Canada Proposes Intersecting Laws To Address Privacy And Digital Safety

In June 2026, the Government of Canada introduced two bills – Bill C-34, the Digital Safety Act¹and Bill C-36, the Protecting Privacy and Consumer Data Act (PPCDA)² – with significant potential impacts for online service providers. The bills are two intersecting parts of a broader proposed framework of standards and rules, with a common thread of business accountability for service design and use.

Regulator

The Digital Safety and Data Protection Commission of Canada (the Commission) would administer both regimes with one member designated as Privacy and Consumer Data Commissioner. This would mean that a single regulator would have greater line of sight across both safety and privacy compliance measures for a business that is subject to both regimes. The Government of Canada Backgrounder on Bill C-36 puts forward the dual mandate as a means to support greater coherence across digital frameworks and to enable the Commission to draw on the diverse expertise of its members to address cross-cutting privacy and digital safety issues.³

Application

• The Digital Safety Act would apply to social media services, chatbot services, and certain online services. A service would be regulated where it meets a prescribed user number threshold, or is designated under regulations. 
• The PPCDA would replace the existing federal privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA). Businesses currently subject to PIPEDA would therefore have updated and amended privacy and consumer data requirements.

Operations

Operators of services that are regulated under both regimes would need to prepare to manage compliance as a combined exercise, from the initial safety by design and privacy by design phase, through to ongoing monitoring, response to complaints, record-keeping and audits. 

• The Digital Safety Act duties would require the operator of a regulated service to make compliance decisions on service and feature design, access to content, age-gating, moderation, complaints and reporting.
• All of the above often involve personal information. That is particularly true with respect to age verification, account controls, complaint handling, risk analysis for recommender systems, chatbot monitoring, and child protection features. The PPCDA rules on consent, use, disclosure and retention of personal information and overall privacy governance would therefore sit alongside many of the above Digital Safety Act compliance measures.

Children’s interests and operator accountability

The purpose of the Digital Safety Act is to prevent and reduce online harms, particularly harms to children. The PPCDA prioritizes children’s interests in relation to the protection of their personal information and to decision-making about privacy compliance. Both define a child as a person under 18. Accordingly, the bills set up an overall framework under which service operators must not only reduce online harms to minors but also justify the data practices they use to do that.

Enforcement and penalties

The Commission may impose administrative monetary penalties under both regimes, of up to the greater of CA$10 million and 3% of gross global revenue. The bills also create offences with higher maximum fines (up to the greater of CA$20 million and 5% of gross global revenue under the Digital Safety Act, and up to the greater of CA$25 million and 5% of gross global revenue under the PPCDA). The PPCDA also provides for a private right of action for damages by an individual who is affected by a contravention of the Act.

A. Digital Safety Act

Application

Three categories of regulated service: The Digital Safety Act would apply to operators of social media, artificial intelligence chatbot, and other online services in Canada.

A social media service is a website or application accessible in Canada, with a primary purpose of facilitating interprovincial or international online communication among users by enabling them to access and share content. A social media service includes an adult content service (pornographic content) and live streaming service.

A chatbot service is an AI system that (a) communicates over the Internet; (b) is made available via a publicly accessible website or application; (c) uses a natural language interface to provide adaptive, human-like responses to users in a conversational format; (d) can be used to simulate a sustained human-like relationship, e.g. friendship, intimate, therapeutic; and (e) generates content or responses not fully predetermined by the developer or operator.‍

An online service is a website or application, other than a social media service or a chatbot service, accessible in Canada over the Internet and that allows users of the website or application to interact with the website or application.

A service would be regulated if its user numbers meet or exceed the prescribed threshold, or if it is otherwise designated by regulation, where it is determined to pose a significant risk of harmful content (social media); harm to individuals (chatbots); or harm to children (online service).

Seven categories of harmful content: The Act targets seven categories of harmful content: (a) intimate content communicated without consent; (b) content that sexually victimizes a child or revictimizes a survivor; (c) content that induces a child to harm themselves; (d) content used to bully a child; (e) content that foments hatred; (f) content that incites violence; and (g) terrorism or violent extremism content.‍

Four duties: Regulated services’ obligations flow from four duties: to protect children; to be transparent, to make certain content inaccessible; and to act responsibly.

Duties at a glance

B. Protecting Privacy and Consumer Data Act

Application

Same as PIPEDA – clarified: The Protecting Privacy and Consumer Data Act (PPCDA) would apply to the same organizations currently under PIPEDA with some clarifications: the Bill confirms that, as is the case for PIPEDA now, personal information collected, used or disclosed interprovincially or internationally would be within its scope and anonymized information would not.

In alignment with Québec’s Act respecting the protection of personal information in the private sector, Bill C-36 introduces a distinction between “anonymized” and “de-identified” information. The former irreversibly modifies information so that there is no reasonably foreseeable risk of identification, directly or indirectly by any means, while in the case of the latter, a risk of identification remains. De-identified information would therefore be within the scope of the PPCDA.

The definition of “personal information” has been modernized to include information that is “inferred” about an individual. This is relevant in the implementation of the Digital Safety Act.

“Sensitive personal information” is now defined. While retaining its contextual nature, the definition aligns with the EU General Data Protection Regulation (GDPR) in specificity. As it includes a child’s personal information, personal information revealing political opinions or religious or philosophical beliefs, biometric information and sexual orientation, it is of direct relevance to the implementation of the Digital Safety Act.

Purpose: The assertion of privacy as a fundamental right calls for the appropriate weighing in the collection and monitoring of personal information to implement the Digital Safety Act.

New duties at a glance

C. The cross-over

Compliance with the Digital Safety Act and with the PPCDA will be a combined exercise. Some crossovers stand out:

• Child protection: The duty to introduce child-protection features into the service entails the processing of children’s personal information for age verification and monitoring. The methods adopted will have to reflect the enhanced obligations in relation to children’s personal information.
• Processing sensitive information: Implementing age verification or age estimation, rendering certain content inaccessible, and fulfilling the duty to notify law enforcement of certain activities entail the processing of sensitive personal information with commensurate obligations in relation to limitation, consent and safeguarding.
• Accountability: The digital safety plan required under the Digital Safety Act and the privacy program required under the PPCDA must align to mitigate the impact of processing personal information, including sensitive personal information, in ensuring digital safety. In particular, the criteria and processes for notifying law enforcement and the emergency measures for crisis intervention must comply with the PPCDA.
• Transparency: Obligations under both acts converge and will have to be addressed in the privacy notice to ensure clarity on the extent of processing of personal information in the use of the service.

The policy basis for the dual mandate of the Commission extends to organizational compliance: harmful content, such as personalized deep fakes, engages both the Digital Safety Act and the PPCDA, and the measures to implement the Digital Safety Act will rely upon the processing of personal information that must comply with the PPCDA.

For more information on this topic, please reach out to Chantal Bernier and Margot Patterson.

The authors would like to thank summer law student, Mev Saiyed, for her assistance in preparing this insight.

Footnotes

1. An Act to enact the Digital Safety Act and the Digital Safety Commission of Canada Act and to make consequential amendments to other Acts (Short title Safe Social Media Act), First Session, Forty-fifth Parliament, 3-4 Charles III, 2025-2026↩

2. An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, First Session, Forty-fifth Parliament, 3-4 Charles III, 2025-2026↩

3. https://www.canada.ca/en/innovation-science-economic-development/news/2026/06/government-of-canada-introduces-legislation-to-protect-canadians-privacy-in-the-digital-age.html ↩