OTTAWA, Ontario Canada’s Privacy Commissioner, Philippe Dufresne, has expressed his backing for a new proposal that would introduce financial penalties up to $500,000 for adult websites that fail to verify the age of Canadian users.
Earlier efforts to implement mandatory age verification, such as Bill S-210, faced strong criticism over potential censorship concerns. However, appearing this month before the Standing Senate Committee on Legal and Constitutional Affairs, Dufresne argued that the current version, Bill S-209 known as The Protecting Young Persons from Exposure to Pornography Act includes stronger privacy protections than previous attempts.
“In my testimony before the Public Safety and National Security Committee in May 2024 regarding a prior version of this legislation, I made two key recommendations,” Dufresne explained. “First, to narrow the bill’s scope, and second, to strengthen the privacy criteria around approved age-verification and age-estimation systems. I am pleased to see that both suggestions have been integrated into Bill S-209. The addition of a requirement limiting data collection to only what is absolutely necessary for verifying or estimating age represents a significant privacy improvement.”
Dufresne emphasized that privacy-friendly verification is achievable. “It is possible to design age-assurance systems that respect personal privacy,” he said, adding that his office is preparing detailed guidance on how to accomplish this.
Despite this support, the Canadian Bar Association (CBA) has raised concerns about the legislation. In a letter to Committee Chair David M. Arnot, CBA Privacy and Access Section Chair Christiane Saad warned that the bill lacks essential details about how privacy will be protected in practice.
“This legislation speaks of government data handling only in broad terms,” Saad wrote. “It provides no concrete rules on data retention periods, destruction timelines, auditing or enforcement processes, storage locations, or remedies for users in cases of data misuse. Because of these omissions, many critical privacy safeguards are left to be defined later through regulations, which means enforcement will depend heavily on how the law is implemented rather than on its current wording.”
Saad further cautioned that any system collecting personal information for age verification risks creating sensitive databases linking individuals’ identities to their online viewing habits and sexual interests.
The CBA also criticized the bill’s provision granting the Federal Court broad authority to instruct internet service providers to block noncompliant websites. Such powers, the organization warned, could result in “over-blocking” inadvertently restricting access to lawful, non-pornographic content and could also limit adults’ freedom to access legal materials online, raising concerns about free expression and access to information.
Senator Julie Miville-Dechêne, who introduced Bill S-209, has previously led several unsuccessful efforts to establish national age verification requirements for adult content in Canada. In a 2024 interview on the Law Bytes podcast, she dismissed fears that the bill would block adults from viewing legal adult material, saying, “I’m not worried. Adults will continue to be able to watch porn.”
