On June 10, 2026, Canadian Heritage Minister Marc Miller tabled Bill C-34, the Safe Social Media Act, in the 45th Parliament. The bill enacts two statutes — the Digital Safety Act and the Digital Safety Commission of Canada Act — and it is now at second reading in the House of Commons (LEGISinfo). The headline feature is a 16+ minimum age for social media accounts. The more consequential feature is the regulator it builds to enforce it.
The case for acting
The strongest argument for C-34 is real and should not be dismissed. Children encounter genuine harm online — child sexual abuse material, non-consensually shared intimate images, and, increasingly, AI chatbots that simulate intimacy without guardrails. The bill imposes three duties on operators: to protect children, to act responsibly, and to be transparent. It requires a 24-hour takedown of material that "sexually victimizes a child or revictimizes a survivor," or intimate content shared without consent (Sections 43–44 of the first-reading text). Few would defend the status quo, in which that content can circulate for days while platforms route complaints into a void. On the worst categories of harm, a hard clock is defensible and proportionate.
A framework that is mostly blank
The problem is that almost everything else in C-34 is deferred. The bill announces a 16+ rule, but Section 27(1) requires operators to deploy "adequate age-verification or age-estimation measures" — without defining "adequate," naming an acceptable technology, or specifying which services count as "social media" in the first place. Cabinet designates the regulated services by regulation, and the new Commission decides what verification it will accept.
Law professor Michael Geist counts roughly 50 substantive decisions punted to regulations and to a Commission that does not yet exist (michaelgeist.ca). Osler's analysis reaches the same conclusion from a practitioner's angle: "the precise scope of application of the Act will not be known until draft regulations are circulated" (Osler). Parliament is being asked to approve a destination and let an unappointed body draw the map.
That is not a drafting quibble. Age verification at national scale means building a system to check the age of most adult Canadians — by government ID or facial estimation — before they can use ordinary services. Whether that system retains data, who audits its accuracy, and how it fails are precisely the questions the bill leaves open. Geist warns the design exposes "tens of millions of Canadians" to a new privacy attack surface. A safeguard that protects children by forcing every adult to hand over identity documents to a platform is not obviously a net gain for safety.
A super-regulator with thin guardrails
The Digital Safety Commission would set verification standards, define platform obligations, grant or withhold exemptions, run audits, compel testimony on oath, and levy administrative monetary penalties of up to the greater of 3% of global revenue or C$10 million (Osler). It both polices platforms and is meant to advocate for users — dual roles that sit awkwardly in one body. During a transitional period, a single cabinet-appointed Chair can wield the Commission's powers alone.
The bill does instruct the Commission to "take into account" freedom of expression, equality, and privacy when issuing guidelines (Section 18), and says operators need not adopt measures that "unreasonably or disproportionately limit users' expression" (Sections 22(3), 32(3), 37(3)). These are welcome, but they are framed as factors to weigh rather than hard limits. The Canadian Constitution Foundation argues the speech provisions are vague enough to invite over-removal of lawful content, calling the bill "a sneak-attack on the constitutionally-protected right to freedom of expression for adults and mature minors" (CCF). When penalties are large and definitions are soft, platforms rationally over-comply — and lawful speech is the collateral.
The AI chatbot overreach
C-34 is among the first Canadian statutes to impose direct safety duties on AI chatbot operators — requiring crisis-intervention referrals and bans on bots posing as humans or licensed professionals. Sensible aims. But the definition turns on a capability test, not a purpose test: any system that can "simulate a sustained human-like relationship" qualifies. As Geist notes, that sweeps in general-purpose assistants like ChatGPT, Claude, and Gemini — tools used overwhelmingly for work and learning, not the companion-bot harms the provision targets. Regulating by capability rather than use is how a child-safety bill quietly becomes AI regulation.
A better path
None of this requires abandoning child safety. It requires sequencing. Parliament could legislate the narrow, well-evidenced duties now — the 24-hour takedown for CSAM and non-consensual intimate images, transparency reporting — while putting the contested machinery (national age verification, the chatbot definition, exemption criteria) through public consultation with the actual standards on the table before the vote, not after. Notably, C-34 already softened its predecessor: maximum administrative penalties fell from 6% of global revenue under the 2024 Online Harms Act (Bill C-63) to 3% here. That shows the design is negotiable. Canadians deserve to see the rules before their Parliament enacts the power to write them.