This past week in digital policy was dominated by Bill C-34, the Safe Social Media Act, which includes platform regulation, an under-16 social media ban backed by mandated age verification, a new AI chatbot regulatory regime, and the creation of a powerful Digital Safety Commission. I have posted daily on the bill, including my initial review, an examination of the 50 key decisions the bill leaves for later, and a closer look at the government’s fast-track implementation plan, alongside a FAQ and posts on mandated ID and trade risks that I published just before the bill was tabled. For those coming to the issue fresh, this post draws on the week’s posts by taking stock of where things stand.

1. The Duty to Act Responsibly Provides a Good Foundation

Bill C-34 follows the failed 2021 consultation and Bill C-63, the Online Harms Act, which died on the order paper when Parliament was prorogued ahead of the 2025 election after contentious Criminal Code and Human Rights Act provisions dominated the debate for months. The new bill drops those provisions and retains the element that attracted the broadest support: platform regulation premised on a duty to act responsibly, covering seven categories of harmful content, a 24-hour takedown requirement for content that sexually victimizes children or contains non-consensual intimate images, transparency obligations through public digital safety plans and researcher access to data, and a new synthetic content labelling requirement for deepfakes. These measures target how platforms actually operate and could move through Parliament with the support of most experts and parties. But the government has bundled it with an age verification mandate, a chatbot regime, the pornography age verification requirements from Bill S-209, and a regulator comparable to the CRTC, a kitchen-sink approach that makes the bill far more contentious.

2. The “Kids Ban” is an Age Verification Mandate for Everyone

The headline measure bans those under 16 from holding social media accounts, but the language of a kids’ ban obscures how the policy actually works. Since there is no way to keep people under 16 off a platform without determining the age of everyone who uses it, tens of millions of Canadians who are not the target of the policy would be required to prove their age, typically to foreign third-party verification services, before doing the ordinary things they already do online. The privacy risks are well known: the October 2025 Discord breach exposed roughly 70,000 users’ government IDs, age-estimation technologies have documented accuracy and bias problems, and hundreds of scientists have signed an open letter calling for a moratorium on mandatory age assurance. Nor is there evidence that the policy works. Australia’s under-16 ban took effect in December 2025, and the eSafety Commissioner’s first compliance report found that roughly 70 percent of children with pre-ban accounts retained access to at least one platform three months later, with no discernible reduction in harm complaints. The government frames the measure as temporary, but the data collection and regulatory infrastructure are permanent. Once Canada has required every user to prove who they are to enforce a single age line, there is no putting the toothpaste back in the tube.

3. The Bill is a Law to Be Named Later

Bill C-34 leaves nearly everything that will determine how the law actually works to future regulation. As I pointed out, 19 decision points are reserved for cabinet and a further 31 heads of regulation-making power are handed to the new Digital Safety Commission, for a total of 50 key issues to be decided after the bill becomes law. The most basic questions remain unanswered. In a bill titled the Safe Social Media Act, no social media service is currently covered, since the user thresholds that trigger regulation do not exist in the bill, and the under-16 restriction applies only to services the cabinet later specifies, with no criteria to guide that choice. What counts as adequate age verification, which services qualify for an exemption, and which AI systems fall inside the chatbot regime are all left to a Commission that has no members, no chair, no staff, and no funding model. Implementation will realistically take years.

4. The Promised Exemption is an Illusion

The government’s answer to critics has been that the ban is conditional, with platforms able to stop age verification by satisfying the Commission that they provide adequate safeguards for children. But comments from government officials at this week’s technical briefing suggest the exemption is an illusion, at least for years to come. The plan is to bring the ban into force shortly after Royal Assent through regulations. But assuming this happens before the Commission is operational, there will be no age verification standards, no completed Privacy Commissioner consultation despite the mandatory requirement written into the government’s own bill, no body capable of receiving an exemption application, and no effective enforcement, since the compliance orders and penalties all run through the Commission. The approach reverses the sequencing of the Australian model the government repeatedly invokes, where a deliberate year-long runway produced a technology trial, regulatory guidance, and a functioning privacy regulator before liability attached. Tens of millions of Canadians would be required to verify their age to post a photo on Facebook or a comment on Reddit, but would do so with the bill’s privacy protections sidelined and compliance resting on platforms’ good faith.

5. The AI Chatbot Rules are the Closest Thing in the Bill to a Workable Compromise

The government wisely took the duty approach rather than adopting an age ban on AI chatbots, which I argued last month would have been even worse than the social media ban. There is no chatbot ban and no under-16 account restriction. Instead, the bill creates duties that track emerging international standards: an obligation to interrupt and refer users to crisis services when they express suicidal ideation, and duties to mitigate the risk of posing as a human or licensed professional, using manipulative engagement techniques to foster emotional attachment, or encouraging self-harm. The government also resisted pressure for mandatory police reporting of users’ private conversations, opting instead for the transparency-based approach I advocated in the Globe and Mail in March. The compromise is not without problems, since the bill defines an AI chatbot service by what it is “capable” of rather than its purpose, a test that every general-purpose AI assistant with memory would meet, and the exclusions are left to regulations that do not yet exist.