After years of delay, the government tabled Bill C-63, the Online Harms Act, earlier today. The bill is really three-in-one: the Online Harms Act that creates new duties for Internet companies and a sprawling new enforcement system, changes to the Criminal Code and Canada Human Rights Act that meet longstanding requests from groups to increase penalties and enforcement against hate but which will raise expression concerns and a flood of complaints, and expansion of mandatory reporting of child pornography to ensure that it includes social media companies. This post will seek to unpack some of the key provisions, but with a 100+ page bill, this will require multiple posts and analysis. My immediate response to the government materials was that the bill is significantly different from the 2021 consultation and that many of the worst fears – borne from years of poorly thought out digital policy – have not been realized. Once I worked through the bill itself, concerns about the enormous power vested in the new Digital Safety Commission, which has the feel of a new CRTC funded by the tech companies, began to grow.

At a high level, I offer several takeaways. First, even with some of the concerns identified below, this is better than what the government had planned back in 2021. That online harms consultation envisioned measures such as takedowns without due process, automated reporting to law enforcement, and website blocking. Those measures are largely gone, replaced by an approach that emphasizes three duties: a duty to act responsibly, duty to make certain content inaccessible, and a duty to protect children. That is a much narrower approach and draws heavily from the expert panel formed after the failed 2021 consultation.

Second, there are at least three big red flags in the bill. The first involves the definitions for harms such as inciting violence, hatred, and bullying. As someone who comes from a community that has faced relentless antisemitism and real threats in recent months, I think we need some measures to combat online harms. However, the definitions are not without risks that they may be interpreted in an over broad manner and have implications for freedom of expression. Second – related to the first – is the incredible power vested in the Digital Safety Commission, which will have primary responsibility for enforcing the law. The breadth of powers is remarkable: rulings on making content inaccessible, investigation powers, hearings that under certain circumstances can be closed to the public, establishing regulations and codes of conduct, and the power to levy penalties up to 6% of global revenues of services caught by the law. There is an awful lot there and questions about Commission oversight and accountability will be essential. Third, the provisions involving the Criminal Code and Canadian Human Rights Act require careful study as they feature penalties that go as high as life in prison and open the door to a tidal wave of hate speech related complaints.

Third, this feels like the first Internet regulation bill from this government that is driven primarily by policy rather than implementing the demands of lobby groups or seeking to settle scores with big tech. After the battles over Bills C-11 and C-18, it is difficult to transition to a policy space where experts and stakeholders debate the best policy rather than participating the consultation theatre of the past few years. It notably does not include Bill S-210 style age verification or website blocking. There will need to be adjustments in Bill C-63, particularly efforts to tighten up definitions and ensure effective means to watch the watchers, but perhaps that will come through a genuine welcoming of constructive criticism rather than the discouraging, hostile processes of recent years.

Now to the bill with a mini FAQ.

Which services are caught by the bill?

The bill covers social media services, defined as “a website or application that is accessible in Canada, the primary purpose of which is to facilitate interprovincial or international online communication among users of the website or application by enabling them to access and share content.” The Act adds that this includes adult content services and live streaming services. The service must meet a certain threshold of users in Canada for the law to apply (the threshold to be determined).

What duties do the these services face?

As noted above, there are three duties: a duty to act responsibly, duty to make certain content inaccessible, and a duty to protect children. The duty to act responsibly is the most extensive and it focuses on “measures that are adequate to mitigate the risk that users of the service will be exposed to harmful content on the service.” The Digital Safety Commission will be empowered to rule on whether companies have met this duty. Requirements including offering the ability to block users and flag content. The services must maintain available contacts and submit a digital safety plan to the Commission for review. There are detailed rules on what must be included in the plan. The services must also make their data available to researchers, which can be valuable but also raises potential privacy and security risks. The Commission would be responsible for accrediting researchers.

A duty to make certain content inaccessible focuses on two kinds of content: content that sexually victimizes a child or revictimizes a survivor or intimate content communicated without consent. The service must respond to flagged content and render it inaccessible within 24 hours. There is a notification and review process that follows.

A duty to protect children requires services to “integrate into a regulated service that it operates any design features respecting the protection of children, such as age appropriate design, that are provided for by regulations.” There few details available at this stage in the legislation about what this means.

What harms are covered by the bill?

There are seven: sexually victimizing children, bullying, inducing child to harm themselves, extremism/terrorism, inciting violence, fomenting hatred, intimate content without consent including deep fakes.

How are these defined?

The definitions are where there may concerns in some instances. They are as follows:

Intimate content communicated without consent. This involves visual recordings involving nudity or sexually explicit actiivty where the person had a reasonable expectation of privacy and did not consent to the communication of the recording.

content that foments hatred means content that expresses detestation or vilification of an individual or group of individuals on the basis of a prohibited ground  of discrimination, within the meaning of the Canadian Human Rights Act, and that, given the context in which it is communicated, is likely to foment detestation or vilification of an individual or group of individuals on the basis of such a prohibited ground.

Note that content that foments hatred, content does not express detestation or vilification solely because it expresses disdain or dislike or it discredits, humiliates, hurts or offends.

content that incites violence means content that actively encourages a person to commit – or that actively threatens the commission of – an act of physical violence against a person or an act that causes property damage, and that, given the context in which it is communicated, could cause a person to commit an act that could cause

(a) serious bodily harm to a person;

(b) a person’s life to be endangered; or

(c) serious interference with or serious disruption of an essential service, facility or system.

content that incites violent extremism or terrorism means content that actively encourages a person to commit – or that actively threatens the commission of – for a political, religious or ideological purpose, an act of physical violence against a person or an act that causes property damage, with the intention of intimidating or denouncing the public or any section of the public or of compelling a person, government or domestic or international organization to do or to refrain from doing any act, and that, given the context in which it is communicated, could cause a person to commit an act that could cause

(a) serious bodily harm to a person;

(b) a person’s life to be endangered; or

(c) a serious risk to the health or safety of the public or any section of the public.

content that induces a child to harm themselves means content that advocates self-harm, disordered eating or dying by suicide or that counsels a person to commit or engage in any of those acts, and that, given the context in which it is communicated, could cause a child to inflict injury on themselves, to have an eating disorder or to die by suicide.

content used to bully a child means content, or an aggregate of content, that, given the context in which it is communicated, could cause serious harm to a child’s physical or mental health, if it is reasonable to suspect that the content or the aggregate of content is communicated for the purpose of threatening, intimidating or humiliating the child.

content that sexually victimizes a child or revictimizes a survivor is a very long definition that includes multiple visual representations.

These are all obvious harms. The challenge will be to ensure that there is an appropriate balance between freedom of expression and safeguarding agains such harms. There are clearly risks that these definitions could chill some speech and a close examination of each definition will be needed.

How will the law be enforced?

This is the biggest red flag in the bill in my view. Enforcement lies with the new Digital Safety Commission, a new entity appointed by government with between three and five commissioners, including a Chair and Vice-Chair. The Commission’s powers are incredibly broad ranging. It can issue rulings on making content inaccessible, conduct investigations, demand any information it wants from regulated services, hold hearings that under certain circumstances can be closed to the public (the default is open), establish regulations and codes of conduct, issue compliance order, and levy penalties up to 6% of global revenues of services caught by the law for compliance violations. Failure to abide by Commission orders can result in penalties of up to 8% of global revenues. The scope of the regulations cover a wide range of issues.

The law says the Commission must consider privacy, freedom of expression, and equality rights, among other issues. Despite those powers, the Commission is not subject to any legal or technical rules of evidence, as the law speaks to acting informally and expeditiously, an approach that seems inconsistent with its many powers.

In addition to the Commission, there are two other bodies: the Digital Safety Ombudsperson, who is responsible for supporting users, and the Digital Safety Office, which supports the Commission and Ombudsperson.

Who pays for all this?

Potentially the tech companies. The Act includes the power to establish regulations that would require the services caught by the Act to fund the costs of the Commission, Ombudsperson, and Office.

What about the Criminal Code and Human Rights Act provisions?

There are several new provisions designed to increase the penalties for online hate. This includes longer potential prison terms under the Criminal Code, including life in prison for advocating or promoting genocide. There are also expanded rules within the Canada Human Rights Act that opens the door to an influx of complaints on communicating hate speech (note that this does not include linking or private communications) with penalties as high as $20,000. These provisions will likely be a lightning rod over concerns about the chilling of speech and overloading the Human Rights Commission with online hate related complaints.

And the mandatory reporting of child pornography?

These provisions expand the definition of Internet services caught by the reporting requirements.