The proposed kids’ social media ban is capturing the headlines, but lost in the debate over Bill C-34 is that its most consequential element may be the creation and powers of the government agency the bill establishes to oversee the entire system. The Digital Safety Commission of Canada will be a super-regulator of the Internet, with greater influence over the daily lives of Canadians than perhaps any other regulator in the country. The breadth of its influence can’t be overstated: it will set the standards that millions of Canadians must satisfy to verify their age in order to use social media services. It will establish what platforms must do about harmful content, including the removal of certain material. It will determine whether the age-gating requirement may be lifted for any given service. It will both regulate the platforms and advocate for their users, dual roles that raise obvious fairness concerns. And it will exercise investigative and adjudicative powers, complete with penalties, hearings, and formal, law-enforcement-style investigations. Yet despite all those powers, it will not be bound by the rules of evidence, will be free to conduct its hearings in secret, and, at least in the beginning, will be capable of operating as a one-person body in which the Commission and its Chair are one and the same individual. The full scope of the new powers is illustrated in the infographic below.

The Commission’s authority begins with its regulation-making authority across 31 separate heads under section 126(1) of the bill. This covers everything from the design features platforms must adopt for children to the measures they must take against harmful content to the content and format of the digital safety plans every service is required to file. As I noted in identifying the roughly fifty decisions that Bill C-34 leaves to cabinet and the Commission, the large majority of those unresolved questions fall to the Commission, which means that the rules for social media, AI chatbots, and potentially other online services do not yet exist and will be set by the regulator only after the bill becomes law.

The effect on ordinary users is most apparent with age verification. An adult seeking to leave a comment on Reddit or a parent hoping to post a family photo on Facebook will first be required to verify their age by submitting government identification or undergoing a facial age scan. It is the Commission that sets the standard those measures must meet (ss. 22, 27), and the only statutory benchmark is its own satisfaction that the measures “are effective” (ss. 22(2)(a), 27(2)(a)), a term the legislation does not define. Will this require identification directly with the social media service, or with a third-party company, or perhaps even a government-run service? The Commission will decide. What level of accuracy and what privacy safeguards? The Commission will decide. Indeed, virtually all the terms on which millions of Canadians establish their age to use the most common services on the Internet will therefore be the Commission’s to decide, with early indications that some of the safeguards may be bypassed altogether when the system first takes effect. The Commission also decides on exemptions, since it may exempt a service from the kids’ social media ban where it is satisfied that the operator provides “adequate safeguards” for children (s. 29).

The Commission’s role in addressing harmful content is more systemic. Operators are required to implement measures that are “adequate” to mitigate the risk of users being exposed to harmful content (ss. 31, 32). It is the Commission that decides whether those measures are adequate, and it may order an operator to take or refrain from “any measure to ensure compliance” (s. 81). For two categories of content, a person who finds an intimate image shared without consent, or material that sexually victimizes a child, the Commission can directly order the platform to make the content inaccessible within hours and, after receiving representations, decide for itself whether there are “reasonable grounds” to keep it permanently inaccessible to everyone in Canada (ss. 68, 69). This is harmful content that should be removed, but the power is undeniable: an administrative body, applying a reasonable-grounds standard, decides when particular expression is removed from the Internet. To be clear, that direct removal power does not extend to content that foments hatred or incites violence, in which the Commission acts through a platform’s systems rather than on individual posts.

The enforcement powers resemble those of a law enforcement agency more than a content regulator. The Commission may compel testimony and the production of documents “in the same manner and to the same extent as a superior court of record,” and may accept evidence “whether or not it would be admissible in a court of law” (s. 73). It may designate inspectors who, under warrant, can enter a company’s premises or, as the bill specifies, “enter” simply by accessing its systems remotely “by a means of telecommunication,” with everyone present required to assist (s. 78). And it may impose penalties of up to the greater of $10 million or three per cent of a company’s global revenue (s. 88).

The Commission “is not bound by any legal or technical rules of evidence” (s. 74), it may hold its hearings in private, in whole or in part, whenever it concludes that doing so serves “the public interest” or “the national interest” (s. 75(2)), and its members cannot be compelled to testify about what they learn through their work (s. 113). The concentration of power is most apparent in a transitional provision: until a full complement of members is appointed, a single cabinet-appointed Chair “comprises the Commission” and may exercise all of its powers (Digital Safety Commission of Canada Act, s. 23), leaving open the prospect of one individual setting age-verification standards, ordering content removed, and imposing penalties.

There are safeguards, though they are largely procedural rather than meaningful limits on the powers that matter most. The Commission must take freedom of expression, equality, and privacy into account in making its rules (s. 18), and the age and content measures are not to “unreasonably or disproportionately limit users’ expression” (ss. 22(3), 27(3), 32(3)). Before issuing anything related to age verification, it must consult the Privacy Commissioner, consider any recommendations, and provide written reasons for any it declines to follow (s. 122), a meaningful but ultimately non-binding requirement. It must also consult the CRTC and the RCMP, publish proposed regulations for comment, and submit to periodic review (ss. 121, 123, 126, 128). These are genuine constraints, but early indications are that on issues like the kids’ social media ban, the government is willing to rush implementation of the law without the mandated consultations.

It is worth noting that the Commission is expected to advocate for the very users it regulates, as its mandate includes providing “support to users” and advocating “for the public interest” on systemic online safety issues (s. 15). This marks a departure from the previous Bill C-63, which assigned the advocacy function to a separate and independent Digital Safety Ombudsperson. Bill C-34 eliminates that office and folds the role into the regulator, resulting in the Commission being empowered to levy multi-million-dollar penalties against a platform and to advocate for that platform’s users.

The sheer breadth and limited constraints are incredible. In establishing the Commission, Bill C-34 creates the most powerful Internet regulator the country has known, and does so before anyone can fully know how that power will be used.