One of the most heavily promoted features of Bill C-34, the government’s Safe Social Media Act, is that its social media ban for those under 16 comes with a potential exemption for platforms that satisfy the new Digital Safety Commission that they provide adequate safeguards for children. But based on comments from government officials, it appears the exemption is an illusion, at least for years to come. The legislation carefully sets out how the ban is supposed to work, but officials at a technical briefing on the bill this week described a very different plan that involves moving quickly after Royal Assent with regulations to bring the ban into force without waiting for the Digital Safety Commission to be fully operational. No Commission means no age verification standards, no privacy review, no exemption, and no effective enforcement. It also creates huge risks since the initial start of the ban is when tens of millions of Canadians would be required to verify their age, yet the government is sidelining the privacy protections written into its own bill and essentially conceding that the ban is unlikely to carry any real consequences for those services that fail to comply when it first takes effect.

Section 27(1) of the Digital Safety Act requires operators of regulated social media services to “implement adequate age-verification or age-estimation measures designed to prevent a person under the age of 16 from being able to have an account.” The government’s role is to specify by regulation which services are covered. But the question of what constitutes adequate is left to the Commission. Section 27(2) provides:

In order to determine whether the measures implemented under subsection (1) are adequate, the Commission must be satisfied that the measures

(a) are effective;

(b) do not involve the collection or use of personal information other than for age-verification or age-estimation purposes;

(c) provide for the destruction of personal information that is collected for age-verification or age-estimation purposes once the verification or estimation is completed;

(d) provide for the protection of personal information that is collected for age-verification or age-estimation purposes until that information is destroyed; and

(e) comply with any other requirement specified in the regulations.

The bill builds in an additional privacy safeguard before any such standard-setting can occur. Under Section 122(2), the Commission cannot issue guidelines regarding age verification measures or make the relevant regulations “unless it has consulted with the Privacy Commissioner on the guidelines or regulations and has taken into account any recommendations made by the Privacy Commissioner.” The exemption sits on top of this structure. Section 29(1) permits the Commission, on application by an operator, to exempt the operator from the ban entirely “if the Commission is satisfied that the operator provides adequate safeguards in the regulated social media service for the protection of children,” guided by criteria set by cabinet and by Commission guidelines on what adequate safeguards look like. In other words, the process starts with the statutory requirement, moves to government regulations that identify who is covered, proceeds to Commission standards for age verification, is vetted through a mandatory privacy consultation, and ends with a functioning exemption process.

The plan described by officials discards that sequence. The government intends to issue its regulations specifying the covered platforms and to declare the ban in force shortly after Royal Assent, without a functioning Commission, which must be created, staffed, and resourced from scratch. As I noted in my post yesterday on the more than 50 decisions the bill defers, establishing the Commission and completing its regulatory work will realistically take years. During that entire period, there will be no standards for what constitutes adequate age verification, no completed Privacy Commissioner consultation, no body capable of receiving an exemption application, and no enforcement mechanism, since the bill’s compliance orders, penalties, and investigative powers all run through the Commission. The two versions, the system as Parliament is being asked to approve and the system as officials plan to run, are captured in the infographic posted below. They are not the same system.

The implications begin with privacy. The government itself recognized that mandated age verification creates serious privacy risks for the tens of millions of Canadians who will face verification requirements, which is presumably why it made the Privacy Commissioner consultation a mandatory precondition to every instrument in the bill that defines what age verification will actually look like. Yet the only instruments the government plans to issue before the ban takes effect, the cabinet regulations identifying covered platforms, are the ones that carry no consultation requirement at all. The result is that the first and most consequential wave of age verification in Canada affecting millions of Canadians, including the choice between document uploads and facial age estimation, the selection of vendors, and the design of systems that tens of millions will use, will occur with no privacy review and with the safeguards in Section 27(2) left to platform self-assessment. Hundreds of scientists have warned about the privacy, security and discrimination risks of these technologies, but the government’s implementation plan disregards it all.

The approach also reverses the Australian model that the government has repeatedly invoked. Australia’s social media minimum age law passed in late 2024 but did not take effect until December 10, 2025, a deliberate year-long runway during which the government conducted an independent age assurance technology trial, the Minister made rules settling which services were excluded, the eSafety Commissioner published detailed regulatory guidance on compliance nearly three months before the obligation took effect, and the Australian privacy regulator was in place to co-regulate the privacy provisions. Whatever the problems with the Australian ban, platforms there knew what was expected of them before liability attached and faced a regulator capable of answering questions.

The Canadian approach also raises serious doubts about the enforceability of the ban. There is no regulator to issue a compliance order or levy a penalty, and any attempt by a future Commission to retroactively punish conduct against a standard that did not exist at the time would face serious legal challenge. Even Bill S-209, the Senate age-verification bill I have repeatedly criticized, gets the sequencing right by tying liability to the implementation of government-prescribed verification methods that must be vetted against statutory privacy and effectiveness criteria before approval. Bill C-34’s implementation plan offers none of that.

The exemption was the government’s answer to critics of the ban with assurances that the restriction would be temporary, conditional, and designed to reward platforms that make their products genuinely safer for kids. But it turns out that is illusory, as the government’s concerns about privacy risks won’t be addressed, standard-setting won’t happen, and enforcement of the ban will rely on social media companies’ good faith rather than on the immediate threat of real penalties.