Promotion of Safety in the Digital Age Act

This bill, known as the Promotion of Safety in the Digital Age Act, has three parts that together aim to make online spaces safer, particularly for young people.

The first and largest part creates a brand-new law called the Protection of Minors in the Digital Age Act. It applies to any online platform that could reasonably be used by minors (under 18), such as social media and online games. These platforms would have to act in the best interests of young users by limiting harms like sexual exploitation, promotion of dangerous products, addictive design features, and mental health risks. They would need to provide strong default privacy and safety settings, parental controls, ways to report problems, clear information about data use and advertising, and regular independent reviews and public reports on risks to minors. Companies that break these rules could face large fines, and families could also sue for serious harm caused by non-compliance. Most of these obligations would take effect roughly a year and a half to two years after the bill becomes law.

The second part updates an existing law requiring internet service providers to report child sexual abuse material found online. It broadens the definition of "internet service," directs all such reports to a designated law enforcement body, requires more technical data to be included when material is clearly abusive, extends how long related data must be preserved, lengthens the time period during which offenders can be prosecuted, and gives the government more regulatory power to manage this reporting system.

The third part amends the Criminal Code. It creates a new offence for publishing fake, computer-generated nude or sexually explicit images of real people without their consent ("deepfakes"), with penalties similar to those for sharing real intimate images without consent. It also creates a distinct criminal harassment offence for harassment carried out online or through social media, treats anonymous or fake-identity harassment as an aggravating factor at sentencing, and allows courts to impose preventive conditions (recognizances) on people who pose a risk of online harassment—including, where the harasser used anonymity or a false identity, allowing police to seek orders to help identify them.

This bill creates a new statute (the Protection of Minors in the Digital Age Act) imposing duties on platform operators regarding minors' safety and data, amends the Internet child sexual abuse reporting Act's notification and enforcement rules, and amends the Criminal Code to add offences and court orders concerning fake intimate images and online harassment.

• New obligations on platform operators — operators serving minors must build in safety settings, parental controls, age verification, reporting channels, and disclosure of data/advertising practices (sections 4–14); no cap is stated on which platforms qualify beyond the broad definition of "operator" covering any Internet-connected service "used, or could reasonably be expected to be used, by a minor."
• Enforcement and penalties — contravening the duty-of-care and prohibition provisions (sections 4–9) carries fines up to $25 million on indictment or $20 million summarily; contravening disclosure/record-keeping provisions (sections 10–12) carries fines up to $10 million; a due-diligence defence is available.
• Private right of action — a minor or parent alleging "serious harm" from an operator's breach of the duty of care may sue in court for damages, injunctions, or other relief, within a three-year limitation period (extendable at court's discretion).
• Ministerial and CRTC roles — the Minister of Industry may publicly exempt an operator whose own code of practice is judged to give equal or greater protection; the Canadian Radio-television and Telecommunications Commission (CRTC) must issue guidelines on market research involving minors; the Governor in Council (Cabinet) may make regulations (on recommendation of the Minister, after consulting the CRTC) covering disclosure formats and record-keeping requirements, leaving these details to future rule-making rather than the bill itself.
• Changes to mandatory reporting law — Internet service providers must notify a government-designated law enforcement body of suspected child exploitation material, include transmission data in clear-cut cases, preserve related data for one year, and face a five-year limitation period for prosecutions; the designated enforcement body must file an annual report to the Minister of Justice and the Minister of Public Safety.
• Criminal Code changes — creates offences for publishing "false intimate images" (AI-altered or edited images falsely depicting nudity or sexual activity), with penalties up to 14 years imprisonment in aggravated cases; creates a distinct online criminal harassment offence and lets courts treat anonymous or false-identity communication as an aggravating factor; allows courts to impose recognizances (peace bonds) on people assessed as likely to commit online harassment, and to issue production orders compelling disclosure of data to identify anonymous harassers.