Canada’s Digital Rulebook Is Being Rewritten. Parents, Educators and Citizens Should Pay Attention.
Canada is not debating one privacy bill. It is watching a digital rulebook being rebuilt in pieces.
Over the past year, Canadians have seen a cluster of proposals dealing with privacy, children’s safety, lawful access, social media, age verification, AI chatbots, harmful content, consumer data and online pornography. Each one sounds reasonable when presented alone. Who is against protecting children? Who is against privacy? Who is against stopping fraud? Who is against giving police lawful tools to investigate serious crimes?
But legislation does not operate in isolation. When several bills point in the same direction, citizens need to ask what kind of digital society is being assembled.
Are we strengthening privacy, safety and accountability?
Or are we normalizing identity checks, platform gatekeeping, lawful-access expansion, automated enforcement and a new generation of digital regulators with broad influence over everyday life?
The answer is not simple. Some of these proposals contain useful protections. Some respond to real harms. Some may help children, parents, victims and investigators. But they also raise serious questions about civil liberties, privacy, expression, access to information, digital identity, autonomy and public trust.
The responsible position here is not panic. It is scrutiny.
First, what are the bills?
A bill is a proposed law. It is not law until it passes through Parliament, receives Royal Assent and comes into force. Some provisions may also depend on regulations written later, which means the details may arrive after the political debate has cooled.
That is one reason Canadians should pay attention now.
Bill C-36, the proposed Protecting Privacy and Consumer Data Act, would replace much of Canada’s current private-sector privacy framework under PIPEDA. It recognizes privacy as a fundamental right, defines personal information to include inferred information, gives children’s personal information special sensitivity, and creates transparency obligations around automated decision systems that produce predictions, recommendations or decisions with legal or similarly significant effects. It is currently at second reading in the House of Commons.
Bill C-34, the Safe Social Media Act, would enact the Digital Safety Act and create the Digital Safety Commission of Canada. It applies to regulated social media services and regulated chatbot services, and would impose duties related to harmful content, synthetic content, digital safety plans, child protection, age restrictions, and age verification or age estimation. It is also at second reading in the House. Bill C-22, the Lawful Access Act, 2026, is aimed at modernizing lawful access to digital information for law enforcement and national security purposes. It includes provisions related to subscriber information, transmission data, production orders, foreign entities and non-disclosure orders. It is already before the House Standing Committee on Public Safety and National Security. Bill S-209, the Protecting Young Persons from Exposure to Pornography Act, would create offences for organizations that make pornographic material available to young persons for commercial purposes, subject to prescribed age-verification or age-estimation methods. It passed the Senate and is now at second reading in the House.
These bills are not identical. They do not do the same thing. But they overlap around a common set of issues: digital access, identity, age assurance, platform duties, automated systems, children’s safety, privacy enforcement and state authority.
That is why Canadians should not evaluate them one at a time, as if each were a separate appliance in the policy kitchen. They are more like wiring. Once installed, they shape what can be connected later.
The harms are real
Let’s start with the obvious: children do face serious risks online.
Cyberbullying is real. Sextortion is real. Non-consensual intimate imagery is real. Child sexual exploitation material is real. Algorithmic feeds can amplify harmful material. AI chatbots can simulate intimacy, authority or therapeutic support in unsafe ways. Parents are overwhelmed. Educators are trying to teach judgment inside systems designed to monetize attention.
Statistics Canada reported that one in four youth aged 12 to 17 had experienced cyberbullying in the previous year, based on 2019 data, and that one-quarter of young adults aged 18 to 29 experienced cybervictimization in 2018.
Statistics Canada also reported 16,905 police-reported incidents of online child sexual exploitation in 2024, a rate of 223 incidents per 100,000 children and youth aged 17 and younger.
So no, this is not a manufactured problem.
The issue is whether the proposed solutions are necessary, proportionate, effective and privacy-preserving.
Good intentions are not the same thing as good architecture.
Bill C-36: privacy reform, but not a full AI law
Canada needs private-sector privacy reform. PIPEDA was written for an earlier Internet. It is not well suited to a world of data brokers, AI training sets, behavioural advertising, cross-device tracking, automated decisions, inferred profiles and personalized fraud.
Bill C-36 contains important improvements. Recognizing privacy as a fundamental right matters. Treating inferred information as personal information matters. Treating children’s personal information as sensitive matters. Requiring plain-language explanations for certain automated decisions matters.
A strong privacy law can help reduce downstream AI and fraud harms by limiting the collection, retention, reuse and inference of personal data in the first place. Fraud thrives on personal context: urgency, authority, identity clues, account compromise, phishing, pretexting, dark patterns and emotional manipulation. The more personal data is collected and reused, the easier it becomes to personalize deception at scale.
But Bill C-36 should not be mistaken for a complete AI accountability framework. It does not replace the kind of risk-based AI legislation now emerging internationally. The EU AI Act, for example, uses a risk-based structure that prohibits some practices, regulates high-risk systems and imposes transparency obligations on others.
Canada still needs a clear AI accountability framework that deals directly with model governance, high-impact systems, bias, safety testing, explainability, procurement, public-sector use, third-party audits and meaningful remedies.
Bill C-36 may be a privacy foundation. It is not the whole house.
Bill C-34: platform accountability, chatbot safety and the age-check problem
Bill C-34 is not simply a “ban kids from social media” bill. It is broader than that.
It would impose duties on regulated social media services to mitigate harmful-content risks, provide blocking and flagging tools, publish guidelines, preserve certain removed content in defined cases and submit digital safety plans. It also addresses regulated chatbot services, including risks related to harmful content, suicidal ideation, self-harm, deceptive human-like presentation, false professional authority and manipulative engagement techniques.
That part deserves serious consideration. AI companions, therapy-like chatbots and intimacy-simulating systems should not be allowed to operate as emotional slot machines for children.
The harder question is age assurance.
To restrict access by age, someone must determine age. That can mean self-declaration, parental verification, document upload, facial age estimation, device-level age signals, app-store controls, telecom controls, behavioural inference, third-party vendors or digital ID.
Each method has trade-offs.
A self-declared birthday is easy to evade. A government ID check creates identity-theft risk. A facial scan normalizes biometric screening. Behavioural age inference expands surveillance. Parental verification can create phishing, coercion and family-safety risks. Third-party age vendors become attractive targets. Device-level checks turn phones and operating systems into enforcement points. Platform-level checks may exclude vulnerable youth from support, community, education, news and expression.
Bill C-34 does include privacy-protective language. Its age-verification and age-estimation provisions require measures to collect or use personal information only for age verification or estimation, destroy that information once verification or estimation is complete, and protect it until destruction.
That is welcome. But it does not end the discussion.
Canadians still need to know who performs age checks, what data is processed, what error rates exist, whether systems work equally well across groups, whether vulnerable youth are harmed, whether appeals exist, and whether the infrastructure can be reused later for other purposes.
Bill C-22: lawful access requires lawful restraint
Law enforcement has a legitimate problem. Serious crimes happen online. Sextortion, child exploitation, ransomware, trafficking, fraud and threats of violence require investigation.
But lawful access powers always require strict limits.
Bill C-22 includes production orders for subscriber information, transmission data and foreign entities, along with non-disclosure orders in certain contexts.
That may help investigators, but Canadians should ask familiar questions: What threshold is required? Who approves access? How often are powers used? What reporting is public? Can affected people challenge orders? How long is data retained? What happens when lawful access intersects with platform identity systems and age-verification infrastructure?
The Supreme Court of Canada’s 2024 Bykovets decision recognized a reasonable expectation of privacy in IP addresses, meaning police generally require prior judicial authorization before asking a third party to identify a person behind an IP address. Statistics Canada noted that this change may affect investigations and reporting of online child sexual exploitation.
That context matters. But constitutional friction is not a defect in democracy. It is the machinery doing its job. Rights are not paperwork. They are guardrails.
S-209: pornography, minors and the same age-assurance dilemma
Bill S-209 targets commercial access to pornography by young persons. The positive case is easy to understand. Children should not be exposed to violent, degrading or exploitative sexual material. Parents should not be left alone against commercial platforms with every incentive to maximize traffic.
But the enforcement mechanism again points to age verification or age estimation.
That creates the same policy test: can Canada restrict minors’ access to commercial pornography without building identity infrastructure that later spreads into ordinary online life?
The answer depends on design.
Privacy-preserving age assurance is possible in principle. A system might prove “over 18” without revealing name, address, date of birth or government ID number. But bad implementation can turn a child-safety measure into a permanent identity checkpoint.
That is the line Canadians should watch.
Why this is happening now
Several forces are converging.
Governments are responding to real online harms involving children, sextortion, cyberbullying, AI companions, fraud and exploitation. Governments are also frustrated with large platforms and want stronger levers than voluntary trust-and-safety promises. Law enforcement wants faster access to digital evidence. Privacy laws written for an earlier web are being forced to deal with AI, data brokers and automated decisions.
International pressure is also growing. Australia’s under-16 social media restrictions came into effect in December 2025, requiring platforms to take reasonable steps to prevent underage users from creating or keeping accounts.
The United Kingdom is discussing an “Australia plus” model, with proposals that raise similar questions about age verification, online safety and privacy. The Office of the Privacy Commissioner of Canada has also warned that age assurance is not a silver bullet and should be treated as one tool among many.
There is also a growing compliance market: age-verification vendors, digital ID providers, AI safety auditors, trust-and-safety consultants, cybersecurity firms, data-governance platforms and monitoring tools.
That does not make reform bad. It means Canadians should understand that child safety and privacy reform are also becoming business models.
The false choice: protection or literacy
The worst version of this debate asks Canadians to choose between protecting children and teaching digital literacy.
That is a false choice.
Children need safer digital environments. They also need the skills to navigate digital life. A 15-year-old does not become safe online at midnight on their 16th birthday. A manipulative algorithm does not become ethical because the user is older. A chatbot does not become safe because it asks for a birthdate.
If Canada restricts access without investing in education, it will teach evasion instead of judgment.
Young people need to learn how scams work, how influencers monetize trust, how algorithms shape emotion, how AI simulates intimacy, how deepfakes distort evidence, how screenshots travel, how misinformation spreads, how data brokers operate and how to verify information under pressure.
That education cannot begin at 16. It has to be scaffolded earlier, with age-appropriate participation, guided practice and trusted adults.
The parental position should not be “no regulation.” It should be “good regulation, not checkpoint regulation.”
The test Canadians should apply
Canadians do not need to become constitutional lawyers to ask useful questions. They can ask:
Will this bill require children or adults to upload government ID?
Will facial age estimation be allowed?
Will platforms infer age from behaviour?
Who stores age-verification data?
How quickly must it be deleted?
Can it be reused for advertising, profiling, policing, immigration, national security or unrelated platform enforcement?
Will there be privacy-preserving alternatives?
Will vulnerable youth be consulted?
Will youth who rely on online spaces for support be harmed?
Will the law restrict dangerous design, or only restrict access?
Will automated decisions be explainable in plain language?
Will people be able to challenge account bans, content removals or automated decisions?
Will the new regulator be independent enough to challenge both government and large platforms?
What role will remain for the Office of the Privacy Commissioner?
Will privacy be treated as a right or a compliance checkbox?
Will Canada introduce a separate AI accountability law?
These are not anti-safety questions. They are safety questions.
What better regulation should demand
A better Canadian approach would require privacy-preserving age assurance, not identity collection.
It would prohibit mandatory government ID upload for ordinary platform access unless strictly necessary and justified.
It would avoid facial scans of children except in exceptional, independently reviewed cases.
It would require strict deletion of age-assurance data.
It would prohibit reuse for advertising, profiling, law enforcement, immigration, national security or unrelated platform enforcement without clear legal authority and oversight.
It would mandate independent audits of accuracy, bias, security and failure rates.
It would protect vulnerable youth, including youth seeking help related to sexuality, abuse, religion, mental health, identity, family violence or homelessness.
It would create meaningful appeal rights when accounts are blocked or content is removed.
It would fund digital literacy alongside platform regulation.
It would preserve a strong, independent privacy watchdog role.
It would require public consultation before regulations are finalized.
And it would include youth in policy design.
Children should not be treated as passive objects of protection. They are rights-bearing people learning how to live in a digital society.
The bottom line
Canada needs privacy reform.
Canada needs child protection.
Canada needs platform accountability.
Canada needs AI chatbot safeguards.
Canada needs better fraud prevention.
Canada needs lawful tools to investigate serious crime.
But Canada also needs civil liberties, anonymity, autonomy, due process, access to information, expression, association, equality and trust.
Those values are not obstacles to child safety. They are part of child safety.
The real question is not whether children should be protected. Of course they should.
The question is whether we protect them by strengthening their rights, judgment, privacy and resilience, or by building checkpoints around their lives and calling that safety.
Canadians should read the bills, follow committee study, contact MPs and senators, and ask for evidence that these measures will actually make children safer.
A law that teaches young people to evade, hide, surrender identity and distrust institutions has not solved the problem.
It has merely shifted the risk.
Sources and Further Reading
Parliament of Canada. Bill C-36, 45th Parliament, 1st Session — LEGISinfo: An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts. Current status and legislative progress page.
https://www.parl.ca/legisinfo/en/bill/45-1/c-36
Parliament of Canada. Bill C-36, First Reading: An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts. First reading, June 15, 2026.
https://www.parl.ca/DocumentViewer/en/45-1/bill/C-36/first-reading
Innovation, Science and Economic Development Canada. Backgrounder: Government of Canada introduces legislation to Protect Canadians’ Privacy in the Digital Age. June 15, 2026.
https://www.canada.ca/en/innovation-science-economic-development/news/2026/06/government-of-canada-introduces-legislation-to-protect-canadians-privacy-in-the-digital-age.html
Innovation, Science and Economic Development Canada. Government of Canada tables new legislation to protect children’s data, strengthen privacy and build trust in the digital economy. News release, June 15, 2026.
https://www.canada.ca/en/innovation-science-economic-development/news/2026/06/government-of-canada-tables-new-legislation-to-protect-childrens-data-strengthen-privacy-and-build-trust-in-the-digital-economy.html
Parliament of Canada. Bill C-34, 45th Parliament, 1st Session — LEGISinfo: Safe Social Media Act. Current status and legislative progress page.
https://www.parl.ca/legisinfo/en/bill/45-1/c-34
Parliament of Canada. Bill C-34, First Reading: An Act to enact the Digital Safety Act and the Digital Safety Commission of Canada Act and to make consequential amendments to other Acts. First reading, June 10, 2026.
https://www.parl.ca/documentviewer/en/45-1/bill/C-34/first-reading
Canadian Heritage. Bill C-34, the Safe Social Media Act. Government of Canada information page.
https://www.canada.ca/en/canadian-heritage/services/safe-social-media-act.html
Canadian Heritage. Government of Canada introduces legislation to make social media services and AI chatbots safer for children. News release, June 10, 2026.
https://www.canada.ca/en/canadian-heritage/news/2026/06/government-of-canada-introduces-legislation-to-make-social-media-services-and-ai-chatbots-safer-for-children.html
Canadian Heritage. Backgrounder: Government of Canada introduces legislation to combat online harms, particularly those impacting children. June 10, 2026.
https://www.canada.ca/en/canadian-heritage/news/2026/06/government-of-canada-introduces-legislation-to-combat-online-harms-particularly-those-impacting-children.html
Parliament of Canada. Bill C-22, 45th Parliament, 1st Session — LEGISinfo: Lawful Access Act, 2026. Current status and legislative progress page.
https://www.parl.ca/legisinfo/en/bill/45-1/c-22
Parliament of Canada. Bill C-22, First Reading: An Act respecting lawful access. First reading, March 12, 2026.
https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/first-reading
Parliament of Canada. Bill S-209, 45th Parliament, 1st Session — LEGISinfo: Protecting Young Persons from Exposure to Pornography Act. Current status and legislative progress page.
https://www.parl.ca/legisinfo/en/bill/45-1/s-209
Parliament of Canada. Bill S-209, First Reading: An Act to restrict young persons’ online access to pornographic material. Protecting Young Persons from Exposure to Pornography Act.
https://www.parl.ca/DocumentViewer/en/45-1/bill/S-209/first-reading
Parliament of Canada. Bill C-30, 41st Parliament, 1st Session — LEGISinfo: Protecting Children from Internet Predators Act. Historical legislative record.
https://www.parl.ca/LegisInfo/en/bill/41-1/C-30
Parliament of Canada. Bill C-30, First Reading: Protecting Children from Internet Predators Act. First reading, February 14, 2012.
https://www.parl.ca/DocumentViewer/en/41-1/bill/C-30/first-reading
Parliament of Canada. Bill C-27, 44th Parliament, 1st Session — LEGISinfo: Digital Charter Implementation Act, 2022. Historical legislative record for the Consumer Privacy Protection Act, Personal Information and Data Protection Tribunal Act, and Artificial Intelligence and Data Act.
https://www.parl.ca/legisinfo/en/bill/44-1/c-27
Parliament of Canada. Bill C-27, First Reading: Digital Charter Implementation Act, 2022. First reading, June 16, 2022.
https://www.parl.ca/DocumentViewer/en/44-1/bill/C-27/first-reading
Innovation, Science and Economic Development Canada. The Artificial Intelligence and Data Act (AIDA) — Companion document.
https://ised-isde.canada.ca/site/innovation-better-canada/en/artificial-intelligence-and-data-act-aida-companion-document
Parliament of Canada. Bill C-18, 44th Parliament, 1st Session — LEGISinfo: Online News Act. Historical legislative record.
https://www.parl.ca/legisinfo/en/bill/44-1/c-18
Parliament of Canada. Bill C-18, Royal Assent: Online News Act. Royal Assent version, June 22, 2023.
https://www.parl.ca/DocumentViewer/en/44-1/bill/C-18/royal-assent
Canadian Radio-television and Telecommunications Commission. Implementing the Online News Act.
https://crtc.gc.ca/eng/industr/info.htm
Office of the Privacy Commissioner of Canada. Consultation on the Development of a Children’s Privacy Code — What We Heard. May 2026.
https://www.priv.gc.ca/en/about-the-opc/what-we-do/consultations/completed-consultations/consultation-children-code/report_children-code_2026/
Office of the Privacy Commissioner of Canada. Age assurance. Privacy topic page.
https://www.priv.gc.ca/en/privacy-topics/age-assurance/
Office of the Privacy Commissioner of Canada. Age Assurance — Policy Note. May 2026.
https://www.priv.gc.ca/en/privacy-topics/age-assurance/aa-policy-note/
Office of the Privacy Commissioner of Canada. Designing age assurance to be privacy-protective — Guidance for age assurance developers. May 2026.
https://www.priv.gc.ca/en/privacy-topics/age-assurance/aa-gd-developers/
Statistics Canada. Study: Online harms faced by youth and young adults: The prevalence and nature of cybervictimization. The Daily, February 21, 2023.
https://www150.statcan.gc.ca/n1/daily-quotidien/230221/dq230221c-eng.htm
Hango, Darcy. Online harms faced by youth and young adults: The prevalence and nature of cybervictimization. Statistics Canada, Insights on Canadian Society, February 21, 2023.
https://www150.statcan.gc.ca/n1/pub/75-006-x/2023001/article/00003-eng.htm
Kingsbury, Mila, and Rubab Arim. Cybervictimization and mental health among Canadian youth. Statistics Canada, Health Reports, September 20, 2023; corrected November 24, 2023.
https://www150.statcan.gc.ca/n1/pub/82-003-x/2023009/article/00001-eng.htm
Statistics Canada. Police-reported incidents of online child sexual exploitation in Canada, 2024. The Daily, March 10, 2026.
https://www150.statcan.gc.ca/n1/daily-quotidien/260310/dq260310a-eng.htm
Savage, Laura. Online child sexual exploitation: A statistical profile of police-reported incidents in Canada, 2024. Statistics Canada, Juristat, March 10, 2026.
https://www150.statcan.gc.ca/n1/pub/85-002-x/2026001/article/00002-eng.htm
United Nations General Assembly. Universal Declaration of Human Rights. General Assembly Resolution 217A (III), December 10, 1948. See Article 12 on privacy and protection against arbitrary interference.
https://www.ohchr.org/en/universal-declaration-of-human-rights
European Commission. AI Act. Shaping Europe’s Digital Future. Overview of Regulation (EU) 2024/1689.
https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. EUR-Lex official text.
https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
Council of Europe. The Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law.
https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence
Australian eSafety Commissioner. Social media age restrictions. Government of Australia.
https://www.esafety.gov.au/about-us/industry-regulation/social-media-age-restrictions
Australian eSafety Commissioner. Social media age restrictions and your family. Government of Australia.
https://www.esafety.gov.au/parents/social-media-age-restrictions
