In February 2026, an 18-year-old walked into a secondary school in Tumbler Ridge, British Columbia, and killed six people before taking her own life. Two more victims — her mother and 11-year-old half-brother — were found at the family home. It was the deadliest school shooting in Canada since the 1989 École Polytechnique massacre.
In the weeks that followed, investigators learned that the shooter had been using ChatGPT in ways that OpenAI’s own systems flagged for “gun violence activity and planning” — eight months before the attack. According to lawsuits filed by victims’ families, an internal safety team reviewed the content and urged management to notify authorities. Instead, OpenAI deactivated the account. The shooter created a new one and continued. OpenAI CEO Sam Altman later apologized publicly: “I am deeply sorry that we did not alert law enforcement to the account that was banned in June.”
That tragedy, and the public fury that followed, shaped what came next. On June 10, 2026, the federal government introduced Bill C-34, the Safe Social Media Act. It’s Canada’s most ambitious attempt yet to regulate how social media platforms and AI chatbots operate in this country, and it’s aimed squarely at the question Tumbler Ridge forced into the open: who’s responsible when these tools cause harm?
If you run a business, use AI tools, or simply log into social media in Canada, this bill has your name on it.
The Safe Social Media Act creates two new pieces of legislation: the Digital Safety Act and the Digital Safety Commission of Canada Act.
Together, they’d establish a regulatory framework built on four pillars: new safety duties for social media platforms, an under-16 social media ban backed by age verification, rules governing AI chatbot behaviour, and a brand-new federal regulator, the Digital Safety Commission of Canada, to enforce all of it.
This is the government’s third run at this. A 2021 public consultation on online harms went nowhere. Bill C-63, the Online Harms Act, was introduced in 2024 but died when Parliament was prorogued ahead of the 2025 election. That earlier bill got bogged down in contentious Criminal Code amendments that overshadowed its platform regulation provisions. Bill C-34 drops those criminal law changes but packs in everything else, plus AI chatbot rules and a social media age ban that weren’t part of the original proposal.
The bill is currently at first reading. Royal Assent isn’t expected before the end of 2026, and even after that, most of the specific rules will need to be written through regulation. Summer consultations are expected before Parliament returns in the fall.
The under-16 social media ban, and why it affects every Canadian
The headline provision: Canadians under 16 would be banned from holding social media accounts. There’s no parental consent workaround. If the bill passes, platforms covered by the restriction would have to implement age verification measures to keep minors out.
There’s a catch in that framing, though. You can’t identify who’s under 16 without checking everyone. That means every Canadian who logs into a covered platform (Instagram, TikTok, X, Snapchat, Facebook, YouTube, Reddit, Discord, or whatever else ends up on the list) would need to prove their age.
The bill doesn’t specify which verification method platforms must use. But comparable laws in Australia, the UK, and parts of the EU have produced a short list of options: government ID upload, credit card verification, biometric face-age estimation, or third-party services that hold your ID and pass a yes-or-no age signal to the platform.
And it could mean two rounds of verification on the same service. Section 27 sets the social media age floor at 16, while section 22 requires age verification for any regulated service that provides access to pornographic content — setting that threshold at 18. So a platform like X or Reddit could end up verifying a user’s age twice: once for general access and again for restricted content.
Which platforms actually face the ban? That’s one of the bill’s many blanks. Section 27 says the restriction “applies only in respect of regulated social media services specified in regulations.” In other words, the age of 16 is written into the statute, but which services are covered is a future cabinet decision. No criteria for that decision appear in the bill.
Platforms can seek an exemption if they demonstrate that they’ve established and maintained adequate safeguards for children. But the criteria for what counts as “adequate” will also be defined later, by the Digital Safety Commission. One thing the bill does clarify: penalties fall entirely on the companies, not on children or their families.
The AI chatbot rules
Bill C-34 doesn’t ban kids from using AI chatbots. Instead, it takes what experts call the “duty path” — imposing responsibilities on chatbot operators rather than restricting access by age.
The centrepiece is a crisis intervention mandate. If a user expresses suicidal ideation, an intention to self-harm, or an intention to cause death or serious bodily harm to another person, the chatbot must immediately interrupt the conversation and connect the user to crisis services. Those services have to be staffed by a human who’s available in the moment. Automated crisis responses alone won’t satisfy the requirement. This provision is the most direct legislative response to the Tumbler Ridge shooting.
Beyond crisis situations, the bill defines four categories of “harmful behaviour” that chatbot operators must guard against. Chatbots can’t pose as a human being in a deceptive manner. They can’t impersonate licensed professionals — doctors, lawyers, therapists — and give advice a user could reasonably rely on. They can’t use manipulative engagement techniques that encourage users to form emotional attachments in ways that lead to social withdrawal or disconnection from reality. And they can’t encourage self-harm, suicide, or violence.
The definition of which chatbots are covered is broader than you might expect. The bill uses a “capability” test, not a “purpose” test. Any AI system that’s publicly accessible, uses natural language, provides adaptive human-like responses, and “is capable of being used to simulate a sustained human-like relationship” qualifies. That description fits ChatGPT, Claude, Gemini, and virtually every general-purpose AI assistant with conversational memory. The exclusions are narrow: only systems that “exclusively serve a purpose specified in the regulations” are carved out, and those regulations don’t exist yet.
On the question of mandatory police reporting, the issue BC Premier David Eby pushed hardest after Tumbler Ridge, the government went with transparency instead. Chatbot operators won’t be required to report concerning interactions to law enforcement. But their digital safety plans must disclose the criteria they use to decide whether to notify police, along with how many notifications they’ve actually made and under what circumstances. A five-year statutory review will assess whether those voluntary measures are working or whether mandatory reporting should be imposed.
The Digital Safety Commission — Canada’s new internet regulator
To enforce all of this, Bill C-34 creates the Digital Safety Commission of Canada, a new federal body with three to five commissioners that would become one of the most powerful regulators in the country.
The Commission’s mandate is broad. It would develop the regulations and guidelines that flesh out the bill’s many undefined terms, assess compliance, conduct audits and inspections, manage complaints from the public, issue binding compliance orders, and levy penalties. University of Ottawa law professor Michael Geist has compared its potential scope to the CRTC, noting it would have “greater influence over the daily lives of Canadians than perhaps any other regulator in the country.”
Its investigative powers are substantial. The Commission could summon witnesses, compel testimony under oath, administer oaths, and receive evidence, including evidence that would be inadmissible in court. It would not be bound by technical rules of evidence and is directed to proceed “informally and expeditiously.”
Most of the bill’s critical blanks land squarely on the Commission’s desk: which platforms count as regulated services, what age verification methods are adequate, what design features satisfy the duty to protect children, and which chatbot systems fall within scope. It’s the body that will turn the bill’s framework into actual, enforceable rules.
The penalty structure has teeth. Administrative monetary penalties can reach the greater of 3% of gross global revenue or $10 million. For offences prosecuted by indictment, fines can go up to the greater of 5% of gross global revenue or $20 million. Individual liability is capped at $50,000. Imprisonment is off the table. Penalties are limited to fines, and a due diligence defence is available for the most serious contraventions.
That said, the penalties are actually lower than what Bill C-63 proposed. The maximum administrative penalty dropped from 6% of global revenue to 3%, and the top criminal fine fell from 8% to 5%. The reasons for the reduction aren’t stated, but the geopolitical context offers a clue (more on that below).
What critics are raising
The bill has drawn pushback from several directions.
The privacy argument is the most straightforward. As covered earlier, verifying who’s under 16 requires verifying everyone. The Canadian Civil Liberties Association has warned that the data collected creates “disproportionate privacy risk” and that broad regulator discretion “invites mission creep.” University of Ottawa professor Ian Goldberg has pointed to the inherent privacy risks of age-assurance technologies, and legal experts have questioned whether any verification method can satisfy the bill’s stated privacy safeguards while still being effective enough to enforce the ban.
On free speech, both the Canadian Constitution Foundation and the CCLA have raised alarms. The CCF has called the bill “the greatest threat to Canadians’ free speech in decades,” arguing that the obligations are “so alarmingly broad that providers of regulated services will be tempted to over-comply at the expense of users’ freedom of expression and privacy rights.” Whether that assessment holds up will depend heavily on how the Commission exercises its discretion, which brings critics back to the “trust us” problem.
That’s Geist’s core criticism. He counts roughly 50 key decisions that the bill defers to future regulation by either cabinet or the Commission, from which platforms are covered to what verification technology is acceptable to what qualifies a platform for an exemption. “The uncertainty of this bill has the hallmarks of a government wanting to do something quickly,” he wrote on the day the bill was tabled, “but the ‘trust us’ approach likely means years of implementation work and potential court challenges.”
From the other direction, BC Premier David Eby has argued the bill doesn’t go far enough on AI chatbots. As noted earlier, the government chose a transparency-based approach over the mandatory police reporting that Eby pushed for. He considers that choice insufficient, particularly given that OpenAI had flagged the Tumbler Ridge shooter’s account but never notified Canadian authorities.
There’s also a geopolitical angle. The US has signalled that age verification mandates and platform regulation targeting US tech companies could become trade irritants. That context helps explain the penalty reductions from Bill C-63. The softer fines and the discretionary, cabinet-triggered restriction regime look like a government trying to hedge against another cross-border dispute.
How Canada’s approach compares globally
Canada isn’t the first country to try this. But no other democracy has attempted to pack this much — platform duties, age bans, chatbot regulation, and a new regulator — into a single bill.
Australia went first with its Online Safety Amendment Act, setting a minimum age for social media and requiring platforms to take “reasonable steps” to enforce it. But Australia’s law is focused mainly on access restrictions. It doesn’t regulate AI chatbots, doesn’t create a new super-regulator, and doesn’t bundle platform duties into the same legislation. Maximum penalties reach AUD $49.5 million per violation.
The European Union has taken a different path through its Digital Services Act, prioritizing systemic platform risks and privacy-preserving age verification pilots. Rather than imposing a single minimum age, the EU has let member states set their own thresholds (France at 15, Austria at 14, Greece and Spain at 16) while building the technical infrastructure for age assurance first.
The United Kingdom moved into active enforcement of its Online Safety Act in July 2025, with regulator Ofcom pushing platforms to strengthen age-assurance measures. Penalties can reach 10% of global annual turnover.
Bill C-34 combines elements of all three approaches. It takes Australia’s age-ban concept, layers on the EU’s systemic platform duties, adds the UK’s strong-regulator model, and then bolts on AI chatbot regulation that none of those frameworks include at the same level of specificity. Whether that ambition accelerates progress or bogs the bill down is the question critics keep returning to.
Early returns from other countries aren’t encouraging on the age-ban front specifically. Evidence from Australia and France suggests that under-16 bans have driven teens to VPN-evading workarounds rather than meaningfully reducing their usage.
What you should do now
Bill C-34 isn’t law yet, and most of its specific requirements will be defined through regulation after it passes. But there are practical steps worth taking now.
If you operate any kind of online platform where users interact, whether it’s a community forum, an app with social features, or a service that hosts user-generated content, start thinking about whether it could meet the bill’s definition of a “regulated service.” The thresholds for how many users trigger coverage haven’t been set, but the definitions are broad enough that mid-sized platforms with active user bases could be pulled in.
If your business uses AI chatbot tools like customer service bots, AI assistants, and chatbot-based products, pay attention to how “chatbot service” gets defined in regulation. The bill’s capability test is sweeping. It covers any AI system capable of simulating sustained human-like relationships, which could include general-purpose business tools, not just companion chatbots. The exclusion for systems that “exclusively serve a purpose specified in the regulations” offers a potential off-ramp, but until those regulations exist, the boundary between a regulated chatbot and an exempt productivity tool is unclear.
For businesses that may be in scope, the digital safety plan requirement is worth understanding early. Regulated services would need to publish plans covering compliance measures, risk assessments, child-safety features, harmful content data, and law enforcement notification policies. Building the internal processes to track and report this information takes time.
On timeline: even if the bill passes, the Digital Safety Commission needs to be stood up, consultations need to happen, regulations need to be drafted and published. Enforcement is unlikely before late 2027 at the earliest, and some experts project 2028. That’s a window you can use, not an excuse to wait. The government is expected to hold summer consultations before Parliament returns in the fall. Participating in those consultations gives you a seat at the table while the rules are still being shaped.
The rules are coming: the question is when and how
Bill C-34 may pass in its current form, get narrowed during committee review, or stall in the legislative process the way its predecessors did. Any of those outcomes is possible. What’s not in question is the direction Canada is heading. Platform accountability obligations, AI chatbot safety requirements, and stronger protections for minors online are coming in some form. The political consensus behind them is too broad for that to change.
The details will matter enormously, and most of them haven’t been written yet. That’s both the bill’s biggest vulnerability and, if you’re a business operator in this space, your biggest opportunity. The companies that understand these requirements early and prepare for them now won’t be scrambling when the enforcement window opens. The ones that wait will be.
Affiliate disclosure: Some links in this post are affiliate links. See full disclosure in the page footer.
Not sure what to read next?
I can suggest related Tech Help Canada articles based on the topic you’re reading now.
We empower people to succeed through practical business information and essential services. If you’re looking for help with SEO, copywriting, or getting your online presence set up properly, you’re in the right place. If this piece helped, feel free to share it with someone who’d get value from it. Do you need help with something? Contact Us
Want a heads-up once a week whenever a new article drops?
