Culture Minister Marc Miller by Michael Geist

The government tabled Bill C-34, the Safe Social Media Act, earlier today, marking its third attempt at online harms legislation after the failed 2021 consultation and Bill C-63, the Online Harms Act that died on the order paper when Parliament was prorogued ahead of the 2025 election. As I wrote on the day Bill C-63 was introduced, that bill was effectively three bills in one: a defensible set of platform regulation provisions built around a duty to act responsibly and a clear list of identifiable harms, contentious Criminal Code and Canada Human Rights Act reforms, and a powerful new Digital Safety Commission with considerable regulatory discretion. My view at the time was that the contentious provisions should be removed and addressed separately, since they were certain to dominate the debate at the expense of what really mattered, namely the platform regulation piece. That is precisely how it played out as the speech provisions undermined the bill for months, and by the time the government conceded and agreed to split the bill, time ran out.

Bill C-34 suggests the government absorbed only part of the lesson. The Criminal Code and Human Rights Act provisions are gone, but in their place the government has thrown in everything else: the original Online Harms Act platform duties, an under-16 social media ban backed by mandated age verification, Bill S-209’s pornography age verification requirements, a new AI chatbot regulatory regime, and sweeping powers for a Digital Safety Commission that will write the rules, enforce them, and decide which platforms escape the ban restriction. It is an everything-all-at-once approach in which nearly every key component, including which services face the restriction, how age gets verified, which AI systems are covered, and what standards govern exemptions, is left to regulations that do not yet exist.

I’ve been working on this piece since before the bill was introduced with the expectation that many provisions from the prior proposal would resurface. This post is long, but seeks to provide a very initial review of key elements in the bill. For those looking for the key takeaways, there are five. First, the platform regulation elements with a duty to act responsibly once again offers a good starting point for working through regulation. Second, the inclusion of a social media ban for those under 16 is bad policy that will take considerable time to implement and raises serious privacy concerns that will affect tens of millions of Canadians. Third, the AI chatbot regulations are consistent with emerging standards, but the uncertainty of who it covers is not. Fourth, the government is creating a bureaucracy comparable to the CRTC in the Digital Safety Commission as it will wield serious power and be tasked with fleshing out much of the detail of how the law will work. Fifth, the uncertainty of this bill has the hallmarks of a government wanting to do something quickly, but the “trust us” approach likely means years of implementation work and potential court challenges.

The Foundation: A Duty to Act Responsibly

The aspect that attracted the broadest support in Bill C-63, namely the platform regulation rules, survived largely intact. The bill features the same seven categories of harmful content (intimate content communicated without consent, content that sexually victimizes a child or revictimizes a survivor, content that induces a child to harm themselves, content used to bully a child, content that foments hatred, content that incites violence, and terrorism or violent extremism content) and revives the duty to act responsibly that requires platforms to assess and mitigate the risk of exposure to that content. There is also a duty to make certain categories of content inaccessible within 24 hours backed by a complaint path to the new Digital Safety Commission, and a duty to be transparent through public digital safety plans, record-keeping, and researcher access to data. These measures target how platforms actually operate and provide a credible starting point.

The bill also adds a synthetic content labelling obligation that requires social media services to label deepfakes and bot-amplified harmful content, a useful transparency-focused measure. The terrorism and violent extremism definition has been broadened from Bill C-63’s incitement-focused version to cover recruitment, training, facilitation, and financing. And notably, the government resisted the post-Tumbler Ridge pressure for mandatory police reporting. As I argued in the Globe and Mail in March, requiring AI companies to report users’ private conversations to police would undermine privacy and encourage corporate surveillance, and the better approach was mandated transparency about corporate reporting policies. That is what the bill does: digital safety plans must disclose “the criteria and processes, if any, that the operator applies to determine if the Royal Canadian Mounted Police – or another law enforcement agency – should be notified” of content suggesting a risk of death or serious bodily harm, along with the number of notifications made and the circumstances. There is also a five-year statutory review that will assess those measures and recommend “whether an obligation should be imposed on operators to notify a law enforcement agency.” The government’s approach is to improve transparency now and consider whether it is sufficient later.

The Social Media Ban for Under 16’s

The headline measure, widely reported as a “temporary” ban on social media for those under 16, leaves many questions unanswered since the application of the ban, age verification methods, and exemption rules are all left to future regulation. The word “temporary” appears nowhere in the bill. What the bill actually provides, in section 27(1), is that an operator must,

“with respect to every regulated social media service specified by regulations made by the Governor in Council under subsection (5) that it operates, implement adequate age-verification or age-estimation measures designed to prevent a person under the age of 16 from being able to have an account with, or be otherwise registered with, the service.”

Subsection 27(4) removes any doubt: the obligation “applies only in respect of regulated social media services… specified in regulations.” In other words, the age of 16 is in the statute, but whether the restriction applies to any given platform is a future cabinet decision, made on a service-by-service or class-by-class basis, with no criteria in the bill to guide it.

The verification mandate, by contrast, is explicit and confirms what I wrote in this week’s FAQ and in my post on the “temporary” ban framing: an age-based restriction is, in practice, an age-verification requirement for everyone, since identifying who is under 16 means identifying everyone who is not. As part of the further delay in implementation, the Commission will decide whether the age verification system meets certain criteria, including privacy and freedom of expression safeguards. These provisions are clearly drafted with the Charter in mind. But experts say there are still privacy risks, and the government is effectively implementing a system that will verify the age of the majority of Canadians. In fact, there is even the possibility of two rounds of age verification by the same service such as X or Reddit: 16 for access to the social media service and 18 for access to pornography on the service.

A regulated social media service can seek an exemption from the Commission on the grounds that it “provides adequate safeguards in the regulated social media service for the protection of children.” But the criteria for that determination are left to Governor in Council regulations and Commission guidelines. The degree of uncertainty is astonishing: which social media services are covered, which age verification technology is adequate, and what measures are needed for exemption are just some of the issues to be determined after the law is enacted. What we do know is that teenagers today worried about losing access to social media can worry a little less as this will take a lot of time to sort out.

The AI Chatbot Regime: Mainstream Duties, Unbounded Definition

The government wisely took the duty path rather than the ban path on AI chatbots, an approach I argued last month would be even worse than the social media ban. There is no chatbot ban and no under-16 account restriction for chatbot services. Instead, the bill creates duties that track the emerging international mainstream found in California’s SB 243 and New York’s AI companion law. Regulated chatbot services must mitigate the risk of communicating harmful content and, under section 51, implement measures that, if a user

“expresses, on the service, a suicidal ideation, an intention to self-harm or an intention to commit an act that could cause death or serious bodily harm to an individual, cause the service to immediately interrupt its interaction with the user in order to direct the user towards crisis intervention services that are appropriate to the situation, are available at the moment when the user is directed towards them and permit the user to interact with a human being.”

This statutory interrupt-and-refer duty is the direct legislative answer to Tumbler Ridge. Section 53 adds duties to mitigate the risk that the service engages in harmful behaviour, including “posing as a human being,” “posing as a medical, legal or other licensed professional,” “using manipulative engagement techniques to encourage a user of the service to form or maintain an emotional attachment to the service in a way that may encourage the user to withdraw socially or disconnect from reality,” and “encouraging self-harm, suicide or the commission of acts that could cause death or serious bodily harm.” Taken on their own terms, these are reasonable obligations that have begun to emerge in jurisdictions around the world.

The problem lies in their application, since the bill defines a chatbot service as an AI system that, among other things, “is capable of being used, by means of multiple interactions or sessions, to simulate a sustained human-like relationship with a user, including one that may resemble friendship, an intimate relationship or therapeutic support.” The operative word is “capable.” This is a capability test, not a purpose test, and every general-purpose AI assistant with memory across sessions, including ChatGPT, Claude, and Gemini, would meet it. The exclusions make matters worse rather than better, since the bill excludes only systems that “exclusively serve a purpose specified in the regulations,” meaning the line between a regulated companion service and an unregulated productivity tool is yet another regulation that does not yet exist. The mandated age verification question also reaches chatbots through a different door: section 22 requires any regulated service, chatbots included, with reasonable grounds to suspect it provides access to pornographic content to implement age-verification or age-estimation measures, importing the Bill S-209 machinery into AI services at the content level. That does suggest that age bans could make their way into AI chatbots.

The Commission: More Power, Fewer Limits, Smaller Penalties

The third concern is the one the government never resolved the first time. My day-one assessment of Bill C-63 flagged the Digital Safety Commission’s regulatory power as a serious concern. The answer two years later is an even more powerful Commission with more undefined limits. Bill C-63’s three-pronged approach of the Commission, a Digital Safety Office, and a Digital Safety Ombudsperson has been consolidated into a single Digital Safety Commission of Canada that develops the regulations and guidance, assesses compliance, manages complaints, conducts audits, issues compliance orders, levies administrative monetary penalties, and decides the exemption applications that determine which platforms escape the under-16 restriction. Once again, the amount of uncertainty is the real story since the design features at the heart of the duty to protect children are simply those “set out in the regulations,” and the user thresholds that determine which services are covered at all are to be determined.

There are safeguards built into the system since the Commission must consider freedom of expression, equality rights, privacy rights, and the perspectives of Indigenous peoples when establishing guidelines, private messaging features are expressly excluded, and imprisonment is precluded for offences. But one quiet change cuts in the other direction and will surprise those who assume this bill gets tougher on platforms: the penalties have been cut roughly in half from Bill C-63, with the maximum administrative monetary penalty dropping from the greater of 6% of gross global revenue or $10 million to the greater of 3% or $10 million, and the top operator offence falling from 8% of global revenue or $25 million to 5% or $20 million. With the U.S. already signalling that age verification mandates and platform regulation are trade irritants, the softened penalty exposure for U.S. platforms alongside a discretionary, cabinet-triggered restriction regime suggests a government may be trying to hedge against another trade battle.

What Next?

The Bill C-63 experience demonstrated that the way to address an urgent issue is to start with a narrow scope that can attract broad support and move quickly, rather than an overbroad bill that invites months of legislative wrangling while the underlying harms remain unaddressed. A bill built on the duty to act responsibly, the duty to protect children through design, the takedown requirements, and the transparency obligations could move through Parliament with the support of most experts and parties. Instead, the government has pulled everything off the shelf by bundling that foundation with an age verification mandate whose application is left to the cabinet, a chatbot regime whose boundaries are left to regulation, and a Commission whose most consequential decisions will be governed by criteria no one has seen. A kitchen-sink bill invites opposition from every direction at once and virtually guarantees long delays in passing the bill, alongside even longer processes to bring the law into effect. With the bill clocking in at nearly 100 pages, there will be much more to come.