Bill C-34 and What It Means for Privacy

Canada's newly introduced Bill C-34, the Safe Social Media Act, is generating plenty of attention as an online safety measure. But for those of us working in privacy, it's equally a data bill, and it raises some important concerns worth paying attention to, particularly when it comes to the new age-verification obligations.

The bill would impose significant new obligations on social media platforms, AI chatbots, and other online services, representing a meaningful step up in how online spaces are regulated in Canada. The bill equally represents a significant step in what personal information organizations are mandated to collect about individuals, and how they must protect that information.

What the Bill Requires

There are a number of new obligations outlined in this bill not only for social media operators, but for anyone operating an AI chatbot, or other services that allow individuals to interact with an app or website. From a privacy standpoint, three obligations stand out when looking at the obligations for social media platforms. First, a ban on social media accounts for users under 16. Second, age-verification or age-estimation measures on social media and other online services. Third, the protection and eventual destruction of personal information collected during the verification process.

Why Privacy Professionals are Concerned

The age-verification requirement is where things get complicated. To identify who is under 16, platforms would need to collect age-related information from every user, creating a significant new category of personal data processing that would affect most Canadians.

There's also a notable gap in the bill's language: while operators are told they must protect the personal information they collect, the bill doesn't specify what that protection needs to look like. Organizations will know that they have privacy obligations, but not yet how to meet them adequately. That uncertainty won't be resolved until regulations are issued or the yet-to-be-created Digital Safety Commission provides guidance.

What to Do Now

If the bill passes in its current form, operators will need to be ready. The good news is that preparation can start today. Begin by taking stock of the safety and age-assurance measures already in place on your platform. Then map the data flows, tracing where age-related information would go and how it would ultimately be destroyed. From there, design for minimization by favouring approaches that collect as little personal information as possible from the start, and plan ahead for how age-related data will be kept secure during the verification window.

Decisions made now about system architecture are far easier to get right the first time than to unwind later. The bill may still evolve, but the direction is unmistakable: greater regulation of online spaces is coming to Canadian law. Getting ahead of that shift starts with building privacy in from the beginning.