Bill C-34, the Safe Social Media Act: what it would mean for social and AI chatbot startups
Written by For Founders Law, a Toronto firm licensed by the Law Society of Ontario. About us
In short
Bill C-34, introduced on June 10, 2026, would create a Digital Safety Act and a Digital Safety Commission, with duties for regulated social media services, AI chatbot services and other online services. It is still at second reading in the House of Commons, and which services it covers depends on user thresholds that regulations haven't set. Founders building social, community or consumer chatbot products can start designing for safety, age assurance and transparency now, without treating any of it as a current obligation.
Where the bill stands
Bill C-34 had first reading on June 10, 2026. According to LEGISinfo, it’s at second reading in the House of Commons, with debate on October 21, 2026. It still needs to pass the House and the Senate, and the new Commission would need to be set up before any enforcement. Its content may change along the way. Nothing here is a current legal obligation.
It sits alongside Bill C-36, which would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA. That bill is also at second reading. Bill C-34 isn’t the earlier Online Harms Act (Bill C-63), which died when Parliament was prorogued in January 2025.
What the bill would do
According to its first reading text, it would enact a Digital Safety Act and create the Digital Safety Commission of Canada to administer and enforce the rules, investigate certain complaints and contribute to online safety standards. It covers three kinds of services: regulated social media services, regulated chatbot services, and other regulated online services. Whether a social media or chatbot service is regulated depends on a number of users that regulations will set, and services below that number can also be designated by regulation. Those numbers haven’t been published, so the law’s reach is still unclear.
Duties for social media services
Operators of regulated social media services would have a duty to protect children and a duty to act responsibly. The bill defines seven kinds of harmful content: intimate content shared without consent, content that sexually victimizes a child or revictimizes a survivor, content that induces a child to harm themselves, content used to bully a child, content that foments hatred, content that incites violence, and terrorism or violent extremism content.
Duties in the bill include measures to reduce exposure to that content, tools for users to block other users and flag harmful content, labelling of synthetic content, and record-keeping to show compliance.
For services specified by regulation, operators would have to use adequate age-verification or age-estimation measures to keep people under 16 from having accounts, with a possible exemption. Those measures must be effective and must not collect or use personal information for anything other than age assurance. That’s the tension for founders: confirming age without collecting more than you need, which is already a privacy obligation under PIPEDA.
Duties for AI chatbots
Operators of regulated chatbot services would have a duty to act responsibly, including measures to mitigate the risk the chatbot communicates harmful content and emergency measures for crisis situations. The conduct the bill targets includes a chatbot being deceptive about being AI, posing as a medical, legal or other licensed professional and giving advice a user could rely on, and using manipulative engagement techniques to build emotional attachment.
For an AI companion, a coaching bot or any consumer assistant, those are product decisions, not just policy wording. They overlap with what your AI product terms and acceptable use policy should already say about prohibited uses, human review and crisis escalation.
Penalties
The bill has two tiers, both calculated on worldwide revenue:
- Administrative penalties of up to the greater of $10 million and 3% of gross global revenue per violation (section 88 of the proposed Act).
- Fines for offences, such as breaching a Commission order or misleading the Commission, of up to the greater of $20 million and 5% of gross global revenue on indictment (section 107).
What to do now
If your product lets users post, message or talk to an AI, a few steps now can save a redesign later:
- Map where minors could use your product and what age signals you already collect.
- Review your reporting, blocking and moderation tools and how quickly you act on reports.
- Decide how you’ll label AI-generated content and tell users they’re talking to AI.
- Update your terms and privacy policy so they match how moderation, age checks and AI features actually work.
- Write down your safety decisions. A written risk assessment is a natural starting point for any future safety plan.