Privacy & Cybersecurity Law Blog

John Salloum and Maryna Polataiko from Osler, Hoskin & Harcourt LLP report that Canada is contemplating a social media ban for children under 16—among other measures—through a new online safety regime that takes aim at harmful material, platform accountability and synthetic content.

Bill C-34, the Safe Social Media Act, was introduced on June 10, 2026, and would create two new statutes: the Digital Safety Act (the “DSA” or the “Act”) and the Digital Safety Commission of Canada Act. If passed, Bill C-34 would establish a comprehensive legal framework intended to govern online safety, reduce harms from online content and establish transparency and accountability requirements for operators of regulated services such as social media sites, chatbots and other online services.

Regulated Social Media, Chatbot and Online Services

The Act's duties apply to three types of “regulated services.” A service is generally regulated when it falls within a defined service type and either meets a user number threshold set by regulation or is designated as regulated by the Governor in Council.

• Social Media Services. Social media services are websites or applications whose primary purpose is to facilitate communication among users by enabling them to access and share content. These include adult content and live streaming services. Duties under the Act do not apply to private messaging features on social media services.
• Chatbot Services. Chatbot services are AI systems that (i) communicate over the internet; (ii) are publicly accessible via websites or applications; (iii) use natural language interfaces to provide adaptive, human-like responses in a conversational format; (iv) can simulate sustained human-like relationships through multiple interactions or sessions; and (v) generate content or responses that are not fully predetermined by system developers or operators. These do not include AI systems that exclusively serve purposes specified in the regulations.
• Online Services. Online services are websites or applications other than social media or chatbot services that allow users to interact with them, excluding those whose primary purpose is the sale or advertisement of goods or services, or directories, search results, maps or navigation tools. Online services must first fall within a category established by the Governor in Council to be regulated. Duties under the Act do not apply to private messaging features on online services.

Telecommunications service providers offering basic internet connectivity would be exempt from duties under the Act.

The Act would not require operators to proactively search for harmful content, though regulations may require technological means to prevent child sexual abuse material (“CSAM”) from being uploaded.

Regulated Content

The Act would target seven categories of harmful content: Non‑consensual disclosure of intimate images (“NCDII”), CSAM, content that induces a child to harm themselves, content used to bully a child, content that foments hatred, content that incites violence, and terrorism or violent extremism content. It would also establish requirements specific to pornographic content and synthetic content.

Duties of Operators

The DSA would impose two baseline duties on all operators of regulated services: a duty to protect children, including safety-by-design features and — where an operator has “reasonable grounds” to suspect its service provides access to pornographic content —age verification or estimation measures to mitigate the risk of persons under 18 being exposed to such content, as well as a duty to be transparent through compliance record-keeping.

For social media operators, the child protection duty would also include age estimation or verification measures “designed to prevent" persons under 16 from holding accounts where specified by regulation, subject to a Commission exemption for “adequate safeguards.” The duty to be transparent would extend to include digital safety plans. Additionally, a duty to act responsibly would include measures against harmful content, user guidelines, blocking and reporting tools, bot-amplified and synthetic content labeling, an identifiable resource person, and preservation requirements following certain content take-downs. A duty to make content inaccessible would impose 24-hour take-downs of NCDII and CSAM, as well as notice and appeal processes.

For chatbot operators, the duty to be transparent would similarly contemplate digital safety plans. Further, the duty to act responsibly would include measures against harmful content, emergency intervention obligations, and measures against harmful behavior such as posing as a human or licensed professional, using manipulative engagement techniques, and encouraging self-harm.

For operators of online services, the baseline transparency duty would similarly be supplemented with digital safety plans.

Remedies and Enforcement

The Digital Safety Commission of Canada would administer and enforce the Act. Canadians could make submissions about harmful content, harmful behavior, or non-compliance with the Act, as well as complaints seeking take-down orders for NCDII or CSAM.

The Commission would have extensive enforcement powers, including investigating complaints, holding hearings, conducting inspections under warrant, and issuing compliance orders.

Subject to a due diligence defense, administrative monetary penalties would reach the greater of 10 million Canadian dollars or 3% of gross global revenue, and offenses could carry fines up to the greater of 20 million Canadian dollars or 5% on indictment and $15 million or 4% on summary conviction. For affiliated groups, “gross global revenue” would mean the group’s revenue.