Technology lawyers weigh in on what’s missing from the Safe Social Media Act
For a government determined to protect children from unregulated harms that can be inflicted through social media and interactions with chatbots and other generative AI technologies, elected officials are leaving many details to future regulators.
In introducing Bill C-34, the Safe Social Media Act, Canadian Identity and Culture Minister Marc Miller told reporters that Canada’s “laws are behind the digital era. We have the tools to act when the harms are caused, but we need to do more to prevent [children] from being harmed… The safety of children can’t be an afterthought. We need basic protection in place, so every child in this country should be safe on platforms they use every day.”
The government quickly followed up on this bill by introducing another piece of potential legislation focused on online activity, Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, as part of a broader overhaul of how Canada regulates the online space.
The Safe Social Media Act would, among other things, ban children under 16 from using social media and ensure that chatbots’ behaviour mitigates risks for young users. And yet despite that drive and desire to create basic protections, the specifics of how exactly children will be protected aren’t part of the bill’s fine print.
Max Jarvie, a partner in the technology group at Davies Ward Phillips & Vineberg LLP, puts the proposed act in the context of an earlier failed bill, Bill C-27: An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act, and to make consequential and related amendments to other Acts. He describes that bill as a “skeleton” that left every major decision point and definition to be made by a commissioner to be named at some point in the future. Given the lack of specificity, he says parliamentarians couldn’t properly debate the bill as they didn’t fully comprehend its operational reach. And he speculates that this bill will receive a similar response.
“Almost every major decision point or threshold or specification of measures to be undertaken or nature of services or classes of service that would come under this and be regulated by this bill… are all left to the governor in council or the digital safety commission that will be spun up.”
Similarly, Maanit Zemel, a partner and internet law and social media lawyer at Zemel van Kampen LLP in Toronto, says the bill lacks detail.
“We have fragments of a plan to maybe do something in the future… [and] the number of things that have to happen in the future for there to be any form of regulation are just staggering.”
Zemel points to Michael Geist’s detailed description of what he describes as “50 key issues to be decided after the bill becomes law.” He breaks these down into 19 Cabinet decision points, 31 commission regulation-making powers, plus other decisions that he didn’t include in his count.
And beyond the yet-to-be-determined points, Zemel believes there’s also a legal mistake in the drafting. Specifically, she points to s. 88 that details the maximum administrative monetary penalty that can be imposed on individuals or corporations that violate the proposed regulations. It reads:
88 The maximum penalty for a violation is
- (a) the greater of $10 million and 3% of the gross global revenue, in the financial year before the one in which the penalty is imposed, of the person that is believed to have committed the violation, in the case of a person that is not an individual; and
- (b) the greater of $10 million and 3% of the gross global revenue, in the year before the one in which the penalty is imposed, of the person that is believed to have committed the violation, in the case of an individual.
“I deal with regulatory law a lot,” says Zemel, “and when they establish AMPs, there are usually two sections. One is for organizations or non-individual corporations, and one is for individuals. They did the same here, but it’s the exact same amount. It doesn’t make any sense, and I think it’s a drafting mistake.”
No matter the amount, penalties may be imposed on regulated services (which include social media services and chatbots but exclude ISPs, search engines and navigation applications) for several reasons. One of these violations would involve social media companies exposing children to categories of content that the government calls harmful. Examples of this type of content include anything that:
- Sexually victimizes a child or re-victimizes a survivor
- Induces a child to harm themselves
- Is used to bully a child
- Foments hatred
- Incites violence
- Depicts terrorism or violent extremism
- Communicates intimate content without consent.
Ensuring that children are prevented from seeing that type of content is one of the three core duties in Bill C-34’s overarching framework, along with a duty to act responsibly and a duty to protect children. As a part of those protective measures, companies are expected to use age-appropriate design features, to make their applications targeted and adaptable, to keep children from accessing pornographic content, to label bot-driven content and all synthetic (deep-fake) content, to allow users to flag content and to permit users to block other people. Additionally, they will be required to comply with take-down requests within 24 hours for material that sexually victimizes a child or shares intimate content without consent.
And while the 16-and-under set is prevented from using social media services, they’ll still be permitted to engage with chatbots, with a few guardrails in place, according to Miller.
“When a user expresses an intention to harm themselves or others, they too will have to be safe by design. Platforms will have to be transparent and accountable to Canadians, and submit publicly disclosed digital safety plans to the Digital Safety Commission. The measures in this bill represent, in my view, the basic expectation that parents and Canadians have for keeping their kids safe online.”
In trying to figure out how the bill’s basic tenets will work, Jarvie says there’s still plenty open for interpretation. The bill, for example, allows for some social media services to qualify for exemptions to the age-restriction ban, but it doesn’t outline the process by which that can occur or which social media platforms might qualify. While he doesn’t expect to see exemptions for major platforms such as Facebook or X, smaller, federated services could fall into a “grey area” where exemptions are possible. And when it comes to the numerical user threshold by which smaller social media sites might qualify for exemptions, the bill doesn’t offer much in the way of guidelines.
“There’s the question of how do you count users,” he explains. “Is it users who can access the service, or users [who] registered an account? What’s the criterion for a number of users? How is this numerical count going to be articulated?”
Then there are the big technical issues surrounding age verification and user identification – both for those who sign up for social media accounts and for those who view content or lurk. Again, the bill lacks details as to how social media sites should determine who is old enough to participate.
“It might be that the framers of the bill, the drafters of the bill, are speculating that there are specific technologies that are nascent or that are maybe already somewhat reliable, or that will become more reliable down the road, that they could more narrowly specify in regulation… but for the time being, it’s difficult territory if you have users that are lurkers, to use the term of art,” says Javie. He notes that this type of situation was already examined by the Office of the Privacy Commissioner of Canada during an investigation into TikTok’s age-verification practices.
Although the bill tries to carve up the online world into distinct segments, separating social media from chatbots from search engines, those distinctions aren’t always clear. As Zemel points out, sites often combine all those elements, so figuring out which regulations might apply can get a bit murky. She expects e-commerce sites to fall outside the regulated category, along with search engines like Google, but many of these sites are incorporating chatbots into their platforms, as well as options for people to post reviews and engage with brands and companies. What happens, she wonders, if intimate images are posted to those portions of the website?
As a lawyer who often represents victims of online harm, Zemel says that some of the measures taken to supposedly protect victims don’t actually accomplish their goals, or in some cases, actually make the situation worse for them. For example, she points to the Hearings and Complaints portion of the bill at s. 75. In particular, ss. 2 states that “a hearing under subsection (1) must be held in public, but the Commission may decide that it is to be held in private, in whole or in part.” That, she says, is backwards.
“It says these hearings before the commission should be public complaints. That is a huge no-no for complainants. Complainants – especially children – will not engage if it's public,” she says. “That’s very different than what some of the provinces are doing, like Quebec and British Columbia, where they’re doing it right; where the presumption is not to identify the victim… That’s the way it should be, especially for children and for victims of non-consensual intimate images, or victims of [terrorist] attacks. Victims do not want to be identified; if they are, they will be re-victimized.”
She’s not even sure the bill will achieve its goal of keeping kids safe online. “I just don’t know because it’s so unclear. Will it be helpful to children? If it’s done right, probably. But so far, we don’t know what they're going to be doing.”
