Comparing the Safe Social Media Act to CIPPIC’s Previous Positions

The Canadian government has introduced Bill C-34, the Safe Social Media Act, the latest attempt to regulate online harms after earlier bills died on the Order Paper. C-34 is more ambitious than its predecessors. It would: (1) set a minimum age of 16 for social media accounts on services the government designates, backed by mandated age checks; (2) create online harms duties for platforms; (3) require age checks on sites that host pornography; (4) set up a regulatory scheme for AI chatbots; and (5) establish a new federal regulator, the Digital Safety Commission of Canada (the Commission). Many of these measures echo earlier Canadian bills or laws adopted abroad.

There’s a lot to say about C-34.We’ll start by asking how it measures up against the recommendations CIPPIC advanced in its brief and open letter, both later picked up by TVO and National Post. On some points, the bill delivers. On others, it diverges from CIPPIC’s recommendations, or acknowledges the concern without fully resolving it. The key question is whether the bill achieves the underlying objective each recommendation was meant to serve.

CIPPIC previously urged the government to take the following steps. In this post, we assess Bill C-34 against each of them.

 ✓ 1. Engage in significant study and consultation with experts and stakeholders in Canada and beyond. 

We need a comprehensive regulatory strategy that aligns with efforts in like-minded countries, and that respects the global nature of the internet.

→ The government spent years consulting on online-harms policy. However, several of the bill’s measures don’t obviously trace back to that work, the clearest being the new minimum-age rules for social media (ss. 26-29). The government should identify the consultation those provisions rest on, and whether it heard from children and young people who have more at stake here than almost anyone.

 ✗  2. Legislate holistically rather than in isolation. 

Rather than focusing just on online harms, the government should tackle platform regulation holistically - as happened in the European Union with the introduction of the Digital Services Act and the Digital Markets Act in tandem. Online harms cannot be legislated in isolation. There is a growing consensus that platform amplification of harmful material is a symptom of business models premised on surveillance capitalism and the concentration of market power by technology companies.

→ C-34 stays narrow. It imposes duties on social media and chatbot services but leaves untouched the underlying incentives that drive harmful content toward users: recommendation systems, surveillance-based advertising, and concentrated market power. A law that treats the symptoms and ignores the causes can only go so far.

 ✗  3. Do not take actions that could jeopardize claims that Canada is a global leader in human rights. 

Ensure actions increase human rights rather than decrease them.

→ The bill’s age assurance duties (ss. 20-29) come with privacy safeguards: operators can collect personal information only to check age, must protect it, and must destroy it once the check is complete (ss. 22(2), 27(2)). The Commission also must consult the Privacy Commissioner before it issues age-assurance guidelines (s. 122(2)). The question is whether those safeguards will survive contact with commercial incentives. Faced with heavy penalties, platforms will have every reason to choose the method easiest to defend as “effective” age-verification. In practice, that will mean government ID checks and facial scans rather than less intrusive alternatives. The likely result will be large-scale collection of sensitive identity data by private companies, creating privacy and security risks well beyond anything the bill appears to contemplate. We already show ID to buy alcohol, but handing identity documents or facial data to online platforms introduces a different order of risk.

 ✗  4. As a first step, acknowledge how business models premised on surveillance capitalism contribute to online harms. 

Legislate from this basis.

→ The bill doesn’t touch this. Surveillance capitalism goes unnamed, though the same concern runs through recommendations 2 and 3. The bill targets harmful content hosted on platforms but leaves the data-harvesting model that drives it untouched.

 ✗  5. Definition regulated service providers with precision. 

The statute should clearly identify those services it regulates and those it does not. Canada should follow international best practice by choosing a clear scoping model: either a broad, technologically neutral definition, or a narrow definition limited to specified services. Any exclusions, including for services that facilitate private communications, should be just as clear. 

→ C-34 creates three categories of regulated entities: regulated social media services, chatbot services, and online services. It also adopts the carve-out CIPPIC proposed by excluding private messaging. But the bill leaves the larger scoping questions to regulation. Whether a service is covered at all will depend on user thresholds and designations Cabinet has not yet set. Regulations may also capture new categories of “online services” on the Commission’s recommendation. That gives the executive too much control over the statute’s reach. Parliament should decide, openly and in the legislation itself, who the law covers.

 ✗  6. Avoid arbitrary takedown deadlines. 

When service providers must assess and remove illegal content, the law should require them to act expeditiously. It should not impose rigid deadlines, such as mandatory removal within 24 hours.

→ C-34 sets exactly the kind of hard deadline CIPPIC cautioned against: operators must remove content within 24 hours once a user flags it, or once the operator spots it themselves (ss. 43, 44). The obligation only applies to the most serious material: content that sexually victimizes a child or revictimizes a survivor (CSAM and related material) and non-consensual intimate images (NCII). But even in these categories, speed can come at the expense of lawful expression. The risk of over-removal is real. A fixed 24-hour clock gives platforms little time to assess context, legality, consent, newsworthiness, evidentiary uncertainty, or bad-faith complaints. Faced with heavy penalties, platforms will have every incentive to remove first and ask questions later. That may be understandable as compliance strategy, but it is a poor rule for lawful expression. The risk is greatest in close or disputed cases. C-34’s broad definitions make that risk greater still. An expeditious removal standard would better preserve urgency while allowing platforms, regulators, and courts to distinguish obvious illegality from harder cases that require care.

 ✓ 7. Narrow mandatory reporting to law enforcement. 

Reporting obligations should remain limited to serious harms such as child exploitation material. Reporting requirements must remain limited to content that service providers discover through the general course of providing their services. A reporting obligation cannot be combined with a proactive content discovery obligation.

→ The bill starts in the right place—operators are not required to proactively hunt for content (s. 12(1)), which speaks directly to one of CIPPIC's main concerns. But s. 12(2) then leaves the door open for regulations to require upload-prevention technology for child abuse material, and that edges back toward proactive monitoring. The reporting obligations are also unsettled: the Commission must issue guidelines on when operators should notify the RCMP about certain content (s. 17) and must consult the RCMP before doing so (s. 123). Meanwhile,  whether operators will face a binding duty to report is left to a later review (s. 128). Parliament should keep any reporting regime focused on serious harms and prevent it from hardening into a monitoring duty in practice.

 ✓ 8. Separate proposed changes to the Criminal Code and the Human Rights Act from the Social Media Act for independent parliamentary consideration.

→ C-34 does not touch the Criminal Code or the Canadian Human Rights Act. Its consequential amendments are housekeeping, such as adding the new Commission to the Access to Information Act and the Privacy Act. The previous online-harms package bundled several contested reforms together, while this bill lets Parliament judge the social-media rules on their own merits.

✗  9. Avoid complaint incentives that invite abuse. 

Complaint systems should not encourage users to test their luck by filing weak or strategic complaints. Anonymous complaints, no filing cost, and high penalties for the respondent can undermine basic fairness where there is no serious assessment of evidence, context, or truth.

→ C-34 avoids the bounty structure CIPPIC flagged. Complainants receive no payout. Ordinary users whose posts are challenged face no fine. The penalty regime applies to operators, not to individuals for what they post (ss. 83, 107-108). The bill also builds in some friction. A complainant must first try to resolve the matter with the platform (s. 68(2)). The Commission may screen out complaints that are trivial, frivolous, vexatious, or made in bad faith (s. 68(4)). The user who posted the content is also entitled to make representations (s. 69). The remaining concern is lawful expression: a complaint may trigger an interim takedown before the Commission decides anything (s. 68(6)), so content may be suppressed while the complaint is assessed, even where it later proves to be perfectly lawful. Much will turn on process: whether the person who posted enjoys a genuine chance to respond and on how rigorously the Commission filters out weak or abusive complaints.

This is only part of the picture. Bill C-34 is big. CIPPIC will follow with further commentary that take account of what has changed since we last weighed in.