Official Hansard
Mr. Speaker, no security system is judged by its strongest lock, but instead by how easily someone gets through its weakest point. The same idea applies to Bill C-34. We need to discuss whether its proposed measures for a safer Internet would actually work when children and platforms test them. I share the goal of the bill before us. The most important thing is to protect our children. Parents cannot take on some of the largest technology companies in the world by themselves. Parliament has a responsibility to ensure those companies are held accountable for the risks their products create for children and families. However, good intentions alone are not enough. The question before us is whether the mechanisms in the bill would deliver the protections families are expecting. I have heard from so many parents in Cambridge and North Dumfries who are being asked to protect their children against some of the most sophisticated companies on earth. They want peace of mind. They want to ensure privacy and security for their kids. Most of all, they want them to be safe, but we have to ask: Will the law promising these things actually work when it meets a 14-year-old with a phone or a trillion-dollar, multinational social media giant? Parliament is being asked to approve the framework today, while many of the important details that would actually protect our children are to be determined later. Under Bill C-34, regulated social media platforms would have to stop children under 16 from holding accounts, but a platform can apply to the new commission for an exemption by showing it has adequate safeguards. What constitutes adequate? Parliament does not know, because that standard has not yet been established. The bill does not name a single platform. Whether it covers TikTok, Snapchat, YouTube, Roblox or Discord will be decided by cabinet after Parliament has voted. Law professor Michael Geist counted 50 key decisions in the bill left to cabinet and a commission that does not yet exist. That makes careful scrutiny of the bill even more important. There are other lessons from around the world we could take to inform our conversation here today. For instance, Australia’s under-16 ban took effect on December 10, 2025, across 10 major platforms. Four months in, surveys found many Australian children who had accounts before the ban still retained access. Most of those who stayed reported that getting around the restrictions was easy. A larger study found that account use among children fell after the ban took effect, but significant numbers remained on the very platforms the law was written to keep them off. For most of those children, staying on took no effort at all. Many reported that existing accounts were never removed, while others got through age checks, created new accounts or relied on someone else to set one up for them. The regulator found platforms letting new users simply declare they were 16 or older, and allowing children to retry the same age check until they were eventually let through. One app was reported to allow 24 attempts a day. Some teens beat the face scans by drawing on facial hair. When accounts did close, children moved. Many reported spending more time on gaming platforms and messaging apps, and some said they felt less safe online than before. Apps left outside the ban, like WhatsApp, surged in popularity. One Australian research compared the regulator’s job to a game of whack-a-mole, chasing each new app after children had already found it. Gaming is one of the areas of greatest concern. Roblox and Discord were not among the services covered by Australia’s initial ban, yet they offer friend lists, private chats, voice channels, group servers and strangers who can reach a child directly. Roblox now uses age-based controls to limit who can communicate with whom, but neither platform was required to keep a 14-year-old off the service entirely. Indonesia and Malaysia saw the same risk and included Roblox inside their bans. If gaming and messaging services fall outside the bill’s scope, children will simply do their socializing there instead. Platforms usually decide which country’s law applies based on the Internet address the phone connects through and a VPN routes that connection through a server somewhere else. A teenager in Cambridge can appear to be in Kentucky, Kenya or Korea, all places where Canadian law does not reach. Many free VPNs make their money by collecting and selling what their users do online, and so a child using one may be handing their browsing history to a company nobody can identify. Australia’s regulator now expects platforms to try to stop under-sixteens from using VPNs, but new servers appear faster than old ones can be blocked, which is another game of whack-a-mole. Here is another weak point. Facial age estimation is quick and inexpensive, but even one of the industry’s leading providers reports an average error of approximately one year for teenagers, yet this bill draws a hard line at a single birthday. An error of a year in either direction lets some 15-year-olds through and locks out some 17-year-olds, and children have already shown they will keep trying until the camera says yes. Government ID is more accurate, but it means handing a child’s identity to a private company, and that information is valuable to criminals and hostile foreign actors alike. To its credit, this bill says that information can only be used for age checks and must be destroyed once the check is done, but a rule on paper is not the same as a secure system. Every database containing sensitive information will eventually become a target. Just last month, IDScan.net confirmed a breach involving more than 150 million drivers’ licences and identity records. The challenge is only growing as AI accelerates the discovery of software vulnerabilities and the speed at which attackers can exploit them. Before coming to this House, I worked in systems architecture and database management. One thing this experience taught me is that data scheduled for deletion is still data until the moment it is actually deleted. Every additional database creates another target, another vulnerability and another risk that must be managed. Canadians need to know who will hold that information, where it will be stored, who owns the companies holding it, how long it will be retained and whether Canadians will be notified if a breach occurs. There is also a gap that no age check closes because the bill restricts holding an account, not viewing content. The government’s own charter statement confirms that young people would still be able to browse without an account. A child without an account can often still watch videos and scroll public feeds while logged out, where none of the teen safety settings or parental controls apply. Parents are still the first line of defence for their children online. The question for Parliament is whether this bill gives parents meaningful tools to help protect their children or whether those tools and safeguards are more effective on paper than in real life. Many countries are still adjusting their own approaches. France’s constitutional council struck down the country’s proposed social media ban before it could take effect, citing concerns about privacy safeguards and freedom of expression. All around the world, governments are trying to answer many of the same questions that Parliament is grappling with today. Australia has also had to go back and strengthen its own law. It doubled the maximum penalty and gave its regulator the power to compel internal company documents. That should give us pause about enforcement here. Australia’s regulator is well established, with experienced staff and existing powers, and it still needed months to open investigations into five platforms and has yet to issue a fine. This bill would create a brand new commission of three to five members that would be starting from nothing while facing the same companies. Officials have said it could take 18 months to set up. However, the minister has said that platforms would have to act as soon as this law comes into effect. Much of what decides whether this law works has been left to regulations that Parliament has not seen. That does not mean the bill is wrong, but it does mean that Parliament is being asked to place considerable trust in decisions that have not yet been made. Those are not arguments against protecting children online. They are questions Parliament should answer before concluding that this framework will work as intended. How will enforcement work in practice, and will it be based on a user’s age or their apparent location? What age verification and safe design regulations will ultimately be adopted, and what opportunity will Parliament have to review them? How will children’s age verification data be collected, stored, protected and deleted, and what happens if that information is breached? Will the bill follow children to where they actually spend their time online, including gaming platforms, messaging services and content viewed while logged out? How will Parliament and Canadians know whether the law is achieving its goals and whether circumvention remains widespread? What standards will a platform have to meet in order to be exempt from the age restriction, and how transparent will those decisions be? I opened by saying that a security system is judged by its weakest point. Here, that weakest point could be a teenager with a VPN, a flawed age verification process, inconsistent and unenforceable rules, unanswered questions from a bureaucratic commission, rival platforms not covered by legislation, data security questions or other unintended consequences that we have not yet identified. A bill like this, with such important goals and significant consequences, deserves careful study. We need a law that holds up when it is tested. Let us send this bill to committee. Let us find and fix those weak points. Let us get it right to protect our children.
