Canada Age Verification: 2 Bills, Zero Privacy Answers

Picture a woman in Canada who uploads her driver's license to prove she's an adult. She does it once, for one app. Then a second site asks her to prove it again, a different way. Nobody planned for that to happen.

If you've ever clicked "I'm over eighteen" on a

If you've ever clicked "I'm over eighteen" on a website, this story is about you. Canada is moving toward real age checks, not just a box to tick. And those checks mean handing over something personal, like a photo of your face or your government I.D. Two bills in Parliament are pushing in that direction. According to legal scholar Michael Geist, they don't line up with each other. The first is Bill C-34, the government's Safe Social Media Act. It requires age checks for anyone opening a social media account. It also bars kids under sixteen from social media and requires proof of age for under-eighteens to reach pornography. A new Digital Safety Commission would oversee all of it. The second is Bill S-209, a Senate bill that also requires age checks for porn sites. So the question running through this episode is simple. If both bills pass, who actually protects your data?

Start with how each bill decides what counts as a proper age check. Under S-209, cabinet picks the methods. A site can only rely on a method that cabinet has approved in advance. Before approving one, cabinet has to be satisfied of three things. The method must be highly effective. It must be run by a third party at arm's length from the site. And it must follow best practices for privacy. That's a real checklist, with real privacy tests built in.

Now look at C-34. There, the new Digital Safety Commission sets the standards. According to Geist's analysis, the government's plan for C-34 doesn't yet spell out the privacy review, the approved standards, or how enforcement would work. So one bill has a checklist. The other has a promise that a checklist is coming. And if both become law, the same Commission could end up enforcing two different definitions of pornography for age-check purposes.

For a platform, that's a headache

For a platform, that's a headache. For you, it's a question mark. Adults signing up won't know what they're handing over. It might be a government I.D. It might be a face scan. Nobody can say who holds it, or what happens if the two systems clash.

S-209 adds another wrinkle. Earlier versions covered only age verification, meaning proving your age. This one also allows age estimation. That means A.I. that looks at your face and guesses how old you are. So one route points toward your I.D. card. The other points toward your face. Either way, it's sensitive information that you can't change if it leaks. You can replace a password, but not your face.

Committee reviewers also raised a location problem. Millions of Canadians could end up sending government I.D. outside the country to outside providers. Canadian privacy law may only partly apply to those companies. So for the rest of us, the real question is who's holding your driver's license, and where.

There is a counterargument, and it deserves a fair

There is a counterargument, and it deserves a fair hearing. Canada's Privacy Commissioner has voiced support for S-209 and welcomed its privacy protections. The bills say the methods must be effective and privacy-protective. Operators must also destroy verification data once the check is done. That's a meaningful promise.

But the safeguards live on paper. The open question is who enforces them when two regulators, with two sets of rules, both claim the job.

The danger isn't that one bill is stricter than the other. It's that they don't fit together, and the gap between them is where your data sits.