Safer Screens for Children: What Businesses Need to Know About Canada’s Proposed Safe Social Media Act

To listen to an audio recording of this article, click here.

Introduction

Concerns have grown regarding the level of transparency, accountability and guidance governing digital services, as evident in the Canadian government’s 2026 AI Strategy.^[1] As social media platforms and artificial intelligence (“AI”) chatbots become increasingly prevalent, they pose growing risks to the well-being of children and youth.

On June 10, 2026, the Government of Canada introduced Bill C-34, the proposed Safe Social Media Act (formally, An Act to enact the Digital Safety Act and the Digital Safety Commission of Canada Act and to make consequential amendments to other Acts), to address online harms facilitated by digital services. This proposed legislation aims to hold online services accountable through new safety requirements, duties and age restrictions, and follows Australia’s recent move in December 2025 to ban social media for users under 16 years old.^[2]

This article discusses the proposed Safe Social Media Act and highlights key developments that businesses should closely monitor.

Overview of Bill C-34

Bill C-34 seeks to ensure that social media platforms and AI chatbot services address and mitigate online harms before they occur, with the protection of children as its core.^[3] Experts have repeatedly raised concerns that social media platforms and AI chatbots are designed, by their very architecture, to capture users’ attention, contributing to online environments in which harms such as sexual exploitation, cyberbullying and mental health issues can proliferate.^[4] In 2019, Statistics Canada reported that 25% of youth aged 12 to 17 reported experiencing cyberbullying in the past year.^[5] Among young adults, women aged 18 to 29 were the most frequent targets of cybervictimization, experiencing it at nearly twice the rate of young men.^[6]

As part of Bill C-34, the Safe Social Media Act would enact two new acts. The Digital Safety Act would establish new safety regulations, and the Digital Safety Commission of Canada Act (later renamed Digital Safety and Data Protection Commission of Canada Act, as noted below) would create the Digital Safety and Data Protection Commission (the “Commission”) as the new regulator responsible for overseeing and enforcing the digital safety regime.^[7]

Key Highlights of Bill C-34

Who Does It Regulate?

Bill C-34 would apply to regulated services, such as regulated social media services, regulated chatbot services and regulated online services. The bill excludes services whose primary purpose is to facilitate the sale, listing or advertisement of goods or services, or to provide directories, search results, maps or navigation tools. It also would exclude private messaging features on social media services and telecommunications service providers where they provide basic connectivity to the internet.^[8]

The Three Core Duties of Bill C-34

1) Duty to Protect Children

Under Bill C-34, the Duty to Protect Children would mandate age-appropriate safeguards for younger users, including safeguards to prevent the access of pornographic material and the exposure of high-risk online interactions.^[9]

One of the most significant features of Bill C-34 is the proposed prohibition on social media accounts for users under 16 years of age, unless an exemption applies. Under this duty, regulated social media services would be required to implement a minimum 16-year-old age requirement to own an account.^[10] However, exemptions may be granted if the social media service can establish that they implemented sufficient safeguards for children. At this stage, details remain unclear, including when the ban will come into effect, what would qualify as “sufficient safeguards” for an exemption and how the exemption process would operate.^[11]

The proposed minimum age requirement also faces a trade-off with privacy rights. Enforcing the regulation may require all users to undergo age verification, often through third-party services that rely on government-issued identification or age-estimation processes. However, this carries the risk of data breaches.^[12] For instance, in October 2025, Discord, a popular social messaging platform, experienced a data breach linked to their age-verification practices. Approximately 70,000 users had their government-ID photos exposed in a breach by a third-party service provider who was reviewing age-related appeals.^[13] Despite this concern, the government suggests that privacy impacts associated with Bill C-34 are proportionate to its goal of protecting children.^[14] To further balance privacy concerns, Bill C-34 further carves out an exclusion for the “private messaging feature” of a service, defined as a feature that enables a user to communicate content to the user’s specified limited number of other users and does not enable such user to communicate content to a potentially unlimited number of other users.^[15]

2) Duty to Act Responsibly

The Digital Safety Act outlines new safety requirements as part of the Duty to Act Responsibly, including the identification of risks of harm, the implementation of age-appropriate design features, the attachment of labels to synthetically generated content, the submission of publicly disclosed digital safety plans and user safety tools like blocking and flagging.^[16] There are seven types of harmful conduct that the Digital Safety Act focuses on:^[17]

• intimate content communicated without consent;
• content that sexually victimizes a child or revictimizes a survivor;
• content that induces a child to harm themselves;
• content used to bully a child;
• content that foments hatred;
• content that incites violence; and
• terrorism or violent extremism content.

Unlike social media platforms, AI chatbot services are regulated through risk-mitigation obligations rather than age-based restrictions. AI chatbots do not fulfil the same social function as social media platforms like Instagram, Facebook, X and Snapchat. Rather, they are positioned differently due to their educational and informational uses, which may justify a distinct regulatory approach.^[18] The Duty to Act Responsibly would require obligations to be tailored to the nature of their services.^[19] Under the proposed framework, AI chatbot services would be expected to:^[20]

1. mitigate the risk of the chatbot communicating harmful content;
2. implement emergency measures in crisis situations, especially when a user intends to harm themselves or another person; and
3. mitigate the risk that the chatbot will engage in harmful behaviour.

While operators would not be required to proactively search content in order to identify harmful content, they may be required by regulation to use technological means to prevent content that sexually victimizes a child or revictimizes a survivor from being uploaded.^[21]

3) Duty to Make Content Inaccessible and Duty to be Transparent

Regulated social media services would have the Duty to Make Content Inaccessible where it involves content that sexually victimizes a child or revictimizes a survivor and involves intimate content communicated without consent, such as sexual deepfake images.^[22] Flagged content would be required to be made inaccessible and taken down within 24 hours.^[23]

In addition to the three core duties, the Duty to be Transparent would require regulated services to create Digital Safety Plans that describe how the service identifies, assesses and addresses risks.^[24]

Enforcement and Oversight

Bill C-34 contemplates substantial administrative monetary penalties and offence maximums depending on the circumstances. A violation of the Digital Safety Act could result in a maximum penalty of the greater of $10 million and 3% of gross global revenue.^[25] Offences can result in a penalty of the greater of $20 million or 5% of gross global revenue, although a due diligence defence is available for accused persons.

Key Questions Still to Be Resolved

Although Bill C-34 establishes a broad framework, many significant implementation details remain unresolved, including:

• how age verification will operate in practice;
• what safeguards will qualify a service for an exemption;
• what information regulated services will be required to provide;
• how the Commission will exercise its powers; and
• the extent to which key requirements will be prescribed by future regulations.

Organizations should therefore view Bill C-34 as the beginning of a new regulatory framework rather than a complete compliance regime in its current form, as the bill has yet to complete its additional readings in the House of Commons and Senate.

Conclusion

The Safe Social Media Act represents Canada’s latest step toward regulating social media and AI chatbot services to protect children. If enacted, Bill C-34 would introduce heightened compliance burdens, enforcement risk and increased regulatory oversight. As the law develops, technology companies, social media platforms, prospective investors and AI chatbot developers should consider assessing compliance with the proposed safety regulations and how it may affect their operations. Businesses can begin by reviewing their user safety and content moderation practices, evaluating their age-verification mechanisms and assessing their incident-response processes and governance structures to meet potential digital safety compliance obligations.

The Privacy & Data Security Group at Aird & Berlis LLP closely monitors developments in technology and platform regulation and assists organizations in navigating evolving compliance obligations and risk considerations. The group frequently advises on every aspect of complex privacy and data security matters, including transactions, commercial relationships, litigation, regulatory concerns and emerging technologies. Please contact the authors or a member of the group if you have any questions or require assistance.

[1] Canada’s 2026 AI Strategy: What Businesses Need to Know.