Bill S-209 – An Act to restrict young persons’ online access to pornographic material

Via email: lcjc@sen.parl.gc.ca

The Honourable David M. Arnot
Chair, Standing Senate Committee on Legal and Constitutional Affairs
Senate of Canada
Ottawa, ON K1A 0A6
Dear Senator Arnot:

Re: Bill S-209 – An Act to restrict young persons’ online access to pornographic material.

I am writing on behalf of the Canadian Bar Association’s Privacy and Access Section (CBA Section) about Bill S-209, An Act to restrict young persons’ online access to pornographic material (the “Bill”), which was introduced on May 28, 2025. It aims to restrict online access to sexually explicit material for individuals under 18 years of age. The Bill seeks to make it a criminal offense for organizations to provide such material for commercial purposes without implementing age verification or age estimation systems. This Bill is designed to protect young persons from exposure to pornographic material available on the Internet.

The CBA is a national association of 40,000 members, including lawyers, notaries, academics, and students across Canada, with a mandate to seek improvements in the law and the administration of justice. The CBA Privacy Section comprises lawyers working in the public, private, and not-for-profit sectors across Canada.

The CBA Section supports the overall goal of the Bill which is to protect young persons from serious harm arising from increased accessibility to internet pornography. While we generally support Bill S-209 and its purpose, we raise the following concerns about its implementation and offer recommendations for improvement.

Privacy

One of the desired effects of the Bill is to force pornography distributors to implement prescribed age-verification method(s) to limit access to pornographic material made available for commercial purposes to persons who are at least 18 years of age.¹ The Bill’s preamble claims that “online age-verification and age-estimation technology is increasingly sophisticated and can now effectively ascertain the age of users without breaching their privacy rights”. The Bill, however, contains no specifics on how the government will practically balance privacy and protection. Instead, it mentions the development of “regulations for carrying out the purposes and provisions” of the Bill.

Although age-verification and age-estimation both aim to determine a user's age, they differ significantly in their methods and implications for privacy. Age verification demands direct proof,
such as government-issued IDs or biometric data, offering high accuracy but at the cost of deeply compromising user anonymity and raising substantial privacy risks through the collection and storage of sensitive personal information. In contrast, age estimation utilizes AI to infer age from cues such
as facial features, offering a less precise but also less intrusive method that generally preserves user anonymity and reduces privacy concerns by avoiding the collection of personally identifiable data.

Where will the distinction lie in the trade-off between definitive age confirmation and the protection of individual privacy and digital freedoms?

The Bill’s goal to protect young persons hard‑wires age surveillance into the internet. It forces mandatory proof of age for everyone—ending anonymity and prompting people to hand over IDs or biometrics—while empowering risky enforcement measures like Internet Service Provider-level blocking. This constitutes a recipe for data breaches, mission creep, and censorship by default.

The CBA Section is a strong proponent of privacy protection for Canadians and is skeptical that the appropriate balance is possible absent evidence to the contrary. Age-verification and age-estimation requirements may authorize the Canadian government to either collect or supervise the collection of private and sensitive information. An obvious by-product of such age-verification or age-estimation measures is the creation of a data set that links personal identifying data to data revealing that an individual accessed internet pornography as well as the specific sexual proclivities and interests of that individual.

This Bill addresses government data collection and retention only in broad, principle-based terms. However, it lacks key specifics: no defined retention timeline, no clarity on the speed of destruction, no auditing or enforcement mechanisms, no requirements for storage location, and no remedies for users if data is mishandled. As a result, the Bill leaves many critical safeguards to future regulations, making enforcement and technical protections highly dependent on implementation rather than the statute itself. If this data must be collected, the Bill should explicitly say so and be amended to include legislative provisions that ensure the personal data of Canadians won’t be improperly retained, accessed, or otherwise misused. The mishandling of the personal information could have grave consequences for the mental health, dignity and personal integrity of private citizens who access the age-verification and age-estimation process.

Finally, the Bill raises certain concerns regarding enforcement. By requiring third‑party entities to manage age-verification instead of the government, it increases the risk of direct commercial exploitation of sensitive personal information. This raises questions of oversight, accountability, and the potential for abuse or “function creep,” such as the repurposing of age-verification or age-estimation data for other purposes. At the same time, Section 10 gives the Federal Court sweeping authority to order internet service providers to block access to non‑compliant organizations. Such measures risk over-blocking—removing lawful, non-pornographic content alongside the targeted material—and may inadvertently restrict adults’ access as well, resulting in collateral censorship, restricting freedom of expression and access to information.

The CBA Section recommends amending the Bill to guarantee sufficient privacy safeguards.

We hope these observations are helpful.

Yours truly,

(original letter signed by Julie Terrien for Christiane Saad)

Christiane Saad
Chair, Privacy and Access Section

Endnotes