Canada’s age assurance debate heats up around Bill S-209

Age assurance for pornographic content online is likely coming to Canada – and the debate over it has already arrived. Bill S-209, “an Act to restrict young persons’ online access to pornographic material,” is the sequel to S-210, a similar bill that passed the Senate in 2023 but got mired in bureaucracy until the government reset, sending the process back to the drawing board. The reanimated bill is causing significant consternation among Canadian privacy advocates, but winning support from the country’s privacy watchdog.

In comments to the Standing Senate Committee on Legal and Constitutional Affairs (LCJC), Privacy Commissioner of Canada Philippe Dufresne has endorsed Bill S-209, and declared that “it is possible to implement age-assurance mechanisms in a privacy-protective manner.”

The declaration, which echoes the findings of the Age Assurance Technology Trial commissioned by the government of Australia, follows an exploratory public consultation on age assurance by the Office of the Privacy Commissioner (OPC), which solicited input from privacy and industry stakeholder groups, civil society, academia, technology policy think tanks, and more. Dufresne says the responses reflect the “significant public interest in, and importance of, a well-considered approach to age assurance.”

Now, his office is developing guidance on implementation, demonstrating confidence in the ultimate success of Bill S-209. Dufresne had previously expressed concerns about data retention and misuse, but says those have been addressed in the latest version, noting that “the added requirement to limit the collection of personal information to that which is strictly necessary for the age verification or age estimation” has “enhanced the Bill from a privacy perspective.”

The OPC’s general stance on age assurance amounts to cautious optimism. Dufresne concedes that “determining the precise scope of the bill in its actual operation is a delicate task,” but says his office is ready to help – and needs to be involved.

“Should the Bill be adopted, it will be important for my Office to be involved in the review of regulation drafted by the Government and we will be ready to assist in any way that we can to ensure that privacy and the best interest of young persons are protected in the implementation stage of this Bill.”

New standards will help. The UK-based Age Check Certification Scheme (ACCS) recently announced it can now certify age verification and estimation technologies against Canada’s national standard for age assurance, CAN/DGSI 127: 2025, Age Verification – Age Assurance Technologies.

Legal association wants more specificity in legal definitions

The OPC’s stance is typically Canadian: polite, concerned, more or less willing to follow the rest of the democratic world on major policy issues. The same spirit is present in a letter from the Canadian Bar Association, which effectively says that Bill S-209 has noble intentions but needs better privacy protections.

“The Bill’s preamble claims that ‘online age-verification and age-estimation technology is increasingly sophisticated and can now effectively ascertain the age of users without breaching their privacy rights’,” says the latter. “The Bill, however, contains no specifics on how the government will practically balance privacy and protection. Instead, it mentions the development of ‘regulations for carrying out the purposes and provisions’ of the Bill.”

The CBA is seeking clarification on language, noting the significant differences between age verification and age estimation methods – even though they are still regularly conflated.

Because it requires an identity document, age verification offers high accuracy “but at the cost of deeply compromising user anonymity and raising substantial privacy risks through the collection and storage of sensitive personal information.” Being an estimate, age estimation is less precise, but also a “less intrusive method that generally preserves user anonymity and reduces privacy concerns.”

“Where will the distinction lie in the trade-off between definitive age confirmation and the protection of individual privacy and digital freedoms?”

The language, the lawyers say, must be clear and precise. As is, it “lacks key specifics: no defined retention timeline, no clarity on the speed of destruction, no auditing or enforcement mechanisms, no requirements for storage location, and no remedies for users if data is mishandled.”

There is irony in the CBA’s argument, in that it builds an argument against age assurance providers, while making the same recommendations many in the industry have made: hard regulatory guardrails. It is becoming clear that over-retention of data is a real problem; the Discord breach demonstrated that. The CBA asserts that “an obvious by-product of such age verification or age estimation measures is the creation of a data set that links personal identifying data to data revealing that an individual accessed internet pornography as well as the specific sexual proclivities and interests of that individual.”

While it is perhaps the frankest legal expression to date about the real reasons people don’t like age assurance – the possibility that someone might find out what kind of filth you’re watching and cancel you, Scarlet Letter-style – it is also built on the assumption that providers retain data that can trace them to specific content.

The truth is that most providers work to retain as little data as possible, for as little time as possible. Many would welcome data minimization principles being coded into law. Few would disagree with the following statement by the CBA: “If this data must be collected, the Bill should explicitly say so and be amended to include legislative provisions that ensure the personal data of Canadians won’t be improperly retained, accessed, or otherwise misused.”

Geist fears risk of overreach after senator casts doubt on scope

But as long as there is leeway in the language of the law, the risks remain – not only in terms of data retention, but also overreach. On his blog, frequent commentator on copyright and privacy issues Michael Geist raises the alarm over statements from Bill S-209’s sponsor, Senator Julie Miville-Dechêne, which indicate a broader scope for the law than pornography.

Miville-Dechêne says “Bill S-209 does not just target porn platforms like Pornhub” and that the full scope of application is in the hands of the government – “so the government could decide to include social media like X in its choices.”

Geist calls this “an explicit declaration from the bill’s sponsor that there are few limits on government power to require Internet sites to institute age verification requirements or face the prospect of mandated website blocking in Canada.” He floats the possibility of age verification being applied for search, or “AI services that can be used to generate pornographic images,” which include large language models like ChatGPT.

“This must surely spark reconsideration of what is a dangerous bill that could require virtually all Canadians to submit to age verification requirements in order to access commonly used search, social media, and other sites.”

Article Topics

age verification  |  biometric age estimation  |  Canada  |  data privacy  |  digital identity  |  legislation  |  Office of the Privacy Commissioner (OPC)