Canada is moving ahead with a powerful new digital regulator. The federal government wants this single body to oversee both online safety and privacy for tech companies. It would also take over duties currently handled by the privacy commissioner. Here is what we know about the plan so far.

In June, the Liberal government introduced two major pieces of tech policy legislation. Bill C-34 focuses on digital safety, and Bill C-36 focuses on privacy. Together, these bills would create the Digital Safety and Data Protection Commission of Canada, a new digital regulator with sweeping authority.

Government officials say the new regulator is expected to take about 18 months to set up. Meanwhile, critics and supporters are already debating what this change means for Canadians.

What the New Bills Propose

Bill C-34 would force social media platforms to at least temporarily block access for kids under 16. It would also regulate the companies behind AI chatbots by imposing a duty to act responsibly. As a result, tech firms would face new legal obligations around youth safety.

Bill C-36, on the other hand, deals with privacy protections. It sets higher standards for organizations managing children’s data. In addition, it gives Canadians the right to ask for their information to be deleted, and it requires companies to be transparent about automated decision-making for significant decisions about individuals.

Both bills would be administered by the same commission. This new body will have five members, and cabinet will appoint each one. Consequently, the government will hold considerable influence over who leads this regulator.

Powers, Praise, and Pushback

The commission would have real teeth. It could issue binding orders to organizations and levy fines of up to $10 million, or three per cent of a company’s gross global revenue. For the most serious offences, such as obstructing the commission’s work, fines could reach $25 million or five per cent of global revenue.

This body would also decide how to implement key parts of the digital safety rules. For instance, it would judge whether age-verification methods are effective and respect privacy. It would also decide whether platforms qualify for exemptions to the youth social media ban.

University of Ottawa law professor Michael Geist has dubbed the commission a “digital super-regulator.” He wrote that “a single commission of five Governor in Council appointees will now be responsible both for regulating online speech and content moderation across the country’s largest platforms (including standard setting, guidelines, audits, formal, law-enforcement-style investigations, hearings, and adjudicative powers) and for overseeing how every organization in Canada collects, uses, and discloses personal information.”

Geist added that this new regulator would have “astonishing powers that may be unmatched anywhere in the democratic world.” Similarly, Heidi Tworek, a professor at the University of British Columbia, says Canada’s approach is unusual compared to other democracies.

“In other places we see a separation of the privacy regulator and the online safety regulator,” Tworek said. She also pointed out that when Australia banned social media for kids under 16, it already had a safety commission in place. In Canada’s case, however, officials must stand up an entirely new commission while also implementing brand-new legislation.

Not everyone views this digital regulator negatively, though. Government officials say a single commission gives Canadians one clear entity to turn to for issues like children’s safety and data protection. Teresa Scassa, a law professor at the University of Ottawa, agrees the government likely “sees overlap and synergies between different digital regulation issues and wants to deal with it all in a single shop.”

Taylor Owen, founding director of the Centre for Media, Technology and Democracy at McGill University, offered a similar view. He said he is “not sure creating a super regulator is pejorative,” and added, “I think it’s a powerful regulator, and that might be what we need. The idea that we’re not going to have a powerful regulator and regulate the largest companies in the world, and most powerful companies in world, seems misguided to me.”

Concerns Over the Privacy Commissioner’s Role

Under the new privacy bill, responsibility for the private sector would shift to the Digital Safety and Data Protection Commission. Therefore, the privacy commissioner would only oversee the Privacy Act, which covers government activity rather than private companies.

Florian Martin-Bariteau, a research chair in technology and society at the University of Ottawa, supports strong regulators overall. However, he believes merging the privacy commissioner’s responsibilities into the new commission is a mistake, since the two bills operate under different logic and the privacy commissioner’s office already works well.

Scassa raised another concern. She suggested the government may want more control than it currently has, since the privacy commissioner is an independent agent of Parliament. By contrast, the government can direct the new commission’s approach and policy direction much more closely.

She also warned that shifting power away from the privacy commissioner carries real risks. That office has built “tremendous amount of experience” domestically and internationally, and, as she put it, “there’s just a lot of capital there that I think will be squandered.”

Finally, Scassa cautioned that the transition itself could hurt Canadians. Dismantling the current system and handing power to an unproven body means “there’s going to be a transition period and a period of chaos in which privacy and privacy rights are simply not well served.”

What Comes Next

For now, Bill C-34 and Bill C-36 remain before Parliament. Meanwhile, experts, industry groups, and privacy advocates will continue debating whether this digital regulator strikes the right balance. As the 18-month setup period unfolds, Canadians will get a clearer picture of how this new watchdog actually operates in practice.