Canada's Bill C-34 Would Require ID or Face Scan to Use Social Media

Canada’s long-anticipated and dreaded Bill C-34 arrived on June 10 with the usual fanfare about protecting children.

We obtained a copy of the bill for you here.

Marc Miller, the Minister of Canadian Identity and Culture, tabled it.

Strip off the press release and what is left is a law that lets an appointed federal body order Canadians’ posts deleted across the country, decide which platforms can give an account to a 15-year-old, and tell AI chatbots to watch what you type.

It also bans Canadians under 16 from social media by charging the whole country for it, in the currency of everyone’s privacy.

The government calls it the Safe Social Media Act. Safe for whom is the question it would rather you not dwell on.

The law creates a Digital Safety Commission of Canada. Cabinet appoints its three to five members. The same body writes the rules, runs the inspections, hears the complaints, and hands out the fines, which is a regulator and a courtroom folded into one office that answers to no voter.

Everything hangs on a phrase the bill declines to nail down, “harmful content.” There are seven categories, among them “content used to bully a child” and “content that foments hatred.”

The drafters did take the trouble to say content is not hateful merely because it “discredits, humiliates, hurts or offends,” which is more care than these laws usually take.

It also changes very little because the people drawing the line day to day are the platforms, working from rules the Commission can rewrite whenever it wants. The edge of what a Canadian is allowed to say can shift without anyone in Parliament casting a vote.

So here is how a deletion goes. A platform decides it has “reasonable grounds to suspect” your post is child sexual abuse material or an intimate image shared without consent.

From that moment it has 24 hours to make the post inaccessible to every person in Canada. Down first, explained afterward. You can file representations and request a reconsideration, and your words stay gone the entire time you are waiting. Or someone skips you altogether and reports the post to the Commission, which can order it made “permanently inaccessible.” No judge appears anywhere in that sequence.

The definitions get bigger the longer you look at them. “Intimate content communicated without consent” now reaches AI images “likely to be mistaken for” a real recording of a person.

As a ban on revenge porn; reasonable, depending on how it’s implemented. But as written, those same words also cover a tasteless deepfake of a sitting politician, and the person sorting one from the other works for the company that gets fined either way.

Companies do not agonize over that distinction. They delete and move on.

Now the part that will get sold as the bill’s crown jewel, the social media ban for anyone under 16. Sections 26, 27(1) and 27(2) order affected platforms to “implement adequate age-verification or age-estimation measures designed to prevent a person under the age of 16 from being able to have an account with, or be otherwise registered with, the service.”

The same sections insist those measures provide for the “protection” and eventual “destruction” of any “personal information that is collected for age-verification or age-estimation purposes.” How a company manages both at once the bill leaves blank. What it spells out, plainly, is that the measures have to be “effective.”

So picture what “effective” actually demands. Canadians mostly prove their age by handing over a government ID, a driver’s license or a passport.

The alternative is age estimation, where the platform studies your biometrics to guess your age from facial geometry, eye shape, skin elasticity, the retreat of your hairline.

One way you surrender a document, the other way you surrender your face. Neither is optional if you want in.

And the checking cannot stop at teenagers. To be confident a user is not under 16, a platform has to assess the age of every user it has, so the system built to catch one 15-year-old gets pointed at the entire adult population by design. The monitoring was never going to be limited to children. It cannot be.

It also will not stop after the first look. The goal is not only to remove Canadians under 16 but to keep them off and keeping someone off means checking, then checking again, which points toward continuous age verification rather than a one-time gate at the door.

Whatever method a platform settles on, the outcome is the same. Bill C-34 rewrites the terms on which all Canadians reach social media and it does so by deputizing private companies into making you give up more of yourself before you are allowed into the digital public square.

A government that announced Canadians must show identification to the state before speaking online would have a brawl on its hands by the weekend. Running the identical demand through TikTok and Instagram is quieter and looks like consumer protection. It is the same demand. It raises the obvious questions about privacy and it may collide with the Charter itself, whose section 8 guards against unreasonable search and seizure.

Compelling the population to submit ID or a face scan as the price of using a website is, at the very least, a hard thing to reconcile with that promise.

None of the bill’s reassuring language about destroying data afterward changes the underlying trade and none of it stops a breach, a leaked database, or an employee who decides to go digging. We have all seen how that story tends to end.

Chatbots get their own homework. A chat service has to build something that, the instant a user expresses “a suicidal ideation, an intention to self-harm or an intention to commit an act that could cause death or serious bodily harm to an individual,” cuts off the conversation and steers them toward “crises intervention services that are appropriate to the situation.”

Nobody wants a bot encouraging a person in crisis and that part is worth stating without irony. The trouble is the method. You get there by having the service read private messages for the wrong words, and once that is mandatory for the worst case, the scanning is built for every other case too.

What actually brings the platforms to heel is the money. Administrative penalties run up to the greater of $10 million or 3 percent of global revenue. Criminal fines on indictment go to the greater of $20 million or 5 percent.

Run a platform and do the arithmetic. The cheap, safe move on any borderline post is to delete it, because a wrong guess about “harmful content” is the costliest mistake available, and so the companies will over-censor on reflex without the government ever issuing an order.

For the record, the bill does claim to value speech. “Freedom of expression” is in the list of purposes and a few duties say platforms need not do anything that “unreasonably or disproportionately” limits users. Then ask who decides what counts as reasonable. The Commission does, the same one writing the rules and collecting the fines, with no definition of where the limit falls.

A protection the censor grants itself and can revise on a quiet afternoon, is not really a protection.

The most alarming clause waits near the back. Cabinet can declare a service regulated even below the user threshold, as long as it decides there is “a significant risk that harmful content is accessible on the service.”

Set that next to the government’s claim that platforms must be “responsible for addressing harm before it occurs,” and the design is plain enough. Act against the speech that has not happened, on the theory that it might. Most legal systems wait for the act. This one would prefer not to.

Now it goes to Parliament, where the under-16 ban will take the headlines, because banning teenagers from Instagram polls beautifully and threatens no one with power.

The parts that deserve the scrutiny are duller and far more lasting. One is a standing federal body that can make speech vanish on suspicion, with no court and no clock running against it, holding a definition of harmful it gets to write for itself.

The other is a verification regime that puts every adult’s ID or face on file as the toll for logging on. Protecting kids is the line on the label. The capabilities the bill actually builds will still be sitting there long after this government has gone looking for its next cause.