Bill C-34 Explained: What the Safe Social Media Act Actually Does

Headlines calling Bill C-34 a "social media ban for kids" miss most of what the bill actually does. Introduced on June 10, 2026, the Safe Social Media Act is a platform accountability regime — and understanding its real scope matters if your organization communicates with Canadians online.

What the bill actually regulates

According to the Government of Canada's fact sheet, the bill enacts two new acts — the Digital Safety Act and the Digital Safety Commission of Canada Act — and applies to three categories of regulated services:

• Social media services that exceed a user threshold set by future regulation or are designated as posing a risk of harm
• AI chatbot services — systems with natural language interfaces capable of simulating sustained human-like relationships, whether friendship, intimate, or therapeutic
• Other online services meeting the same threshold or risk criteria

The headline requirement is a minimum age of 16 for certain social media accounts (18 for pornographic content), enforced through platform redesign obligations rather than a simple access block. As University of Toronto researcher Brett Caraway told Reuters, Canada's approach "is a redesign of the social media ecosystem to make it safer for children, whereas Australia's law is about restricting access."

AI duties and enforcement teeth

The bill goes further than any predecessor on synthetic media. Social media services must take reasonable steps to label deepfakes and AI-generated images, audio, and video that appear real, and chatbots must not deceptively pose as human. Chatbot operators must also interrupt service and direct users to crisis intervention when detecting suicidal ideation or intent to cause serious harm.

Penalties reach the greater of CAD $10 million or 3% of gross global revenue from the previous financial year, with a due diligence defense available. A new Digital Safety Commission of 3 to 5 appointed Commissioners would oversee enforcement.

What it does not do

Two exclusions matter for businesses. The bill explicitly does not apply to private messaging, including direct messaging features on social platforms, and it regulates online services, not individual posters or the businesses that use these channels. It also creates no new police powers or data-retention regime.

Status and timeline

The bill awaits Second Reading in the House of Commons. Reuters estimates roughly one year for passage plus another 18 months to stand up the regulator — meaning full enforcement is likely years away. Canada joins a global wave: Australia deactivated nearly 5 million teenage accounts within a month of its under-16 ban, and France, Denmark, Poland, and Greece are moving in the same direction.

For outbound teams, the operative rules remain CASL and PIPEDA — consent records, sender identification, and working unsubscribe mechanisms. That is why disciplined operations like My AI Call Center review list source and consent documentation before any campaign launches: whatever shape the final law takes, permissioned outreach stays on solid ground.

The Critical Distinction: The SSMA Regulates Platforms, Not Your Outreach

If you run outreach campaigns in Canada, the headline "new social media law" probably triggered one urgent question: does this change how I contact people? The short answer is no — and understanding why matters more than you might expect.

The Safe Social Media Act (Bill C-34) is a platform law, not a poster law. The government's official fact sheet states it plainly: the Act regulates online services, not individual posters. It targets three categories of regulated services — social media platforms, AI chatbot services, and other online services — and only those that exceed a user threshold set by future regulation or are designated as posing a risk of harm to Canadians, according to legal analysis of the bill.

Private messaging is explicitly out of scope too. The fact sheet confirms that private messaging services and direct messaging features on social media platforms fall outside the regime entirely. So your outreach — whether it's appointment reminders, renewal calls, or win-back campaigns — is not what this bill touches.

Who actually faces obligations under the SSMA:

• Social media platforms above the user threshold, which must publish Digital Safety Plans and prevent under-16 account creation
• AI chatbot operators, which must avoid posing as human and interrupt service for users expressing suicidal ideation
• Platforms that fail to comply, facing penalties of up to the greater of CAD $10 million or 3% of gross global revenue — though a due diligence defense is available

Your outbound campaigns remain governed by the laws that already applied. The CRTC's CASL guidance treats social media messages (Facebook Messenger, LinkedIn messaging) as "electronic addresses" requiring consent, sender identification, and working unsubscribe mechanisms. Live voice calls and automated telemarketing sit outside CASL entirely, governed by separate rules.

That means consent discipline is still the operative framework. Implied consent expires after 2 years post-transaction or 6 months post-inquiry, and the sender bears the burden of proving consent was obtained — a standard the CRTC enforces actively, having received 167,939 complaints in a recent six-month reporting period (https://crtc.gc.ca/eng/internet/pub/20220331.htm).

This is why list quality matters more than platform news. At My AI Call Center, every campaign starts with a review of list source and consent records before anything launches — because regardless of what Ottawa does to social platforms, your outreach lives or dies on whether your contacts actually permitted you to reach them. The SSMA changes the platforms; it doesn't change your obligations to the people on your list.

Ready to run compliant, consent-verified calling campaigns? Get a campaign review with a full quote before launch — calling starts at 9¢ per connected minute.

The Rules That Already Govern Social Media Outreach: CASL and PIPEDA

While Bill C-34 targets platform architecture, the compliance framework that actually governs day-to-day outreach is already in force. CASL treats LinkedIn messages and Facebook Messenger as electronic addresses requiring consent, sender identification, and a working unsubscribe mechanism that remains functional for at least 60 days. The CRTC confirms this classification applies to social media messaging systems, while Facebook wall posts and typical website ads fall outside the definition. For teams running outbound campaigns, this means every direct message sent from a Canadian system — or to a Canadian recipient — triggers the same obligations as email.

The consent rules are specific and time-bound. Implied consent lasts two years after a transaction and six months after an inquiry; express consent does not expire. The sender bears the burden of proving consent was obtained, whether written or oral. CASL's extraterritorial reach means a Canada-based operation sending messages abroad is still subject to the law when using computer systems located in Canada. PIPEDA adds a meaningful-consent layer: individuals cannot be required to consent beyond what is necessary to deliver the product or service, and lengthy legalistic policies have been called "nothing more than illusory" by regulators. Risk of harm includes reasonably foreseeable unauthorized reuse of social media information intended for a limited audience.

• Implied consent windows: 2 years post-transaction, 6 months post-inquiry
• Unsubscribe mechanism must function for 60+ days
• Sender bears the burden of proving consent
• CASL applies extraterritorially from Canadian systems

Enforcement data underscores the stakes. In a single six-month period, the CRTC received 167,939 complaints — nearly half citing lack of consent — and issued 230 Notices to Produce and 21 Preservation Demands. Total CASL penalties since 2014 exceed $1.9 million, including a $200,000 undertaking from Gap Inc. for allegedly sending messages without necessary consent and lacking consistent unsubscribe mechanisms. My AI Call Center builds list discipline into every campaign: we review list source and consent records before launch, flag bought lists without clear permission records, and log opt-outs immediately. If the list will not support the campaign, we tell you plainly before you spend anything.

Five Practical Steps to Keep Your Campaigns Compliant

Compliance with Canada's new social media law starts with knowing which rules actually apply to your outreach. Bill C-34, the Safe Social Media Act, regulates platforms — not businesses running campaigns — and it explicitly excludes private and direct messaging, according to the government fact sheet. Your day-to-day obligations still come from CASL and PIPEDA. Here is a practical checklist to keep campaigns on the right side of both.

1. Monitor the bill's timeline without confusing it with outreach rules. The SSMA was introduced June 10, 2026 and is awaiting Second Reading, with an estimated one year for passage plus 18 months to establish the regulator. Track it for downstream effects on the platforms you use, but don't treat it as a new consent regime for your campaigns.

2. Treat social DMs as CASL-regulated channels. LinkedIn messages and Facebook Messenger count as "electronic addresses" under CASL, requiring consent, sender identification, and a working unsubscribe mechanism that functions for at least 60 days, per the CRTC's guidance. Document proof of consent — the CRTC states the onus is on the sender to prove consent was obtained.

3. Audit lists against implied-consent expiry windows. Implied consent expires two years after a transaction and six months after an inquiry. That matters for dormant segments: a 12–24 month win-back list may no longer carry valid implied consent for electronic messaging. Review expiry dates before every launch, not after a complaint arrives. Complaints about lack of consent made up 49.5% of the 3,815 consent-related submissions in the CRTC's most recent six-month enforcement report — the single largest complaint category.

4. Apply AI transparency practices now. The SSMA requires labeling of AI-generated content and prohibits chatbots from posing as human, per the government's summary. AI-assisted outreach should get ahead of this: disclose AI involvement, honor opt-outs immediately, and log every DNC request. That direction matches how we already run campaigns at My AI Call Center — AI disclosure on every call, with opt-outs logged and honored immediately across all campaigns.

5. Remember CASL follows Canada-based senders across borders. If you send commercial electronic messages using computer systems located in Canada, CASL applies regardless of where recipients live, per CRTC guidance. The CRTC's stated best practice is to ensure all messages comply with Section 6 even when sent abroad.

List discipline is the common thread. At My AI Call Center, list source and consent records are checked before any campaign launches, and bought lists without clear permission records are flagged — and in most cases declined. Get the list right first, and the rest of the checklist becomes manageable.

How List Discipline Keeps You Ahead of Every Rule Change

Canada's new Safe Social Media Act targets platforms, not the businesses running outreach campaigns — but the compliance landscape underneath it hasn't shifted. The law explicitly excludes private and direct messaging, leaving outbound operations governed by the same CASL and PIPEDA rules that already require consent, identification, and a working unsubscribe mechanism for every commercial electronic message sent to a Canadian electronic address.

Government guidance confirms the bill regulates online services, not individual posters, and private messaging features fall outside the regime. Meanwhile, CRTC precedent treats LinkedIn messages and Facebook Messenger outreach as messages to "electronic addresses" under CASL, with the sender bearing the burden of proving consent. That burden doesn't change when a new platform law arrives.

• Implied consent expires 2 years after a transaction or 6 months after an inquiry
• Express consent never expires but must be provable on demand
• Unsubscribe mechanisms must function for at least 60 days

A CRTC enforcement report showed lack of consent drove nearly half of all CASL complaints in a six-month window, and total penalties since 2014 exceed $1.9 million. The risk isn't theoretical — it's documented.

This is why list discipline is the durable answer. Before any campaign launches, My AI Call Center reviews list source, consent records, and calling windows — flagging bought lists without clear permission and telling you plainly if the list won't support the campaign before you spend anything. The same review catches implied-consent expiries that would invalidate a win-back list, and it verifies AI disclosure and opt-out handling match the direction regulators are moving.

One clear goal per campaign. Approved, permissioned, or reviewed lists only. No invented numbers. Plan your campaign with a free review and know the full number before you approve launch.