What matters
- Published today in CMAJ, “The Safe Social Media Act: lessons from international online safety policies for protecting child health in Canada” by Christo Hall, Reshma Patel and Charlotte Moore Hepburn of SickKids’ Child Health Policy Accelerator backs passing Bill C-34 and prescribes a product-safety frame: regulate recommender systems and default settings, not only individual posts.
- The authors want the proposed Digital Safety and Data Protection Commission to have real teeth: powers to demand data from platforms, run audits, and enforce compliance, pointing to Australia’s non-enforceable standards and design-flawed age gate as the alternative.
- They insist privacy protection must travel alongside safety, with funded outcome evaluation. The under-16 ban still needs age verification touching every adult user: the privacy team’s problem to solve.
What three SickKids researchers prescribed today
The CMAJ analysis (CMAJ 198(35) E1373-E1376) sets out what Canada should borrow from other countries’ online-safety regimes. Six recommendations, in the authors’ order:
- A whole-of-society approach. Give the proposed Commission a mandate for public education, digital literacy for parents and children, and clear risk communication.
- Regulate design, not just content: target recommender systems and default settings proactively, aligned with the UK Online Safety Act and the EU Digital Services Act. Post-by-post moderation after the fact is not enough.
- Protect privacy alongside safety: the Commission’s dual mandate is, in the authors’ assessment, an important step, giving children’s privacy its own track.
- Make the regulator enforceable, with powers to demand platform data, run audits, and compel compliance. The cautionary examples: Australia’s non-enforceable standards, and an age gate whose design flaws blocked even evaluation.
- Fund outcome evaluation: measure whether the rules actually make children safer, and require platforms to supply the data.
- Keep the law aligned with emerging technology: fund digital literacy, school programs, parent training and youth engagement, and keep the framework current with research, including on AI.
Why this endorsement changes the frame
Most of the public fight over Bill C-34 has been about speech: the under-16 ban, Charter arguments, what counts as harmful content. (I wrote yesterday about the missing Charter statement.) The doctors move the argument to product safety. Recommender systems and default settings are engineering choices, and they can be regulated like seatbelts and food labelling. That frame carried the UK’s and EU’s regimes into law, and platforms find it harder to dismiss.
It also answers practitioners’ most common objection: takedown-based regulation always lags the harm. The prescription agrees, and puts the duty before the post exists, where the feed decides what a child sees next.
Where the design duties would land
| Regime | Design duties | Enforcement teeth |
|---|---|---|
| UK Online Safety Act (2023) | Proactive duties on recommender systems and defaults; age-appropriate design code described as proactive, not prescriptive | Fines available, though the design code itself carries none |
| EU Digital Services Act (2022) | Recommender-system transparency and risk assessments for large platforms | Significant fines through the Commission and national coordinators |
| Australia | Online safety standards the authors call non-enforceable; under-16 ban with an age gate whose design flaws hampered evaluation | Weak by design, per the CMAJ analysis |
| Bill C-34 (proposed) | Proactive duties against child sexual exploitation content, cyberbullying and harassment; applies to platforms with over 1 million Canadian users; age verification for under-16 access; stronger OPC audit and binding-order powers; a Children’s Privacy Code | To be determined: the Commission does not exist yet |
The pattern holds: regimes that work pair design duties with a regulator that can demand data and punish non-compliance; the ones that fail lean on standards nobody enforces.
The privacy catch the doctors leave open
The authors say privacy protection must travel alongside safety. That is the hardest part of the bill.
Skeptical practitioners on Reddit raise objections worth answering seriously. The recurring ones: mandatory age verification links offline identity to online activity and would push most Canadian adults to hand identity documents to platforms or their vendors, creating new breach targets; the “trojan horse” worry that child-safety rules become the scaffolding for a general digital-ID system; Charter section 2(b) concerns and vague harmful-content definitions that would push companies to over-delete lawful speech; and that isolated LGBTQ and neurodivergent youth rely on online peer support a ban would cut off.
Australia’s under-16 ban is cited repeatedly as the live experiment, with the early verdict that teens route around age gates faster than regulators can patch them. The constructive thread points at privacy-preserving age assurance: a third party attests to an age attribute without linking it to identity. That should be the design standard for any verification regime under C-34, and it is where Canadian privacy teams have something concrete to contribute: the OPC published age-assurance guidance in May 2026, and teams that have mapped which products would need age checks are ahead of the curve.
Treat the design-duties half of Bill C-34 as the likely surviving core of the law. Inventory your recommender systems, default settings, and age-gating flows now, and write the one-page brief on how your age assurance would work without collecting identity documents. If the Senate keeps the Commission’s dual mandate and enforcement teeth, that brief becomes your compliance plan. If the teeth get pulled, you built the safer product anyway.