Bill C-34: Canada proposes legislation to regulate social media, AI chatbot, and online services

On June 10, 2026, the federal government introduced Bill C-34, An Act to enact the Digital Safety Act and the Digital Safety Commission of Canada Act and to make consequential amendments to other Acts, short-titled the Safe Social Media Act¹. If Bill C-34 becomes law, it will enact two new statutes: the Digital Safety Act and the Digital Safety Commission of Canada Act, introducing a framework that aims “to improve online safety, ensures that digital services are transparent and accountable for the risks their services create, and creates a new Digital Safety Commission of Canada to enforce the Digital Safety Act and support victims of online harms”².

In this bulletin, we discuss the features of the proposed legislative regime and what it could mean for operators of social media services, artificial intelligence (AI) chatbot services, and online website or application-based services.

What you need to know

• Bill C-34 would impose significant new regulatory obligations on operators of social media, AI chatbot, and online services in Canada. The bill is not yet law but operators who may be affected should begin assessing their exposure now. Services will need to have a certain number of users before they will be subject to the regime, but as that number is not yet defined, the full scope is unclear.
• Obligations to protect children. Novel statutory duties would apply to operators depending on the service type, but would include duties requiring design features to prevent children from accessing pornographic content and a minimum social media account age of 16.
• Obligations with respect to content and reporting. Additional novel statutory duties aimed at content regulation and transparency would require social media and AI chatbot service providers to mitigate harmful content on their services, assess user reports of harmful content within 24 hours, and disclose each report made. AI chatbot service operators would be subject to a duty to mitigate the risk that their services engage in harmful behaviour. Both types of service operators would be required to disclose each report of harmful content and/or harmful behaviour, its circumstances, and how it was addressed.
• New administrative body to oversee and enforce. The proposed legislation would create a new regulatory body, the Digital Safety Commission (the Commission), delegated with over 30 separate heads of regulation-making power and broad powers to enforce compliance, including the ability to hold administrative hearings and compel witness testimony and document production. Questions around whether measures taken by a service to comply with regulatory obligations are adequate would also fall to the Commission.
• Legislation with teeth. Maximum fines for non-compliance with the new legislation would be substantial and not limited to Canadian operations: 5% of the operator's gross global revenue from the prior year.
• The devil is in the details. The proposed legislation does not address the specifics of how each operator can achieve regulatory compliance, including what counts as adequate age verification, what features social media platform and AI chatbot operators would need to design to comply with their duties, and the frequency of reporting obligations. A number of provisions would depend on what subsequent (not yet drafted) regulations set out, with responsibility for these regulations falling to the Commission or the Governor-in-Council.
• Long runway to implementation. Before the Commission can come into existence, Cabinet must designate a minister, appoint members, designate a chair, and establish a head office. Every regulation set by the Commission must be pre-published in the Canada Gazette with an opportunity for the public to comment, and include mandatory consultation with the Privacy Commissioner or the RCMP for certain issues such as child-protection design features (age verification, age minimums, and anti-pornography measures).

Overview of the proposed regulatory regime

• Applies to social media, AI chatbot, and online services. The proposed Digital Safety Act would establish a new “duty to protect children”, applicable to operators of social media services, AI chatbots, and online services that allow users to interact with websites or applications, if the services have user numbers above a threshold (which has yet to be set by regulation). Different obligations are proposed for different services, but in general, the proposed legislation requires service operators to take steps to:
  • implement prescribed design features respecting the protection of children;
  • implement age-verification or -estimation measures to mitigate childrens’ exposure to pornographic content; and
  • maintain records necessary to demonstrate legislative compliance.
• Duty to be transparent. Each type of operator would be required to develop and publish a publicly accessible digital safety plan. The plan’s contents would vary depending on the type of service. For social media providers, this would include reporting obligations about certain measures taken regarding harmful content. AI chatbot operators would have to report harmful content, as well as harmful behaviour.
  • “Harmful content” would include content that: (1) is intimate and shared without consent; (2) sexually victimizes a child or a survivor of childhood sexual victimization; (3) induces child self-harm; (4) is used to bully a child; (5) foments hatred; (6) incites violence; and (7) includes terrorism or violent extremism.
  • “Harmful behaviour” would include an AI chatbot service: (1) posing as a human being; (2) posing as a medical, legal or other licensed professional and giving professional advice that could reasonably be excepted to be relied on by a user; (3) using “manipulative engagement techniques” to encourage an emotional attachment to the service that “encourages the user to withdraw socially or disconnect from reality”; and (4) encouraging self-harm, suicide, or acts that could cause death or serious bodily harm.
• Additional duties applicable to social media. Social media service operators would be subject to three additional duties and corresponding obligations:
  • Duty to act responsibly, which requires mitigating the risk that users will be exposed to harmful content; applying labels to synthetic content (audio or visual representations of persons, objects, places, entities, or events made by electronic or mechanical means, including by AI, if likely to be mistaken for an authentic recording); and providing ways for users to flag harmful content and block other users.
  • Duty to make certain content inaccessible, which applies to content that sexually victimizes children or survivors of childhood sexual victimization, and intimate content without consent either that is identified by the operator or flagged by a user, although the proposed legislation would explicitly carve out the need for an operator to conduct proactive searches in order to identify harmful content.
  • Minimum age requirements setting a 16-year-old minimum age for having an account on the platform, subject to potential exemptions that may be granted if the operator establishes and maintains sufficient safeguards for children. Contemplated measures to implement the minimum are “adequate age-verification or age-estimation measures” that are “effective”; the proposed legislation would allow for the collection or use of personal information for this specific purpose.
• Additional duties applicable to AI chatbots. AI chatbot service operators would be subject to an additional duty to act responsibly tailored to the service type, requiring operators to “mitigate the risk” that the chatbot will communicate harmful content or engage in harmful behaviour, and implement emergency measures in crisis situations.
• Creates a new Commission for online safety. Bill C-34 would establish a new regulatory body—the Digital Safety Commission of Canada (the Commission)—to administer the framework, set standards for online safety, enforce compliance, and handle user complaints.
• The Commission’s powers. The Commission would have broad powers, including access to electronic data disclosed in a digital safety plan; investigating and determining complaints (particularly regarding child sexual exploitation and non-consensual intimate content); summoning witnesses and requiring production of documents; holding public or private hearings; designating inspectors (with court-issued warrants); and issuing compliance orders enforceable as Federal Court orders.
• Offences and fines. Certain types of non-compliance with the proposed legislation would be offences. Penalties are limited to fines (no imprisonment) of up to 5% of the operator's gross global revenue from the prior year or $20 million, whichever is greater.

Implications

Bill C-34 represents the first proposed legislative action by this federal government to regulate online services on the heels of Bill C-63 (the Online Harms Act), which was proposed in 2024 but did not pass its First Reading. Bill C-34 is broader than Bill C-63, which focused on regulating social media service providers. If implemented, the newly proposed legislation contemplates sweeping changes regarding both the measures regulated online service operators would have to implement and ongoing disclosure obligations. Torys will continue to monitor and report on these developments.

In the meantime:

• Bill C-34 is not final; it reached its first reading in the House of Commons on June 10, 2026. The Bill requires a second and third reading in the House, as well as first, second, and third readings in the Senate. It is unclear what form any resultant legislation may take if Bill C-34 is enacted into law.
• There will be consultation opportunities when regulations are proposed under the legislation (if it comes into force).
• Operators of social media services, AI chatbot services, and online services should take the opportunity now to consider whether and how they may be impacted by the proposed legislation.
• Operators who anticipate being affected should seek advice on regulatory compliance measures and potential new or increased litigation risks associated with the operation and provision of services within the contemplated scope of the proposed legislation.