Why Bill C-34’s Social Media Ban for Kids Is Unconstitutional

In my last episode about Bill C-34, the SafeSocial Media Act, I said that one provision jumped out at me as particularly constitutionally vulnerable: the rule that would keep people under sixteen from having accounts on social media services.

I said then that social media is fundamentally expressive. Teenagers have freedom of expression too. And telling a fifteen-year-old that the government will not allow them to have an Instagram account is very different from telling them they cannot buy a bottle of whisky.

Well, since then, something very interesting has happened in France.

France passed a remarkably similar law restricting social media use by young people. And on August 14, 2026, the French Constitutional Council struck down the core of that law as unconstitutional.

Canada is not France. The French Constitution is not the Canadian Charter of Rights and Freedoms. And the legal tests are not identical. But when you read the French decision, the reasoning sounds remarkably familiar to a Canadian constitutional lawyer.

Are there legitimate issues with social media, particularly for kids? Yes.

Is addressing this a “legitimate government objective”? Yes.

But a broad prohibition on young people using social media?

It is too blunt an instrument. It is too broad. And it is not sufficiently connected to the actual risks.

In Canada, I think we would reach much the same result under section 2(b) of the Charter and, particularly, the minimal impairment part of the Oakes test.

And today we’re going to do some constitutional law. Yippee!

Part One: What Bill C-34 Actually Does

First, let's be precise about what Bill C-34 says.

It does not literally say that every person under sixteen is forbidden from ever looking at social media.

Instead, section 27 says that operators of social media services selected by regulation have to use age verification or age estimation measures designed to prevent anyone under sixteen from having an account or otherwise being registered with the service. Section 28 allows the government to prescribe additional measures to accomplish exactly the same thing.

That distinction matters.

A fifteen-year-old might still be able to look at some publicly available material without an account.

But they cannot post. They cannot comment. They cannot participate through an account. They cannot use the platform in the way that social media is fundamentally designed to be used.

And there is an “escape hatch” that makes this less absolute.

Under section 29, the operator of a social media service can apply to the Digital Safety Commission for an exemption from the ban if the Commission concludes that the service provides “adequate safeguards” for children. The government can make regulations establishing the criteria, and the Commission can issue guidelines.

But notice what this exemption is not.

It is not an exemption for a particular fifteen-year-old.

It is not parental consent. (Parents have no say over any of this.)

It is not an assessment of whether this particular young person can safely use this particular service.

It is essentially a service-by-service exemption. The platform gets exempted, not the child.

Part Two: Section 2(b) of the Charter

The first Charter question is relatively straightforward.

Section 2(b) protects freedom of thought, belief, opinion and expression. It also includes freedom of “other media of communication.”

Fundamental freedoms

2 Everyone has the following fundamental freedoms:

(a) freedom of conscience and religion;

(b) freedom of thought, belief, opinion and expression, including freedom of the press and other media of communication;

(c) freedom of peaceful assembly; and

(d) freedom of association.

The Supreme Court of Canada has interpreted “expression” extremely broadly. The basic rule coming out of cases like IrwinToy is that an activity is expressive if it attempts to convey meaning.

Posting a video is expression. Writing a comment is expression. Participating in a political discussion is expression. Sharing your artwork is expression. Talking about your school, your community or your favourite hockey team is expression. And social media has become one of the principal places where people do all of those things.

If you just look at the definitions of “social media service” in the Bill, you can see that what makes a service “in scope” of the Bill is the fact that it enables accessing, sharing and communicating content. That is expression.

In fact, Bill C-34 itself recognizes the importance of freedom of expression but perhaps in more of a “window dressing” kind of way. One of the statutory purposes is to mitigate online harms while respecting freedom of expression, and another is to enable people in Canada to participate fully in public discourse and exercise their freedom of expression online.

The Bill even tells the Digital Safety Commission that when it makes regulations and guidelines, it has to take freedom of expression into account.

The social media ban for kids doesn’t take freedom of expression into account.

I don't think the government gets very far arguing that section 2(b) isn't engaged. It is clearly engaged.

The government is imposing a legal rule that prevents a class of people from obtaining the accounts they need to participate in major forums for expression. That is a restriction on expression, plain and simple.

Which takes us to section 1 of the Charter.

1 The Canadian Charter of Rights and Freedoms guarantees the rights and freedoms set out in it subject only to such reasonable limits prescribed by law as can be demonstrably justified in a free and democratic society.

Part Three: The Oakes Test

A violation of a Charter right is not necessarily unconstitutional.

Section 1 allows governments to impose reasonable limits on Charter rights if those limits can be demonstrably justified in a free and democratic society.

The test to determine if a government measure that limits a Charter can be demonstrably justified in a free and democratic society is called the Oakes test.

Very simplified, the government needs an important objective. The measure chosen by the government has to be rationally connected to that objective. It must impair the Charter right no more than is reasonably necessary. And, finally, the benefits have to justify the harm to the protected right.

I don't think the government is going to have much trouble at the first stage.

Bill C-34 expressly says one of its purposes is protecting children's physical and mental health.

There are legitimate concerns about young people and social media. There are legitimate concerns about harmful content, addictive or manipulative features, bullying and other risks. I am quite prepared to assume in this analysis that protecting children from those harms is a pressing and substantial objective.

I would probably give the government “rational connection” as well. If you keep children completely off a service, they obviously cannot be harmed by that service while they are off it. But that is far from the end of the analysis.

The really difficult question is: Do you have to keep them off the service altogether?

That's minimal impairment. And that is where I think this provision is in serious trouble.

Part Four: Minimal Impairment Does Not Mean “Anything That Works”

The Supreme Court does give governments some latitude here.

Minimal impairment does not mean that a judge gets to dream up some theoretically perfect alternative and strike down legislation because Parliament did not choose it. Governments are generally allowed a range of reasonable policy choices. But there is still a constitutional limit.

The question is whether the government can achieve its objective, in a real and substantial way, through a measure that interferes significantly less with the Charter right.

The Supreme Court's decision in RJR-MacDonald is particularly interesting. That case dealt with a broad prohibition on tobacco advertising. The majority emphasized that a complete prohibition on expression is more difficult to justify than a partial prohibition, particularly where the government has not demonstrated why narrower measures would be inadequate.

And in a case called Carter, the Court made essentially the same point in a very different context: an absolute prohibition was not minimally impairing where a carefully designed system of safeguards could substantially accomplish the government's protective objective. 

Now, the government has a very good case it will undoubtedly rely upon: Irwin Toy. That was the famous case involving Quebec's prohibition on commercial advertising directed at children under thirteen. The Supreme Court found a section 2(b) violation but upheld the restriction under section 1. 

But there is an enormous difference.

Irwin Toy restricted what advertisers could say to young children. It regulated commercial expression directed at a particularly vulnerable audience. Bill C-34 restricts what young people themselves can do.

It removes their ability to participate through an account in an entire medium of communication, including political, educational, artistic, cultural and ordinary social expression.

Those are very different Charter interests.

Part Five: And Then There Is France

This is where the French decision becomes really interesting.

First, a quick note about the French Constitutional Council: its mandate includes reviewing certain laws after they are passed by the legislature but before they are signed into law. It’s kind of like an automatic reference to the Supreme Court. I think that’s a cool protection for constitutional rights.

Back to the social media ban: The French Constitutional Council began by recognizing essentially the same thing that I was just talking about: online communication services have become important to participation in democratic life and the expression of ideas and opinions. It concluded that freedom of expression therefore includes the freedom to access and express oneself through those services.

Then it acknowledged the government's legitimate concern.

The legislature was trying to protect young people from risks associated with social networks. The Constitutional Council accepted that protecting children could justify some restrictions.

But then it looked at what the law actually did.

The prohibition was not sufficiently tied to the particular functions of a service, the content it offered, the dangers it presented or the adequacy of its protections. It could therefore apply to services where a risk to children's health or safety had not actually been established. And the law treated all children under fifteen alike.

There was no mechanism for a parent, properly informed about the risks and safeguards, to authorize access. There was no individualized consideration of the child's age, maturity or circumstances, or of the particular service involved.

The Constitutional Council therefore concluded that the general prohibition was not appropriate, necessary and proportionate to the objective.

And it struck it down.

Does that decide the Canadian question? Nope. But it is almost a textbook description of the minimal-impairment problem with Bill C-34’s social media ban.

Part Six: The Canadian Law Is Different — But Not Different Enough

There are some important differences between the French law and Canada’s Bill C-34..

The Canadian scheme is somewhat more targeted. The government has to specify the regulated social media services or classes of services to which the under-sixteen rule will apply. This is solely based on the number of users, so has nothing to do with specific risks to specific kids.

And Canada has the section 29 exemption for services with adequate safeguards. (Which will likely only come into effect years after the bill becomes law and the Digital Safety Commission gets its stuff together.)

Bill C-34 also deals with the privacy implications of age verification more explicitly than the French law did. It limits the purposes for which age-verification information can be collected and requires its destruction after verification or estimation is completed.

Those differences matter, but they don’t solve the central section 2(b) problem.

Once a service has been selected, the rule right out of the gate is still: if you are fifteen, you don't get an account.

It doesn't matter why you want the account. It doesn't matter whether you're using it to talk about politics, follow community organizations, publish your photography, participate in a school activity or just talk to your friends.

It doesn't matter whether your parents think you're capable of using it responsibly.

And it doesn't matter whether the particular feature you want to use has anything to do with the harm that Parliament is trying to prevent.

That is a very broad response to a much more specific collection of problems.

Part Seven: The Strangest Part Is That Bill C-34 Already Contains the Alternatives

And this is what I think makes the minimal-impairment argument especially powerful.

Bill C-34 itself contains a whole range of less intrusive tools for protecting children.

Section 21 allows age-appropriate design requirements. Section 32 requires social media operators to implement measures to mitigate exposure to harmful content. Other provisions require blocking tools. And the Commission's regulation-making powers expressly contemplate things like children's account options, parental controls and other age-appropriate design features.

In other words, Parliament has already written a menu of more targeted interventions into the same statute.

• Protective defaults.
• Parental controls.
• Age-appropriate account settings.
• Restrictions aimed at particular risky features.
• Measures aimed at harmful content.

Those approaches regulate the risk.

The under-sixteen ban regulates the person.

And that is exactly the question the government is going to have to answer in a Charter challenge: why aren't those less rights-infringing measures enough?

The government does not have to prove that no conceivable alternative exists. But it does have to justify the level of impairment it has chosen. And saying “social media can be harmful to kids” doesn't answer that question.

Conclusion

None of this means that social media is harmless.

And it doesn't mean that Parliament is powerless to regulate it.

The Charter does not require the government to sit on its hands while children are exposed to risks. It does, however, require the government to respond to those risks with some degree of precision.

Target the dangerous features.

Target the harmful content.

Require safer design.

Give parents useful controls.

Impose obligations on the platforms that are actually creating the risk.

But telling every fifteen-year-old that they cannot have an account on a designated social media service is something very different.

France's Constitutional Council has now confronted essentially the same constitutional tension. It accepted that the harms were real. It accepted that protecting children was legitimate. But it concluded that those legitimate concerns did not justify a general prohibition that swept far beyond the risks the government was trying to address.

Canadian courts will have to take a different constitutional route, but I am pretty confident they will arrive at the same destination.

If Bill C-34 is enacted in its current form and the under-sixteen account restriction is challenged, I think minimal impairment is where it breaks.

And I don't think putting an exemption process at the end of an overly broad prohibition fixes the problem at the beginning.

I realize that a social media ban for young people is very popular and politically wonderful, but we exist in a country with rights. A fifteen year old has the same right to freedom of expression as I do. I can have an account on YouTube to share my thoughts on privacy, technology and important public policy matters. Once Bill C-34 is passed – if it is passed in its current form – young people will not be able to do that. And that, in my view, is a serious issue that needs to be front and centre in the discussion of Bill C-34 when Parliament gets back from its summer break.

And I should note, as I wrap up, that I also think this violates adults’ Charter rights, because adults will have to jump through privacy-risking age verification measures before being allowed to use social media. I’m not sure that can be fully justified under the Oakes test, either.

Privacy, Online Harms and Lawful Access: Keep an eye on Parliament this fall

If you care about privacy, the internet, artificial intelligence, social media, free expression, cybersecurity or government surveillance, you probably want to keep an eye on Ottawa this fall.

Because Parliament comes back from its summer break on September 21st, and waiting for MPs and Senators are three important pieces of legislation.

We have Bill C-34, the Safe Social Media Act, which would create an entirely new regulatory regime for social media, online harms and AI chatbots. Including a social media ban for anyone under 16.

We have Bill C-36, the Protecting Privacy and Consumer Data Act, which would repeal and replace the privacy portions of PIPEDA — Canada's private-sector privacy law for the last quarter-century.

And then we have Bill C-22, the Lawful Access Act, 2026, which has already made it through the House of Commons and is now sitting in the Senate.

Each one of these bills would be important on its own.

Taken together, this could be one of the most consequential sessions of Parliament for Canadian privacy and digital policy that we've seen in years.

Hi. My name is David Fraser. I'm a privacy, internet and technology lawyer with the Canadian law firm McInnes Cooper. I also teach Internet and Media Law at the Schulich School of Law at Dalhousie University.

I've already done detailed episodes on each of these bills, so I'm not going to go through every clause again. I’ll link to the previous episodes below.

Instead, I want to talk about where these bills stand, what they would actually do, and — most importantly — what we should be watching when Parliament gets back to work this fall.

Part 1: Three Different Bills — One Enormous Digital Policy Agenda

I think it's useful to start by looking at these three bills together.

Because they deal with different things, but they really are pieces of the same larger picture. And I think a fourth piece is coming.

Bill C-34 is about what online platforms are required to do.

Bill C-36 is about what organizations can do with our personal information and how they are regulated.

And Bill C-22 is about how law enforcement and national security agencies can obtain information and what technological capabilities companies may be required to build to facilitate that access.

So we are talking about regulation of platforms. Regulation of data. And government access to data.

That is a pretty significant chunk of Canada's digital policy landscape.

And there is another important connection between C-34 and C-36.

Bill C-34 creates a new Digital Safety Commission of Canada. Bill C-36 would expand and restructure that institution into a Digital Safety and Data Protection Commission of Canada, which would also become central to the enforcement of Canada's new private-sector privacy law.

In other words, we aren't just talking about three new statutes.

We may be watching the construction of an entirely new federal digital regulatory architecture.

And I fully expect we will have a bill to regulate artificial intelligence, and I bet the Digital Safety and Data Protection Commission will also have oversight of AI.

That deserves attention.

Part 2: Bill C-34 — The Safe Social Media Act

Let's start with Bill C-34.

The government introduced the Safe Social Media Act on June 10th, just before Parliament rose for the summer. It received first reading and is now sitting at second reading in the House of Commons.

This is essentially the government's replacement for Bill C-63, the Online Harms Act, which died when Parliament was prorogued before the last election.

But C-34 isn't simply C-63 with a new name.

There are some pretty significant changes.

The legislation would regulate three broad categories of services: social media services, AI chatbot services and potentially other highly interactive online services that the government considers sufficiently risky to children. Exactly which services are caught will depend enormously on regulations that have not yet been written.

Perhaps the most significant addition between C-63 and Bill C-34 is a social media ban for those under 16. Bill C-34 says that users have to be at least 16 years old to have an account on a regulated social media service unless the service obtains an exemption from the new Commission. And the ban will surely go into effect before the Commission has established criteria for exemptions.

It also requires age-assurance measures for services carrying pornographic content.

And that creates a glaring privacy problem.

To keep people under 16 off social media, social media companies have to figure out who is under 16.

Which means they have to determine the age of everybody.

So legislation promoted as a child-safety measure could result in an enormous new infrastructure for age verification or age estimation across the Canadian internet.

That is going to raise some very difficult questions.

What information are companies going to collect to establish age?

Do you have to upload government identification?

Can platforms use facial age-estimation technology?

Can third-party identity providers do this?

What data gets retained?

And perhaps most fundamentally: how much additional information should adults have to provide about themselves just to use an online service?

There are also very significant freedom-of-expression questions.

Despite some people comparing “Big Tech” with “Big Tobacco”, social media is not cigarettes or booze or gambling.

Social media is fundamentally a medium of expression.

Young people use it to communicate with friends, participate in political discussions, organize, create art, learn about the world and express themselves.

So an outright age restriction raises Charter questions that I expect will receive considerable attention if this bill gets to committee.

Bill C-34 also creates four broad categories of duties for regulated operators: duties to protect children, to be transparent, to act responsibly, and to make certain content inaccessible.

The legislation continues to regulate seven categories of harmful content, ranging from intimate content communicated without consent and content that victimizes children through to bullying, hatred, violence and violent extremism.

And AI is explicitly part of this.

Regulated chatbot services would have obligations designed to prevent them from impersonating human beings or professionals and from encouraging unhealthy emotional relationships with users.

Synthetic audio and visual content would also have to be identified in certain circumstances.

So this isn't just a social-media law. It will affect a LOT of the internet.

It's also one of Canada's first significant attempts to directly regulate consumer-facing generative AI.

And then there is the regulator itself.

The new Digital Safety Commission would have significant investigation, rule-making and enforcement powers, backed by potentially enormous administrative monetary penalties — up to the greater of $20 million or five percent of global gross revenue in some circumstances.

A HUGE amount of the actual operation of this legislation is also left to future regulations and rules made by the Commission. And, as a result, so much will be determined by who is appointed to the Commission.

So when C-34 gets to committee, I would expect a lot of attention to be focused not just on what the bill says, but on how much Parliament is being asked to leave for somebody else to decide later.

Part 3: What to Watch on C-34 This Fall

There are four things I'll particularly be watching.

First, the 16-year-old social media restriction. Does it survive in its current form? And if it does, what safeguards are added around age verification?

Second, freedom of expression. Does Parliament seriously grapple with the Charter implications of excluding younger Canadians from major platforms for communication and expression? It will be interesting to see how the government tries to stickhandle this in their Charter Statement for Bill C-34.

Third, the scope of the legislation. How far beyond Facebook, Instagram and TikTok does this go? Gaming? YouTube? Online communities? AI services?

The more services that can potentially be brought in by regulation, the more important that question becomes. 

And fourth, the power of the regulator. Parliament should be very careful whenever it creates a powerful new administrative agency and says, essentially, "We'll work out a lot of the important details later."

My expectation is that C-34 will be a significant government priority this fall.

Online safety — particularly child safety — has enormous political appeal. But that does not mean the details don't matter. In fact, it means the details matter even more. If they're going to be so ambitious, they need to really try to get it right.

Part 4: Bill C-36 — Replacing PIPEDA

Then we have Bill C-36.

This one was introduced on June 15th — only a few days before the House packed up for the summer — and it is also waiting at second reading.

If C-34 is politically flashy, C-36 may actually have the broader long-term effect.

Because Bill C-36 would repeal Part 1 of PIPEDA.

PIPEDA has been Canada's federal private-sector privacy law since 2001.

For twenty-five years, it has governed how businesses collect, use and disclose personal information.

Bill C-36 would replace that regime with a completely new statute called the Protecting Privacy and Consumer Data Act, or PPCDA.

We've been here before.

Bill C-11 tried to replace PIPEDA in 2020. It didn’t proceed. Bill C-27 tried again in 2022. It didn’t proceed. So Bill C-36 is kick number three at this particular can. 

Much of the substance will be familiar to anyone who followed Bill C-27.

• There are more detailed accountability requirements.
• Documented privacy management programs.
• More detailed consent rules.
• New consent exceptions based on business activities and legitimate interests.
• Formal rules dealing with anonymized and de-identified information.
• A right to disposal of personal information.
• Data mobility.
• Privacy impact assessments for international transfers.
• Much stronger enforcement.
• And enormous potential penalties.

Administrative monetary penalties can reach the greater of $10 million or three percent of global gross revenue.

And serious offences can attract fines of up to the greater of $25 million or five percent of global gross revenue.

That should get the attention of corporate boards.

But perhaps the most interesting change is institutional.

For almost twenty-five years, federal private-sector privacy law has been overseen by the Privacy Commissioner of Canada — an independent officer of Parliament.

Bill C-36 would fundamentally change that.

The existing Privacy Commissioner would no longer be the regulator administering this law.

Instead, we would get a new Privacy and Consumer Data Commissioner operating inside this broader Digital Safety and Data Protection Commission. That Commission would also function as a tribunal when organizations challenge findings and penalties. And I think that is going to be one of the most important issues Parliament has to examine.

Why are we moving privacy regulation away from an independent officer of Parliament? What problem is that intended to solve?

How independent will the new Privacy and Consumer Data Commissioner actually be?

And have sufficient institutional walls been built between the investigative side and the tribunal side?

I don't particularly like the idea of having the investigator, prosecutor and adjudicator all living under one institutional roof.

Maybe that structure can work. But if that's what Parliament wants to create, the firewalls need to be very clear and I don’t see them in the text of the Bill.

Part 5: The Other Big C-36 Issues

There are a bunch of substantive issues I expect will get attention at committee. Consent is one. Bill C-36 requires organizations to provide considerably more information for consent to be valid.

At the same time, it introduces broader alternatives to consent through legitimate interests and specified business activities. So Parliament is simultaneously making consent more demanding and creating more circumstances in which organizations don't need it.

That tension deserves some careful thought. It works in Europe, but we’re not doing exactly what they’ve done in Europe. 

International transfers are another. Organizations transferring personal information outside Canada would have to undertake privacy impact assessments. That's a significant departure from the relatively technology-neutral accountability model we've had under PIPEDA.

And then there is the private right of action. Bill C-36 would allow an individual affected by a contravention to sue for loss or injury arising from it, including in provincial superior courts. I think that provision needs considerable work. Depending on how it is interpreted, a privacy contravention involving millions of individuals could produce an enormous multiplicity of proceedings.

There is also a bigger policy question. What do we actually want Canadian privacy law to accomplish in 2026 and beyond? We're now writing the law that could govern data processing for another generation. This is not the place for Parliament to rush. Bill C-36 isn't a tune-up. It is a wholesale replacement of Canada's federal private-sector privacy regime.

Part 6: Bill C-22 — Lawful Access Goes to the Senate

And then we come to Bill C-22. This one is at a completely different stage. Unlike C-34 and C-36, Bill C-22 made it through the House before the summer break. On June 18th, the House passed Bill C-22 at third reading, and the Senate gave it first reading that same day. So when Parliament returns, the lawful-access debate moves principally to the Senate.

If you've watched my previous episode, you know I have some pretty significant concerns about this bill. 

Bill C-22 has two major substantive pieces. Part 1 creates new and modified investigative tools.

There is a new confirmation-of-service demand, allowing police and CSIS in specified circumstances to require telecommunications service providers to confirm whether they provide services associated with a person or identifier.

There is a new subscriber-information production order operating on the relatively low threshold of reasonable grounds to suspect.

There are changes dealing with voluntary disclosure, publicly available information, tracking orders, transmission data and other investigative powers.

This part is considerably better than what the government originally proposed in Bill C-2, the Strong Borders Act, but I still have issues with Part 1.

Part 2 is where I remain much more concerned. It creates the Supporting Authorized Access to Information Act. That law would create a framework under which electronic service providers can be required to build and maintain technical capabilities to facilitate authorized government access to information.

And "electronic service provider" is defined VERY broadly.

We're not just talking about Bell, Rogers and Telus. We're likely talking about cloud providers, social media services, online gaming companies, messaging services, VPNs and other digital businesses.

The legislation allows obligations to be placed on designated core providers through regulations.

It also gives the Minister of Public Safety authority to issue secret orders to individual service providers, subject to approval by the Intelligence Commissioner.

And it provides for mandatory retention of specified categories of metadata. The House did make important amendments before passing the bill. The maximum metadata retention period was reduced from one year to six months. The provisions dealing with systemic vulnerabilities were improved, but definitely not fixed.

The government is still creating a permanent statutory framework under which private companies can be required to design their systems so that government access can be facilitated.

And that raises some enormous questions about privacy, cybersecurity, proportionality and the future design of communications infrastructure.

As I said in my earlier episode, I think Part 1 is largely fixed. Part 2 is better than what we saw before, but I still think it is deeply problematic.

Part 7: The Senate Could Really Matter

And that makes the Senate particularly important this fall. The House consideration of C-22 ended very quickly. On June 17th, the government obtained a programming motion that dramatically compressed the remaining committee and House proceedings, and the bill was passed by the Commons on June 18th.

So the Senate now has an opportunity to give the legislation the detailed scrutiny that a bill of this significance deserves.

I hope Senators take that opportunity. I would expect witnesses from law enforcement and national security agencies. I would expect privacy and civil-liberties advocates. I would expect telecommunications companies and major technology companies. I hope there are cybersecurity and encryption experts. And I hope Senators spend a lot of time on a fundamental question:

What technological capabilities should the government be permitted to require private companies to build in advance, so they are available if government wants to use them later?

That is a very different question from whether police should be able to get a warrant. Of course police should be able to get warrants where the legal requirements are met. The much harder question is whether we should redesign communications infrastructure to make surveillance easier. Those are not the same thing.

Part 8: The Bigger Picture

And that's why I think these three bills need to be looked at together.

With Bill C-34, the government wants online services to know more about their users' ages and identities so they can control access and manage harmful content.

With Bill C-36, the government is completely rewriting the rules governing how businesses collect and use personal information.

And with Bill C-22, the government wants to ensure that information and technical capabilities exist so law enforcement and national security agencies can obtain data when legally authorized to do so.

There are legitimate public-policy objectives behind all three. Protecting children online is important. Most folks in the field agree that modernizing our privacy law is overdue. Giving police appropriate tools to investigate serious crime in a digital world is necessary. (Emphasis on “appropriate”.)

But good objectives do not automatically produce good legislation. And one of the recurring themes running through all three bills is information architecture. What data are companies required to collect? What data are they permitted to use? What data must they retain? What technological systems must they build? Who gets access to that information? Who is the “customer”? The police? Who regulates all of this? And what checks exist on those regulators and government agencies?

Those questions are going to shape the Canadian internet for years.

Part 9: What I Will Be Watching

So here is my fall 2026 privacy and digital-policy watch list.

For Bill C-34, watch the age-16 restriction, age-verification requirements, freedom-of-expression issues, the treatment of AI and the enormous amount of substantive law being left to regulations and Commission rule-making.

For Bill C-36, watch the fate of the existing Privacy Commissioner, the structure and independence of the new regulator, consent and legitimate interests, cross-border transfers, the private right of action and the penalty regime.

And for Bill C-22, watch the Senate. Particularly watch what Senators do with Part 2, metadata retention, technical capability requirements, ministerial orders, encryption and cybersecurity protections.

And there is one final thing to watch: Speed. We've seen governments try to enact major digital-policy reforms only to have them die because they were too controversial, too complicated or simply ran out of parliamentary runway. Privacy law reform Bills C-11 and C-27 never became law. Online Harms Bill C-63 never became law. The lawful-access proposals in Bill C-2 did not survive in that form.

So introducing legislation is one thing, getting it through both Houses of Parliament is entirely different.

Bill C-22 is already well down that road. C-34 and C-36 are just getting started.

And I suspect we're going to know a lot more by Christmas about how serious the government is about getting each of them enacted.

Conclusion

So buckle up. The fall of 2026 will be enormously consequential for Canadian privacy and technology law.

And I expect I'll have plenty to talk about over the next few months. 

"Online Harms" is back: An overview of Bill C-34 The Safe Social Media Act

 

The proposed new online safety law expands its scope to AI chatbots, introduces strict age limits, and places regulatory oversight under a single Commission.

On June 10, 2026 the Minister of Canadian Identity and Culture Marc Miller tabled Bill C-34 in Parliament, called the “Safe Social Media Act”. This legislation follows Bill C-63 (called the “Online Harms Act”). While the stated purpose of promoting online safety and protecting children remains the same, the new bill introduces highly prescriptive regulatory changes and broadens the scope of the digital services it targets.

The new bill significantly expands the scope of regulated entities beyond traditional platforms. While it continues to apply to “regulated social media services”, it introduces two entirely new categories: “regulated chatbot services” (conversational AI systems) and “regulated online services” (interactive websites or applications deemed to pose a significant risk to children).

The most significant difference is the bill’s aggressive stance on age restrictions and verification. Unlike its predecessor, Bill C-34 explicitly imposes a strict minimum age of 16 to register or hold an account with a regulated social media service. Operators are required to implement adequate age-verification or age-estimation measures to enforce this ban. Furthermore, any regulated service that provides access to pornographic content is mandated to implement age-verification measures (over 18). To try to placate privacy concerns, the legislation includes parameters requiring that any personal information collected for age verification be destroyed once the verification is complete. However, it is clear that all users of regulated social media services in Canada will have to have their ages verified as a condition of having an account.

With respect to artificial intelligence, the bill introduces targeted obligations. Operators of regulated social media services have a specific duty to label synthetic content”—defined as AI-generated or mechanically altered audio or visual data that could be mistaken for authentic content. Chatbot operators are subject to new behavioral guardrails, requiring them to implement measures that prevent the AI from posing as a human being, masquerading as a licensed professional (such as a medical or legal expert), or encouraging self-harm.

One of the most notable changes to content moderation is the 24-hour fast-track takedown rule. If an operator discovers or is flagged about content that sexually victimizes a child or constitutes “intimate content communicated without consent” (which explicitly includes deepfakes), they must make that content completely inaccessible to all persons in Canada within 24 hours. (There is a limited ability for users to dispute these takedowns.) Operators are also required to be transparent about their operations by submitting comprehensive “digital safety plans” to the Commission and making redacted versions publicly available on their services.

The regulatory bureaucracy proposed under Bill C-63 has been streamlined, compared to the previous bill but its powers are immense. The independent Digital Safety Ombudsperson and the Digital Safety Office have been removed, leaving a centralized, highly powerful Digital Safety Commission of Canada to oversee and enforce the Act. (The role of the Commission will be expanded under the new privacy law to become the Digital Safety and Data Protection Commission of Canada.)

User complaint mechanisms have also shifted to an “exhaustion of recourse” model. A person in Canada cannot lodge a formal complaint regarding harmful content directly with the Commission unless they have first used their best efforts to seek recourse from the operator using the platform’s internal tools and reconsideration processes.

Possible penalties under the new regime are massive. If an operator contravenes the Act, fails to follow compliance orders, or makes false statements to an inspector, the Commission can issue notices of violation and severe administrative monetary penalties. The maximum penalty can reach the higher of $20,000,000 or 5% of the operator’s gross global revenue in the preceding financial year. Gross global revenue calculations will legally encompass all corporate affiliates within a consolidated group.

How all of this will play out in practice remains to be seen, as a massive amount of the substance of its application is left to regulations made by the government, and rules to be made by the new Digital Safety Commission.

(This summary was originally written for the Canadian Technology Law Association's newsletter.)

Discussion with Rob Breakenridge: "Protecting kids or deputizing censors? The risks posed by social media ban"