🍁 civid v1

Status

• Bill C-216 was introduced at first reading on June 19, 2025. It proposes a new law on minors’ online safety and amendments to two existing Acts.

Part 1 — Protection of minors online

• Who is covered: Owners and operators of internet-connected platforms used, or reasonably expected to be used, by people under 18, including social media and online gaming services. Some additional safeguards apply to children under 16.
• Duty of care: Operators must take reasonable steps in platform design and operation to prevent or mitigate specified harms to users they know or should reasonably know are minors. These include sexual exploitation, promotion of self-harm, addiction-like use, deceptive marketing and promotion of products unlawful for minors. The duty also addresses reasonable efforts to verify parental contact information before a minor operates an account.
• Controls and reporting: Platforms must provide safety settings and account, data-deletion and time-limit options for children and their parents, with the highest-protection settings as defaults. They must also provide parental controls for minors, a channel for anyone to report risks to minors, and a process for responding.
• Restrictions: Operators must use privacy-preserving age-verification algorithms when restricting access to content inappropriate for children. They may not request or require a digital identifier as described in the bill, use platform features or personal data to facilitate marketing of products unlawful for minors, or manipulate interfaces to undermine required safety settings or controls.
• Transparency: Operators must disclose information about data use, recommendations and advertising; keep compliance records; publish annual reports; and commission independent reviews every two years. The Canadian Radio-television and Telecommunications Commission must establish research guidelines after consulting stakeholders.
• Enforcement and remedies: Proposed maximum fines are $25 million on indictment or $20 million on summary conviction for breaches of the duty of care, safeguards and related prohibitions; other specified breaches carry a maximum summary-conviction fine of $10 million. Due diligence is a defence. A minor or parent alleging serious harm from a breach of the duty of care could sue, generally within three years of becoming aware of the relevant act or omission. The Minister of Industry could recognize qualifying standards or codes and publish notice of the extent to which the Act applies to a platform.
• Timing: Most provisions would take effect 18 months after royal assent; the recordkeeping, review, annual-reporting and research-guideline provisions would take effect on its second anniversary.

Part 2 — Reporting child sexual abuse and exploitation material

• Amends the existing mandatory-reporting law for providers of internet services to the public. It clarifies that covered services include internet access, content hosting and internet-based interpersonal communications.
• Requires notifications about suspected offences to go to a law-enforcement body designated by regulation. Where the content is manifestly child sexual abuse and exploitation material, the notification must include relevant transmission data that could assist an investigation.
• Requires related computer data to be preserved for one year, with data not ordinarily retained generally destroyed afterward unless a judicial order requires preservation. It sets a five-year limit for starting prosecutions under the Act.
• Adds regulation-making powers, including for annual reporting by the designated law-enforcement body, and states that the Act does not limit obligations under the Privacy Act or applicable provincial privacy legislation.

Part 3 — Criminal Code

• Creates an offence for knowingly distributing or otherwise making available a computer-created or edited false intimate image without consent, including an image made using artificial intelligence. The image must falsely depict a person nude, exposing specified body parts or engaged in explicit sexual activity, in a way intended to appear authentic.
• Sets maximum indictable sentences of five, 10 or 14 years, depending on the circumstances, for the new offence and changes the corresponding maximum sentences for existing intimate-image offences. It also extends related court powers, including deletion and forfeiture orders and restitution for reasonable removal expenses, to false intimate images.
• Expressly adds repeated online communication to the conduct covered by criminal harassment. Courts must consider anonymous communication or use of a false identity as an aggravating sentencing factor for that conduct.
• Permits a court, subject to specified conditions, to order production of information to identify an anonymous communicator and to require a recognizance where qualifying threatening or obscene online harassment is feared to continue. Such a recognizance must prohibit contact and may last for a definite or indefinite period.