Canada’s federal government has proposed banning everyone under 16 from social media \u2014 but legal experts say the bill’s most significant privacy impact falls on tens of millions of Canadian adults who never consented to handing their identity documents to a third-party verification company. Bill C-34, the Safe Social Media Act, is now at second reading in the House of Commons as Parliament sits in summer recess, with debate set to resume in September. While the government frames it as a child-safety measure, the mechanism that would make it work requires every adult Canadian user to prove their age before accessing any regulated platform \u2014 and nobody has yet decided how that proof will be collected, or by whom.<\/p>\n
That is not a minor technical detail. It is the question on which the bill’s entire promise turns \u2014 and on which its biggest risk to ordinary Canadians depends.<\/p>\n
What ‘Protecting Children’ Actually Requires From Every Adult on Social Media<\/p>\n
When a law bars users under a specific age, it cannot enforce that bar without determining the age of everyone who wants in \u2014 including people the law is not trying to restrict at all. University of Ottawa law professor Michael Geist, Canada’s foremost internet law scholar, put it plainly in June: “It’s not just kids that are going to be forced to provide some sort of age verification. That’s a very risky approach.”<\/p>\n
The bill would require regulated social media services to implement “effective and proportionate age-verification or age-estimation measures” designed to prevent users under 16 from registering accounts. But it does not specify what those measures are. That specification falls to the Digital Safety Commission of Canada, a new regulatory body that would take up to 18 months to become fully operational after the bill receives Royal Assent \u2014 which is not expected before the end of 2026 at the earliest.<\/p>\n
The result is a gap that legal analysts at Gowling WLG described as requiring “careful consideration”: age verification could be implemented before any privacy regulator has reviewed it. Bill C-36, a companion privacy reform introduced on June 15, 2026, strips the Privacy Commissioner of enforcement authority and transfers it to the Commission \u2014 but that transfer is sequenced after the Commission begins work on age verification. Geist warned that under this structure, the age verification system could operate “with no privacy review at all for a policy that affects tens of millions of Canadians.”<\/p>\n
What the Bill Would Actually Do<\/p>\n
Bill C-34 is two pieces of legislation packaged together: the Digital Safety Act and the Digital Safety Commission of Canada Act. The Digital Safety Act organizes platform obligations under three duties: act responsibly, protect children, and make certain content inaccessible.<\/p>\n
The duty to protect children includes the social media age restriction for under-16s, which would apply to social media services designated by the Governor in Council \u2014 a list to be set by Cabinet through regulation, without Parliamentary debate, according to the Canadian Constitution Foundation. Platforms providing “adequate safeguards” for children could seek an exemption from the Commission. The exemption criteria, like the age-verification method, are left to future regulation.<\/p>\n
The bill would also require platforms to remove child sexual abuse material and non-consensually shared intimate images within 24 hours. Operators of regulated social media services would need to identify risks of harmful content, implement safety-focused design features, label AI-generated material, provide blocking and flagging tools, and submit publicly disclosed digital safety plans.<\/p>\n
Separately, the bill would become the first Canadian statute to impose direct safety obligations on AI chatbot services \u2014 including mandatory crisis-intervention mechanisms for users expressing suicidal ideation, prohibitions on chatbots deceiving users about their non-human nature, and requirements to mitigate behaviors that foster “harmful emotional dependence” or parasocial relationships with users.<\/p>\n
A New Regulator With Sweeping Power<\/p>\n
Below the social media ban, Geist has argued that the bill’s most consequential provision may be the creation of the Digital Safety Commission of Canada. The Commission would wield authority across at least 31 separate regulatory heads \u2014 setting national age-verification standards, determining what constitutes harmful content, deciding whether to lift age restrictions for specific platforms, and overseeing compliance audits and researcher data access.<\/p>\n
The Commission would be empowered to hold public and private hearings, summon witnesses, compel document production, issue compliance orders enforceable through the Federal Court, and publicly name violators. It would be financed through cost-recovery charges levied on the regulated companies themselves \u2014 a structure that critics say creates structural conflicts of interest.<\/p>\n
Geist described the proposed body as a potential “super-regulator of the Internet, with greater influence over the daily lives of Canadians than perhaps any other regulator in the country.”<\/p>\n
The Fines Are Designed to Get Attention<\/p>\n
The enforcement regime targets the financial calculus of the world’s largest platforms. For administrative monetary penalties, the Commission could impose fines of up to $10 million or three percent of a company’s gross global revenue \u2014 whichever is greater. If violations are prosecuted as criminal offenses and convicted on indictment, penalties would escalate to $20 million or five percent of global revenue, whichever is greater.<\/p>\n
For a company like Meta, whose 2024 revenues exceeded $160 billion USD, a five-percent fine could represent penalties in the eight-figure range. The bill’s architects designed the global-revenue basis specifically to make the arithmetic uncomfortable for the largest platforms.<\/p>\n
What the Age Verification Industry’s Track Record Tells Canada<\/p>\n
The technical method chosen for age verification will determine how much of Canadians’ personal data enters a new private data ecosystem \u2014 and how exposed that data will be.<\/p>\n
There are five methods currently in use: self-declaration (typing a birth date, with no verification and trivially bypassed), credit-card-based checks (slightly harder to circumvent, historically subject to fraud), government-ID document uploads (high accuracy, maximum privacy cost), facial age estimation using machine learning on a selfie (disputed accuracy across demographic groups, collects biometric data), and zero-knowledge cryptographic proofs (privacy-preserving in principle, not yet deployed at consumer scale).<\/p>\n
The track record of the companies most likely to supply the government-ID and biometric approaches should concern anyone preparing to hand them a driver’s license. AU10TIX, an Israeli identity verification company whose clients include TikTok, Uber, and X, left its administrative credentials exposed from December 2022 through at least June 2024 \u2014 a period during which access to a logging platform containing users’ names, birth dates, nationalities, and identity document images was available through those credentials, first posted to Telegram in March 2023. The Electronic Frontier Foundation characterized AU10TIX’s systems as “surveillance systems” whose data breaches were “not a hypothetical concern.”<\/p>\n
Yoti, a British age-verification provider used by Sony, Meta, TikTok, and Spotify, was fined \u20ac950,000 by Spain’s data protection authority in March 2026 for three GDPR violations: unlawful processing of biometric data, processing without valid consent, and excessive data retention. In October 2025, a breach at Discord’s own age-verification deployment exposed approximately 70,000 users’ government IDs, according to Geist.<\/p>\n
Zero-knowledge proof systems can verify that a user meets an age threshold without revealing their identity to either the platform or the verifier. The EU has piloted attribute-based verification systems that preserve anonymity. Bill C-34 does not specify whether such systems would satisfy its “effective” threshold \u2014 that question, again, goes to the Commission.<\/p>\n
What the Government Says, and What the Evidence From Australia Says<\/p>\n
The government’s case for the bill rests on data that is genuinely alarming. Canadian police services reported 16,905 incidents of online child sexual exploitation in 2024 \u2014 a 347-percent increase since 2014, according to Statistics Canada. One in four Canadian youth aged 12 to 17 reported experiencing cyberbullying in 2019. The Canadian Medical Association, which backed the bill publicly, has linked these trends to social media’s algorithmic design and noted that Canada ranks 30th out of 38 high-income countries on youth well-being metrics.<\/p>\n
A March 2026 Angus Reid Institute poll found 75 percent of Canadians support an outright ban for under-16s. But the same poll found that 72 percent of respondents believe parents \u2014 not governments \u2014 should be primarily responsible for regulating teens’ social media use, and only 32 percent selected 16 as the right threshold age when asked directly.<\/p>\n
Australia became the first country to implement a hard under-16 social media ban, which took effect December 10, 2025. By mid-January 2026, the Australian government reported that more than 4.7 million accounts believed to belong to under-16 users had been deactivated, removed, or restricted. But a peer-reviewed study published in the British Medical Journal on June 25, 2026 found that three months after the law took effect, more than 85 percent of Australian respondents under 16 reported still using social media platforms covered by the ban \u2014 most through their own accounts. The study, by researchers at the University of Newcastle, described “limited implementation, incomplete compliance, and substantial circumvention of social media restrictions.” The most common age check encountered: self-declaration, which is trivially bypassed.<\/p>\n
Geist, writing on July 8, 2026, added a further consequence that no policy assessment appeared to have considered: the ban also cuts young Canadians off from news \u2014 compounding harm already caused by Canada’s Online News Act, which prompted Meta to block news links on Facebook and Instagram, reducing youth access to journalism even before any social media ban.<\/p>\n
Who Objects, and Why<\/p>\n
The Canadian Civil Liberties Association issued a sharp response on the day the bill was tabled. “Greater transparency and accountability from tech companies is long overdue. But that must come through clear, targeted rules, not sweeping obligations and an open-ended government authority over any regulated service,” said CCLA Executive Director Howard Sapers. “A blank check for federal power is the wrong answer to a real problem.” The CCLA warned that platforms would be “tempted to over-comply at the expense of users’ freedom of expression and privacy rights.”<\/p>\n
The Canadian Constitution Foundation characterized the bill as “a sneak-attack on the constitutionally-protected right to freedom of expression for adults and mature minors,” and launched a public petition against it. The foundation specifically flagged that Cabinet, not Parliament, would decide which platforms fall under the bill’s requirements \u2014 without debate.<\/p>\n
Geist’s sharpest structural critique targets the bill’s relationship with its predecessor. Bill C-63, the Online Harms Act, died on the order paper when Parliament prorogued in January 2025 \u2014 but it reached second reading debate before it did, drawing withering criticism from the same civil liberties community now training its sights on C-34. The current bill eliminates the Criminal Code reforms that generated the most acute constitutional objections in 2024 and 2025. But Geist argues that the Commission’s open-ended mandate \u2014 with 50 or more key decisions left to future regulation \u2014 replaces one set of risks with another. “The government has repeated the same overreach,” he wrote.<\/p>\n
Meta called social media bans “counterproductive” but indicated it was “encouraged that the government appears to recognize that online services that provide teens with sufficient safeguards provide real value to young people<\/a>” \u2014 signaling that Meta intends to pursue the Commission’s exemption pathway rather than oppose the ban outright.<\/p>\n Third Try: Canada’s Online Harms Legislative History<\/p>\n Bill C-34 is the federal government’s third attempt at online harms regulation. A public consultation launched in 2021 produced no legislation. Bill C-63, introduced under the Trudeau government in February 2024, bundled platform duties with Criminal Code hate-speech amendments \u2014 including life-imprisonment provisions that drew comparisons to thought-crime legislation from prominent critics, including author Margaret Atwood. C-63 died on the order paper when Parliament prorogued ahead of the 2025 election, after reaching second reading debate but never clearing the House.<\/p>\n C-34 drops the Criminal Code reforms entirely. Its architects argue the resulting bill is more narrowly focused on platform accountability and is therefore more likely to survive parliamentary and legal scrutiny. Critics argue the Commission’s authority is so broad that a bill focused narrowly on platform duties has been bundled with a regulator that is not narrow at all.<\/p>\n Canada Joins a Global Race With a Mixed Record<\/p>\n The movement Canada has joined is large and moving fast. The United Kingdom’s Online Safety Act 2023 brought mandatory age assurance for adult content into force as of July 2025 \u2014 and triggered a 1,400-percent surge in VPN signups, according to Proton VPN data, as users bypassed the checks immediately. France aims to restrict social media access for under-15s from September 2026. Denmark has committed to a similar restriction for under-15s. As of May 2026, 23 of the European Union’s 27 member states were moving in the same direction, according to global social media age restriction laws<\/a>. Greece announced in April 2026 that it would ban under-15s from January 2027.<\/p>\n Australia’s experience \u2014 the most mature data point available \u2014 shows that banning under-16s raised 4.7 million accounts in the first month but left 85 percent of the target population still using the platforms three months later. Australia’s Communications Minister Anika Wells blamed the platforms rather than the policy: “Australia’s world-leading social media laws are not failing. But big tech is failing to obey the laws.” Whether that defense is convincing is a question Canada’s Digital Safety Commission would eventually inherit.<\/p>\n What Happens Next<\/p>\n Parliament returns from summer recess on September 21, 2026. Bill C-34 is at second reading. Committee study is expected in fall 2026, followed by third reading, Senate readings, and Royal Assent \u2014 a process legal analysts broadly expect to extend well into late 2026 at the earliest. The Digital Safety Commission itself would require up to 18 months to become operational after the bill passes.<\/p>\n In the interim, the government has said that once Royal Assent is received, platforms would immediately be required to enforce the under-16 account restriction. That commitment is in tension with the bill’s own text, which ties implementation to Commission standards that cannot exist until the Commission is established.<\/p>\n Culture Minister Marc Miller, who introduced the bill on June 10, 2026, has said the urgency is real: “The safety of children can’t be an afterthought.” He added that the exemption pathway for platforms that implement “adequate safeguards” is deliberate \u2014 an incentive for platforms to change their design rather than simply block access. Whether any major platform will pursue that pathway before the Commission exists to evaluate it remains unclear.<\/p>\n For Canadian parents, teenagers, platform operators, and AI developers, the months between now and Parliament’s September return are a window in which the government is consulting on age verification methods, user thresholds, and harmful content definitions \u2014 without having yet resolved the most consequential question of all: what information every adult Canadian will be required to hand over, and to whom, before they can log on.<\/p>\n Frequently Asked QuestionsWill Canada’s social media ban actually stop children from using platforms?<\/p>\n Early evidence from Australia \u2014 the only country with a comparable law currently in operation \u2014 suggests significant limits on its effectiveness. A peer-reviewed study published in the British Medical Journal in June 2026 found that more than 85 percent of Australian under-16s continued using banned platforms three months after the law took effect, primarily by using their own existing accounts or bypassing self-declaration age checks. The most common verification method encountered by under-16 users was simply typing in a date of birth. Canada’s Digital Safety Commission would be responsible for requiring stronger methods, but the Commission will not exist for up to 18 months after the bill passes.<\/p>\n Does Bill C-34’s under-16 ban require adults to verify their age too?<\/p>\n Yes, in practice. Any system that effectively prevents under-16 users from accessing a platform must first identify who is not under 16 \u2014 which means requiring all users to demonstrate their age. As Geist has explained, “an under-16 ban functionally requires age-checking the entire population.” Bill C-34 leaves the specific method undefined, delegating it to the Digital Safety Commission once that body is established. Depending on which method is chosen, this could mean government-ID uploads to third-party verification companies, facial scans for biometric estimation, or, in the most privacy-preserving scenario, zero-knowledge cryptographic proof systems that verify age without revealing identity. The latter option exists technically but is not yet deployed at consumer scale, and the bill does not specify whether it would satisfy the “effective” requirement.<\/p>\n What happens to the age-verification data collected under this system?<\/p>\n The bill requires that age-verification measures be “privacy-protective” \u2014 but the specific data-handling standards will be set by the Digital Safety Commission, which does not yet exist. The track record of the companies most likely to supply these services provides context: AU10TIX, which verifies identity for TikTok, Uber, and X, left administrative credentials exposing users’ driver’s license images, names, and birth dates accessible through Telegram from at least March 2023 through June 2024. Yoti, which verifies age for Meta, Sony, and TikTok, was fined \u20ac950,000 by Spanish regulators in March 2026 for unlawfully processing biometric data and retaining it longer than permitted. A separate breach in October 2025 at Discord’s age-verification deployment exposed approximately 70,000 users’ government IDs. The Electronic Frontier Foundation has described government-ID-based age verification systems as “surveillance systems” in which data breaches are “not a hypothetical concern; it is simply a matter of when.”<\/p>\n When would Canada’s Social Media Act actually take effect?<\/p>\n Parliament returns from summer recess on September 21, 2026. If Bill C-34 clears the House and Senate and receives Royal Assent \u2014 a process legal analysts expect no earlier than late 2026 \u2014 the under-16 account restriction would take effect immediately upon Royal Assent, according to the government. The Digital Safety Commission, which would set the age-verification method and administer the bill’s other provisions, would require up to 18 months to become fully operational after the bill passes \u2014 potentially placing real-world enforcement of the broader framework as far out as 2028. Track Bill C-34 legislative progress<\/a> at the Parliament of Canada.<\/p>\n","protected":false},"excerpt":{"rendered":"Canada’s federal government has proposed banning everyone under 16 from social media \u2014 but legal experts say the…\n","protected":false},"author":2,"featured_media":131291,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[32548,43495,32642,17,32640,31627,43494,8067,1194],"class_list":["post-131290","post","type-post","status-publish","format-standard","has-post-thumbnail","category-canada","tag-age-verification","tag-au10tix","tag-bill-c-34","tag-canada","tag-canada-social-media-ban","tag-children-online-safety","tag-digital-safety-commission-canada","tag-privacy","tag-social-media"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/posts\/131290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/comments?post=131290"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/posts\/131290\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/media\/131291"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/media?parent=131290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/categories?post=131290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/tags?post=131290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}