Under a fresh Senate review, Canada’s privacy chief has thrown his weight behind a renewed push for nationwide age checks on adult platforms, while leading legal voices warn the plan could open the door to intrusive data practices and site blocking.
Philippe Dufresne, the privacy commissioner of Canada, told the Standing Senate Committee on Legal and Constitutional Affairs that Bill S-209 — “The Protecting Young Persons from Exposure to Pornography Act” — answers key concerns he raised about earlier proposals like S-210.
“In my appearance in May 2024, before the Standing Committee on Public Safety and National Security on a previous iteration of this Bill, I provided two primary recommendations,” Dufresne told the committee. “To limit the scope of application of the Bill; and to make certain enhancements to the criteria for prescribed age-verification and age-estimation methods to ensure that privacy is protected. I am very pleased to see that they have been incorporated in S-209. The added requirement to limit the collection of personal information to that which is strictly necessary for age verification or age estimation has also enhanced the Bill from a privacy perspective.
“I believe that it is possible to implement age-assurance mechanisms in a privacy-protective manner,” Dufresne added. “My Office is developing guidance on how this can be done.”
S-209 would introduce penalties of up to $500,000 for adult sites that fail to verify Canadian users’ ages. While Dufresne now views the bill’s safeguards more favorably than the previous iteration, the Canadian Bar Association (CBA) urged senators to proceed with caution.
In a letter to committee chair David M. Arnot, CBA Privacy and Access Section chair Christiane Saad argued that the statute leaves too much to future regulations and not enough in the legislative text itself. “This Bill addresses government data collection and retention only in broad, principle-based terms,” Saad wrote. “However, it lacks key specifics: no defined retention timeline, no clarity on the speed of destruction, no auditing or enforcement mechanisms, no requirements for storage location, and no remedies for users if data is mishandled. As a result, the Bill leaves many critical safeguards to future regulations, making enforcement and technical protections highly dependent on implementation rather than the statute itself.”
The CBA also highlighted the privacy risks inherent in any verification model that ties identity to content consumption. “An obvious by-product of such age-verification or age-estimation measures is the creation of a data set that links personal identifying data to data revealing that an individual accessed internet pornography as well as the specific sexual proclivities and interests of that individual,” the letter cautions.
Beyond data issues, the association flagged potential impacts on lawful speech. The letter notes that S-209 would grant Canada’s Federal Court “sweeping authority” to order internet service providers to block access to noncompliant sites. “Such measures risk over-blocking — removing lawful, non-pornographic content alongside the targeted material — and may inadvertently restrict adults’ access as well, resulting in collateral censorship, restricting freedom of expression and access to information,” the letter states.
Both S-209 and its predecessor S-210 were introduced by Sen. Julie Miville-Dechêne, who has championed national age-verification requirements in multiple previous attempts. Asked in a 2024 “Law Bytes” podcast interview about the possibility that adults could be prevented from accessing legal material, she replied, “I’m not worrying. Adults will continue to be able to watch porn.”