A ban whose mechanics are missing
Bill C-34, the Safe Social Media Act, reached second-reading debate in the House of Commons in the week of 21 October 2026. It would require certain regulated social media services to block users under 16 from holding accounts. According to the Canadian Heritage summary of the bill, a service can avoid the age floor only if it receives an exemption from a new Digital Safety Commission of Canada, by showing its product is safe for children. That summary does not say how services would check anyone's age.
That gap matters more than the headline age. A rule that bars under-16s can only be enforced by sorting every user by age, and the bill defers how that happens.
The strongest case for the bill
The argument for acting is serious. Parents and clinicians have watched young teenagers spend hours in products designed to maximise engagement, and voluntary platform controls have not satisfied them. Culture Minister Marc Miller told a McGill University conference on 22 October that if the harms were occurring in a playground, "the playground would be swarmed by police and shut down," as CP24 reported. A clear age floor also gives families a simple social norm, and an exemption route lets safer services keep serving teens. Parliament is entitled to treat child welfare as urgent.
Delegating the hard decisions
The difficulty is that C-34 settles the political question and delegates the practical ones. Three are open.
- Verification method. Per CP24, the regulator would decide whether platforms' age-verification methods are effective and respect privacy. The bill gives no method, no accuracy standard and no data-handling rule on its face.
- Exemption criteria. Miller has said the bar for an exemption would be quite high and that committee might help set the criteria. Conservatives questioned the guidelines for the temporary ban. A ban whose exceptions are defined later invites lobbying and uneven treatment of similar services.
- Timing. CP24 reports that officials said at introduction that standing up the regulator would take 18 months. Miller would not commit to a timeline beyond wanting to "get things in place as quickly as possible."
Together, these mean Parliament would vote on a prohibition before it knows what compliance costs, what data it requires, or who qualifies for relief. Proportionate regulation usually runs the other way: the burden is specified, then the rule is made binding.
What Australia's experience suggests
Australia's under-16 minimum age took effect on 10 December 2025. Within weeks, the prime minister's office reported that more than 4.7 million under-16 accounts had been deactivated, removed or restricted, and described the figures as preliminary. That is a large number, but it counts accounts, not children, and it does not show that the rule works.
Miller himself pointed to enforcement weaknesses. CP24 relays examples from Australia in which one platform asked underage users whether they were sure they were not 16 and then let about 130,000 through, and another gave users more than two dozen daily chances to pass third-party age estimation tests. Miller said "malicious compliance, I believe, is real." The lesson is not that age rules are pointless. It is that verification design decides whether a ban is a real barrier or a speed bump, and that this design cannot be left vague.
The speech and privacy costs of getting it wrong
Strict verification has a price for everyone. If platforms must prove who is under 16, adults will be asked to hand over identity documents or face scans to use general-purpose speech platforms. That creates breach-prone data stores and chills anonymous speech, including for people who cannot easily verify their age at all. Civil liberties groups are already sceptical of the government's online agenda: the Electronic Frontier Foundation is campaigning against the separate Lawful Access Act, Bill C-22, which has passed the Commons and is before the Senate. Stacking an identity-linked access regime on top of expanded surveillance powers deserves scrutiny as a package, even though the two bills are distinct.
The opposite failure is real too. If the bar is set too low, platforms can satisfy the law with cosmetic checks and teens keep their accounts. Either way, vagueness shifts decisions from elected legislators to a five-member commission appointed by cabinet with power to issue binding orders and fines.
What committee should fix
If second reading passes, the committee stage is the place to put the missing detail into the statute rather than leaving it to regulation:
- Statutory floor on privacy. Require data minimisation and prohibit retaining identity documents or biometric templates after a check, with a preference for privacy-preserving, device- or token-based approaches.
- Published exemption criteria. Set objective tests in the bill or in regulations subject to Parliament's review, so comparable services are treated alike.
- Evidence and sunset. Require the Commission to publish measured outcomes, such as how many minors actually lose access and how many adults are blocked in error, and review the age floor after a fixed period.
- A realistic start date. Do not make a ban binding before the regulator can say what compliance means.
Canada can protect children without building a general identity checkpoint for the internet. That requires specifying the checkpoint's limits first. A bill that fixes the age, the penalty framework and the regulator, but not the method, has done the easy part of the job.