OTTAWA — The federal government made social media companies accountable for safeguarding the sensitive personal information gathered to keep kids off their platforms because they’re the ones that profit from Canadian users, Culture Minister Marc Miller told The Logic.

Those firms will shoulder the responsibility for now, but Miller said the legislation won’t be the final word on whether platforms, app stores or governments are best placed to collect and handle sensitive data without creating new hazards.

“We have made platforms responsible because they are the ones doing business,” he said in an interview Thursday. 

Earlier this week, Miller tabled Bill C-34, titled the Safe Social Media Act, which would ban children under the age of 16 from social media and create a new regulator with the power to impose binding orders and heavy fines on platforms and AI chatbot companies. 

Once established, the Digital Safety Commission will be able to exempt social media platforms from the ban, as long as they meet certain safety standards, but creating the regulator will take at least 18 months. In the meantime, experts have raised concerns about the privacy implications of the age-verification methods needed to make the bans work, which could include collecting government identification or biometric data from users. 

The approach marks a shift from the outlook of the previous Liberal government, which banned TikTok from operating in Canada amid concerns that its parent company, ByteDance, might pass users’ sensitive data to the Chinese government. Earlier this year, Ottawa reversed the decision in exchange for a commitment from the company to enforce stronger data protections.

Meta, one of the companies targeted by the legislation, has argued for months it doesn’t want to collect users’ identification, and that app stores should be responsible for verifying ages. Companies like Google and Apple already receive information about users when they set up their devices and could relay to platforms how old the user is, Meta Canada’s director of public policy Rachel Curran told a parliamentary committee last year. 

Ottawa is also considering a government-run age-verification service, similar to the “mini wallet” tool developed by the European Union, according to a Heritage Department official who briefed reporters on the bill on the condition they not be named. The official stressed that a government-led option wouldn’t be mandatory. 

None of those options offer perfect solutions to secure Canadians’ personal information, Miller said. “All [are] fraught with challenges about who protects and who is seen to protect people’s privacy the best,” the minister said, adding: “This is an ongoing conversation. It’s not something that is solved by the legislation.”

The bill leaves it to platforms to decide how they will keep kids off their sites, but requires them to destroy the personal information they collect to do it, after performing any verifications. The government has also announced plans to soon introduce separate legislation to update Canada’s privacy laws.

Canada’s privacy commissioner has found several instances of social media platforms mining Canadians’ personal information without consent, including children’s.

“The sad reality in all this, and I think the more important issue in and around privacy, is these platforms already have a tremendous amount of information with respect to our kids,” Miller said.

Prime Minister Mark Carney arrived in France on Friday on his way to a G7 summit, where he plans to discuss a common approach to age verification technologies with other leaders. Miller said the goal isn’t to create identical international rules, but to try to solve a common problem. 

“To the extent that kids are getting harmed in much the same ways in countries, it stands to reason that you would have some laws and regulations and structures that are similar,” he said. 

Miller said the government took a close look at regulators in the EU, U.K. and Australia to design a Digital Safety Commission for Canada. “There have been deep policy analyses of the good, the bad and the ugly of some of these attempts at making sure that platforms actually behave in a responsible fashion,” he said. The government’s previous failed attempts to regulate social media and feedback from parents also informed the design.

Canada’s regulator won’t wield as large a stick as its international counterparts, however. The government proposes to let the commission impose a maximum fine of $10 million or three per cent of a company’s global revenue–whichever is more. By comparison, the EU can impose penalties of up to six per cent of global revenue under its Digital Services Act, and the U.K.’s Online Safety Act allows fines of up to 10 per cent. 

“There’s a bit of art, there’s a bit of science,” Miller said of setting the maximum fines. “We did look at what potential growth revenue turnover was for a number of companies.” 

The government also considered what would be reasonable in a market the size of Canada, and the fact that firms could face additional fines if provinces impose their own penalties for online safety or privacy violations. 

Ideally, he said, the new rules will get ahead of serious online safety issues and make platforms safe and secure, so the fine won’t be necessary. “This is really about keeping kids safe,” he said.