Four Legal Takeaways from the Proposed Canadian Social Media Legislation

On June 10, 2026, the federal government introduced Bill C-34, also known as the Safe Social Media Act. The proposed legislation represents a sweeping effort to regulate social media platforms, chatbot services and other online services in Canada, with a particular focus on the protection of children (including proposed minimum age requirements). It includes the creation of a new regulator that will be empowered to impose large penalties and make binding orders.

Below are four key legal takeaways that interested stakeholders – especially technology companies and online service operators – should be aware of as this bill progresses through Parliament.

1. The proposed legislation applies to a broad range of (still to be specified) online services, and focuses particularly on “harmful content” 

Bill C-34 includes obligations applicable to operators of a “regulated social media service”, “regulated chatbot service”, and “regulated online service”. Each of those services will be further defined in future regulations, with reference to their numbers of users, types of online services available, and any other feature that may be prescribed by regulation. However, certain online service functions are not captured by the legislation, such as those that do not allow users to communicate content to the public and those that involve merely private messaging.

Many (but not all) of the substantive obligations imposed by the bill relate to “harmful content,” which captures:

a. Intimate content communicated without consent (includes AI-generated explicit content showing identifiable persons);
b. Content that sexually victimizes a child or revictimizes a survivor;
c. Content that induces a child to harm themselves;
d. Content used to bully a child;
e. Content that foments hatred;
f. Content that incites violence; and
g. Terrorism or violent extremism content. 

For regulated chatbot services, Bill C-34 also targets “harmful behaviour”, including deceptively posing as a human, impersonating licensed professionals to give advice, using manipulative engagement techniques to encourage emotional attachment that may cause social withdrawal, and encouraging self-harm, suicide or violent acts.

2. The bill proposes a minimum age of 16 for social media services

Bill C-34 requires regulated social media service operators to implement adequate age-verification or age-estimation measures designed to prevent persons under 16 from having an account with, or be otherwise registered with, the service. Adequate measures must be effective and only collect and use personal information for age-verification or age-estimation purposes; provide for the protection of personal information while it is used for such purposes and its destruction thereafter; and comply with any other requirement specified in future regulations.

The minimum age provisions of the proposed legislation are not limited to “harmful content” or “harmful behaviour” – they apply to “every regulated social media service” to be specified in future regulations. Notably, they do not currently apply to chatbot service operators.

Social media service operators may apply to a new regulatory agency, the Digital Safety Commission (discussed below), for an exemption from minimum age regulations. To obtain such an exemption, operators will need to demonstrate the implementation of adequate safeguards for the protection of children according to criteria that may be established by regulation.

3. The proposed legislation establishes new legal duties for online service operators

Bill C-34 introduces four core new legal duties on operators of regulated services:

  • The “duty to protect children”: Every operator of a regulated service must protect children by integrating child-protective design features, implementing age-verification or age-estimation measures as required above, and complying with any additional measures prescribed by regulation. 
  • The “duty to act responsibly”: This duty will require social media operators to take measures such as mitigating the risk of exposure to harmful content, publishing user guidelines describing measures taken with respect to harmful content, providing tools for users to block others and flag harmful content, and making a resource person available to users. AI chatbot operators will have a parallel obligation that includes mitigating the risk that the chatbot will communicate harmful content, implementing crisis intervention measures and preventing harmful chatbot behaviours. 
  • The “duty to be transparent”: All operators must keep compliance records and submit a digital safety plan to the Digital Safety Commission. These plans must be made publicly available and must include information on the operator's compliance measures, risk assessments, content moderation efforts, and resources allocated to meeting their obligations.
  • The “duty to make certain content inaccessible”: Where content is reasonably suspected to be (a) content sexually victimizing a child or revictimizing a survivor; or (b) intimate content communicated without consent, social media operators must remove such content within 24 hours or a different period provided for by future regulation.

4. Formation of a Digital Safety Commission delegates significant authority for overseeing online safety issues

The proposed legislation would establish the Digital Safety Commission of Canada – a new regulatory body with broad powers. The Commission’s mandate is to promote online safety in Canada and reduce harm caused by harmful online content, including through administering and enforcing the to-be-enacted Digital Safety Act, investigating complaints, and gathering information with respect to online safety issues.

The Commission would have significant enforcement tools at its disposal, including the ability to:

  • hold hearings in connection with complaints or any matter relating to an operator’s compliance with the Act and regulations;
  • designate inspectors to conduct inspections for the purposes of verifying compliance or preventing non-compliance;
  • make orders requiring the operator to take, or refrain from taking, any measure to ensure compliance with the Act; and
  • impose administrative monetary penalties for violations of the Act, with a maximum penalty of the greater of $10 million and 3% of the violator’s gross global revenue.

For more serious violations – including ignoring a Commission order – operators could face criminal penalties of up to $20 million or 5% of their gross global revenue, whichever is greater.

Overall

A central tension in Bill C-34 is the need to balance two objectives: protecting children through age-verification or age-estimation measures while preserving users’ privacy rights. The bill directs the Commission, when making regulations and issuing guidelines, to consider privacy rights, freedom of expression and equality rights. However, many key details remain to be addressed through future regulations, leaving significant discretion over how this balance will be struck in practice.

More broadly, given that the contours of many obligations proposed by Bill C-34 – including those discussed above, design features, content moderation measures, and digital safety plan requirements – will ultimately be determined by regulation, the practical compliance burden on operators remains to be seen and will need to be closely monitored by affected stakeholders.

For further information, please contact the authors or any member of our Litigation and Dispute Resolution, Privacy and Data Protection or Technology teams.


This update is for information purposes only. It is not to be relied on as legal advice. Should you require legal advice, we would be pleased to discuss the matters raised in this update in the context of your particular circumstances.