The government’s plan to address online safety was introduced yesterday with Bill C-34, the Safe Social Media Act, featuring an under-16 social media ban, pornography age verification, AI chatbot rules, and platform regulation that I argued amount to an everything-all-at-once approach built on a “trust us” bet. My initial guide to the bill highlighted many key issues, but this follow-up examines just how much has been left for later. In many respects, Bill C-34 is best understood as version 1.0 of the Safe Social Media Act with a framework that establishes institutions, sets penalty ceilings, and fixes the age of 16 in the statute. But the bill leaves nearly everything that will determine how the law actually works, including which services are covered, when the ban applies and to whom, what counts as adequate age verification, and what design features platforms must build, to what amounts to a version 2.0 that will be developed later through multiple regulatory processes.

The actual count is remarkable: the Digital Safety Act contains 19 distinct decision points reserved for the Governor in Council and a further 31 separate heads of regulation-making power are handed to the new Digital Safety Commission under Section 126(1) alone. That is 50 key issues to be decided after the bill becomes law and that does not include the Commission’s guideline powers, procedural rules, case-by-case adequacy determinations and exemption rulings, or the seven additional cabinet decisions under the Digital Safety Commission of Canada Act, starting with the appointments needed to bring the Commission into existence. In other words, much of how the law will function is left to the DSC that does not yet exist, has no members, no chair, no staff, and even no funding model, since the cost-recovery charges that will finance it are also left to future cabinet regulation.

A closer look at what remains uncertain reveals that even the most basic questions are left unanswered by the bill. For example, in a bill titled the Safe Social Media Act, to what social media services does the law apply? The answer for the moment is none. A social media service only becomes a “regulated social media service” once it meets a user threshold that does not exist in the bill, since Section 6(2) leaves the types of services, the user numbers for each type, and even the methodology for counting users to Governor in Council regulations. The same structure applies to chatbot services under Section 7 and to the open-ended third category of “regulated online services” under Section 8, a category that itself only comes into being if cabinet creates it by regulation under Section 5, and only then following a Commission analysis conducted at the Minister’s direction. In other words, the full scope of the legislation runs through a chain of decisions in which Parliament plays no direct role.

The under-16 social media ban is contingent on multiple future decisions. Even after cabinet makes the threshold regulations that determine which services are regulated at all, Section 27(4) provides that the age verification obligation:

applies only in respect of regulated social media services — or regulated social media services that fall within classes of regulated social media services — specified in regulations made under subsection (5).

The bill contains no criteria to guide which services cabinet will specify. Once a service is specified, the question of what counts as “adequate” age verification or age estimation falls to the Commission, which must be satisfied that the measures are effective and privacy-protective, applying additional requirements the Commission itself will set by regulation under Section 126(1)(c). A service seeking to escape the ban can apply for an exemption, but the criteria the Commission must consider are left to yet another set of cabinet regulations under Section 29(2), supplemented by Commission guidelines under Section 30. Four layers of future rule-making before there is any certainty on how the social media ban will be applied and how services might qualify for an exemption.

The AI chatbot regulatory regime is similar, with the added twist that its scope can move in both directions. Cabinet can shrink the definition of a chatbot service by regulation, since Section 2(7) excludes any artificial intelligence system “that exclusively serves a purpose specified in the regulations,” while the Commission can expand the list of prohibited harmful behaviours by adding “any other type of behaviour specified in the regulations” under Section 53(e). Whether a given AI system is inside or outside the regime, and what duties it faces once inside, are both moving targets.

Even the provisions that appear fixed turn out to be flexible. The 24-hour takedown requirement for content that sexually victimizes a child or intimate content communicated without consent is a default that the cabinet can replace with “a period of a different length” by regulation under Sections 127(1)(c) and (d). One of the bill’s most important speech safeguards, the Section 12(1) assurance that nothing in the Act requires operators to proactively search content, comes with an exception that the Commission itself controls: Section 12(2) provides that Commission regulations “may require the operator of a regulated service to use technological means to prevent content that sexually victimizes a child or revictimizes a survivor from being uploaded to the service.” And the definition of “significant psychological or physical harm,” which determines the scope of mandatory transparency disclosures, is contingent on a cabinet regulation under Section 127(1)(b). On top of all of this, both statutes come into force only on days fixed by order in council, which means the government controls not just the content of the rules but when the entire system takes effect after it is enacted.

This degree of delegation guarantees that implementation will take years. The sequence of required events is staggering: cabinet must designate a minister, appoint three to five Commission members, designate a chair, and establish a head office before the Commission can function, with a transitional provision in the Digital Safety Commission of Canada Act confirming that until at least two other members are in office, the chairperson alone constitutes the Commission and may exercise all of its powers under both Acts. The Commission must then hire staff, set procedural rules, and begin the regulatory work. But it doesn’t end there since every Commission regulation must be pre-published in the Canada Gazette with an opportunity for the public to comment. The most sensitive issues require mandatory consultation requirements with either the Privacy Commissioner of Canada or the RCMP: the Commission cannot issue its law enforcement notification guidelines or any age verification guidelines, nor make regulations on child-protection design features, age verification requirements, anti-pornography measures, or the under-16 account restrictions, without first consulting the Privacy Commissioner of Canada and considering the Commissioner’s recommendations, and it must also consult the RCMP before issuing the notification guidelines.

For a government that promised swift action to protect kids online, the uncomfortable reality of Bill C-34 is that it has enacted the promise and deferred the law, and the version that ultimately governs Canadians’ online lives will take years to be implemented with many of the rules written by a Commission that at the moment does not even exist.