitutional tension. It accepted that the harms were real. It accepted that protecting children was legitimate. But it concluded that those legitimate concerns did not justify a general prohibition that swept far beyond the risks the government was trying to address.

Canadian courts will have to take a different constitutional route, but I am pretty confident they will arrive at the same destination.

If Bill C-34 is enacted in its current form and the under-sixteen account restriction is challenged, I think minimal impairment is where it breaks.

And I don't think putting an exemption process at the end of an overly broad prohibition fixes the problem at the beginning.

I realize that a social media ban for young people is very popular and politically wonderful, but we exist in a country with rights. A fifteen year old has the same right to freedom of expression as I do. I can have an account on YouTube to share my thoughts on privacy, technology and important public policy matters. Once Bill C-34 is passed – if it is passed in its current form – young people will not be able to do that. And that, in my view, is a serious issue that needs to be front and centre in the discussion of Bill C-34 when Parliament gets back from its summer break.

And I should note, as I wrap up, that I also think this violates adults’ Charter rights, because adults will have to jump through privacy-risking age verification measures before being allowed to use social media. I’m not sure that can be fully justified under the Oakes test, either.