Age verification in Canada: S-209, C-34 and what to do now
Age verification in Canada on 31 October 2026: Bills S-209 and C-34 section by section, the OPC age assurance guidance, Ontario and Alberta iGaming, Quebec's digital majority, methods and a checklist.
In short
Canada has no general age verification law in force today. Two federal bills would create one: Bill S-209 for commercial pornography sites and Bill C-34, the Safe Social Media Act, with an under-16 account rule. Both reached House of Commons committee on 28 and 29 October 2026.[1][4]
- Both bills accept age verification or age estimation and require the age-check data to be destroyed once the check is done.[2][5]
- What applies now: provincial rules, such as 19+ for Ontario online gambling and 18+ for Alberta, with player data validated before the account opens.[11][13]
- The Privacy Commissioner's age assurance guidance of 4 May 2026 sets the privacy bar: collect the minimum, keep only the result.[7][9]
Age verification in Canada is moving from provincial rules toward federal ones, but not yet. In the last week of October 2026 the House of Commons sent both federal age-check bills to committee on consecutive days. Neither has passed the House, neither has royal assent, and both would come into force only on a date the federal cabinet fixes by order.[1][2][4][5]
Need the age check itself
Didit estimates age from a selfie with liveness and steps borderline users up to an ID document check in the same flow. Start free or talk to us about your Canadian users.
Age verification in Canada at a glance
| Rule | Status on 31 October 2026 | Age | What it asks for |
|---|---|---|---|
| Bill S-209 | Passed Senate 15 April 2026; House second reading 28 October 2026; HUMA committee[1] | 18 | A prescribed age-verification or age-estimation method on commercial porn sites[2] |
| Bill C-34 | First reading 10 June 2026; second reading 29 October 2026; CHPC committee[4] | 16 for accounts; under 18 for porn content | Adequate age-verification or age-estimation measures on regulated services[5] |
| OPC age assurance guidance | Published 4 May 2026[7] | Any | Minimum data, delete after the signal, keep only the result[9] |
| Ontario iGaming (AGCO standards) | In force; page updated 14 May 2026[11] | 19 (18 for lottery only) | Player data validated before the account is created[11] |
| Alberta iGaming (AGLC SRIG) | Market launched 13 July 2026[15] | 18 | Name and date of birth matched to government ID before the account[13] |
| Cannabis, tobacco, vaping | In force | 18, 19 or 21 by province and product | Mostly ID checked at delivery[19][20] |
- 28 May 2025S-209 tabledFirst reading in the Senate.
- 15 April 2026Senate passesS-209 third reading.
- 4 May 2026OPC guidanceFor operators and developers.
- 10 June 2026C-34 tabledFirst reading in the House.
- 28 and 29 October 2026To committeeS-209 to HUMA, C-34 to CHPC.
Federal milestones, from LEGISinfo and the OPC.[1][4][7]
Both bills finished second reading and sit in committee. C-34 still needs report stage, third reading and the Senate; S-209 passed the Senate on 15 April 2026.[1][4]
Bill S-209: age checks for commercial pornography sites
S-209 is the Protecting Young Persons from Exposure to Pornography Act (Loi sur la protection des jeunes contre l'exposition à la pornographie).[1]
Who it covers
Section 5 makes it an offence for "any organization that, for commercial purposes, makes available pornographic material on the Internet to a young person", meaning anyone under 18.[2] The material must show genital organs or the anal region of a person engaged or depicted as engaged in explicit sexual activity and be "intended to cause sexual excitement".[2] Section 6 excludes services that only incidentally help users "search for, transmit, download, store or access" content, such as search engines and hosts.[2]
Fines and the age-check defence
The fine on summary conviction is up to CAD 250,000 for a first offence and CAD 500,000 for a later one.[2] Section 7(1) turns the bill into an age verification law: believing a user was 18 or older is a defence only if the organization "implemented a prescribed age-verification or age-estimation method" to limit access to adults.[2] Other defences: a legitimate purpose in science, medicine, education or the arts, or taking the steps in an enforcement notice in time.[2]
What a prescribed method must be
The methods are not in the bill. The Governor in Council would prescribe them by regulation, after applying the tests in section 12(2).[2]
Section 12(2)Bill S-209, as passed by the Senate
"Before prescribing any age-verification or age-estimation method [...] the Governor in Council must ensure that the method (a) is highly effective; (b) is operated by a third-party organization that deals at arm's length from any organization making pornographic material available on the Internet for commercial purposes; [...] (e) limits the collection of personal information to what is strictly necessary for the age verification or age estimation; (f) destroys any personal information collected for age-verification or age-estimation purposes once the verification or estimation is completed"
Source: Parliament of Canada, Bill S-209, third reading text[2]
The other tests require privacy, use of data only for the age check, and that the method "generally complies with best practices".[2] The French text says "très efficace" and "une organisation tierce indépendante".[3] An age check run by the site itself would fail test (b); one that keeps selfies or document images would fail test (f).[2]
Enforcement: notice, 20 days, then a blocking order
A notice gives 20 days to take the listed steps. If they are missed, the authority may apply to the Federal Court within 20 more days for an order that Internet providers block access by young persons (ss. 9, 10). The cabinet designates the authority (s. 8); the minister reports annually (s. 11). Section 13 is headed "One year after royal assent", but says the Act "comes into force on a day to be fixed by order of the Governor in Council".[2]
Bill C-34: the Safe Social Media Act and the under-16 account rule
C-34 would enact the Digital Safety Act and the Digital Safety Commission of Canada Act (French short title: Loi sur les médias sociaux sécuritaires).[4] The section numbers below are those of the proposed Digital Safety Act.[5]
Who it covers
The duties fall on "regulated services": regulated social media services, chatbot services and other online services. A social media service becomes regulated at a user threshold set by regulation, or when a regulation designates it; no threshold exists yet. A "child" is anyone under 18.[5]
Two age duties
Section 22(1) applies where an operator has reasonable grounds to suspect a regulated service "provides access to pornographic content": it must use age-verification or age-estimation measures "adequate to mitigate the risk that children will be exposed".[5] Section 27(1) is the under-16 rule.[5]
Section 27(1)Digital Safety Act, Bill C-34, first reading
"[...] an operator must, with respect to every regulated social media service specified by regulations made by the Governor in Council under subsection (5) that it operates, implement adequate age-verification or age-estimation measures designed to prevent a person under the age of 16 from being able to have an account with, or be otherwise registered with, the service."
Source: Parliament of Canada, Bill C-34, first reading text[5]
The under-16 rule reaches only the social media services that cabinet lists, and the Commission may exempt a service that "provides adequate safeguards" for children (s. 29).[5] The government intends "to implement a 16-year-old minimum age requirement" for accounts.[6]
What "adequate" means
For both, the Commission must be satisfied the measures are effective, use personal information only for the age check, destroy it "once the verification or estimation is completed", protect it until then, and meet any extra requirement in the regulations (ss. 22(2), 27(2)).[5] It does not extend to measures that "unreasonably or disproportionately limit users' expression".[5] Before issuing age-measure guidelines the Commission must consult the Privacy Commissioner, and operators must keep records showing compliance (s. 25).[5]
Penalties and timing
The maximum penalty is the greater of CAD 10 million and 3% of gross global revenue in the prior year (s. 88). The Act would come into force on a day or days fixed by order (s. 130).[5]
S-209 and C-34 side by side
| Question | Bill S-209 | Bill C-34 (Digital Safety Act) |
|---|---|---|
| Who must check | Organizations making pornographic material available for commercial purposes[2] | Operators of regulated services above a user threshold or designated by regulation[5] |
| Age line | 18[2] | 16 for accounts on listed social media; under 18 for pornographic content[5] |
| Who sets the method | Cabinet prescribes methods by regulation[2] | The Commission judges adequacy; regulations may add measures[5] |
| Third party required | Yes, at arm's length (s. 12(2)(b))[2] | Not stated in the bill[5] |
| Data after the check | Destroyed once completed (s. 12(2)(f))[2] | Destroyed once completed (ss. 22(2)(c), 27(2)(c))[5] |
| Sanction | Fine up to CAD 250,000, then CAD 500,000; court-ordered blocking[2] | Up to the greater of CAD 10 million and 3% of global revenue[5] |
Watch out
If both pass as written, a platform hosting adult content could face two tests: a method prescribed by cabinet under S-209 and measures the Commission accepts as adequate under C-34. The common ground is an age check that collects little, is used only for age, and deletes its inputs when the check is done.[2][5]
What the OPC age assurance guidance expects today
The OPC published its age assurance guidance on 4 May 2026 for operators and developers, and called them final.[7] It is the privacy regulator's reading of existing law, and it applies now.
The OPC does not pick a method: "Neither age verification, estimation nor inference are inherently more (or less) privacy-protective", and each can be "implemented in a way that is highly effective".[8] It also notes "there is no means of proving one's age online that has been broadly adopted in Canada".[8]
| Who | What the guidance asks |
|---|---|
| Age assurance provider (must) | Collect the minimum; delete personal information "once an age signal is generated"; return only an age range or a yes or no; no secondary use; no profiling; find and disclose accuracy limits by group[9] |
| Age assurance provider (should) | Consider on-device processing; show the practices through an independent audit; offer an equally private alternative[9] |
| Operator (relying party) | Show a legal requirement or a child-specific harm; keep collection proportional to the risk; use the result only for that purpose; give users options and an appeal when access is denied[10] |
Selfie or document checked
Inputs deleted
The data flow the OPC describes: the service learns only the result; the provider keeps no images and no record of where the user went.[9][10]
The OPC calls a system where the provider does not know what content is accessed and the site does not know who the user is "double anonymity".[9]
Online gambling: Ontario 19+, Alberta 18+
Gambling is where age checks are enforced. Ontario and Alberta, both with regulated gaming markets, require identity and age to be validated before the account exists.[11][13]
| Rule | Ontario (AGCO Registrar's Standards) | Alberta (AGLC SRIG) |
|---|---|---|
| Minimum age | 19; 18 only to buy a lottery ticket (Standard 3.01)[11] | 18: a "Minor" is a person under 18 (ss. 3.1, 4.4)[13] |
| When to verify | Player information "validated before a player account is created" (3.04)[11] | Same wording in s. 4.4[13] |
| Data to collect | Name, date of birth, address, login identifier, contact details, PCMLTFA information (3.04)[11] | Full name and date of birth matched to government ID; physical address; PCMLTFA information (s. 4.4)[13] |
| ID viewed at sign-up | Not stated in 3.04[11] | Not required; credit file or dual-process allowed (AGLC FAQ)[14] |
| Self-exclusion | Centralized program mandatory (2.14.1); BetGuard opened 14 May 2026 (19+)[11][12] | Central self-exclusion; enrolment uses name as on ID and a selfie or headshot[14] |
Alberta's SRIG says provincial health cards are "not an acceptable form of identification".[13] Ontario requires players to be re-verified when the excluded list changes (3.03) and the open wagers of a newly excluded person cancelled and refunded within 24 hours (2.14.1), which only works if names and dates of birth match exactly.[11] The PCMLTFA methods casinos also follow are in our FINTRAC guide.
1Collect name, date of birth, address
Plus contact details and a login identifier.
2Validate identity and age
ID document with liveness and face match, or a FINTRAC method such as credit file.
Old enough and not excluded
Create the account
Log the events in the audit trail.
No account
No marketing; keep the record your rules require.
Registration order under Ontario Standard 3.04 and Alberta SRIG s. 4.4.[11][13]
Quebec: the digital majority debate
Quebec has no age verification bill today. On 29 May 2025 the National Assembly's special commission on screens and young people filed 56 recommendations, including a "majorité numérique" (digital majority) barring social media sign-up before 14 without a guardian's consent, and reliable age verification on sexually explicit platforms, in coordination with Ottawa.[16]
To watch
The Parti Québécois platform for the 2026 election promised to "instaurer une majorité numérique" like Australia, Spain, France and the United Kingdom, without naming an age, according to the party document.[17] Its leader, Paul St-Pierre Plamondon, named his cabinet as premier on 21 October 2026.[18] A Quebec bill could add a third age line next to 16 and 18. Quebec's biometric rules are in our Law 25 guide.
Age-gated sales: cannabis, tobacco and vaping
For goods, the age is provincial and the check usually happens at the door.
| Product | Age | Online check today |
|---|---|---|
| Cannabis | 18 in Alberta, 21 in Quebec, 19 in every other province and territory[19] | Health Canada lists "no age verification" as a sign of an illegal retailer[19] |
| Tobacco and vaping (federal floor) | 18: a young person is under eighteen[20] | No one may "send or deliver" these products to a young person; the deliverer's defence is examining government photo ID with name, photograph, date of birth and signature (s. 9)[20] |
| Vaping, online stores | 18 federal floor[20] | Health Canada expects online establishments to prevent youth access, which "could include verifying identification"[21] |
Choosing a method: estimation, document or database
No Canadian text names a technology. S-209 and C-34 both say "age-verification or age-estimation", and the OPC treats verification, estimation and inference as equals if they are effective and private.[2][5][8]
Default for most users
Facial age estimation
- A selfie gives an age estimate; no document
- Works for users without ID
- Needs a buffer around the legal age
Fits "age-estimation" in S-209 and C-34
Step-up
ID document with face match
- Date of birth read from the document
- Bound to the user by liveness and face match
- Required where rules ask for ID data
Alberta SRIG s. 4.4 for gambling
Where KYC applies
Database check
- Input data checked against a trusted source
- No image needed
- Depends on the user having a record
AGLC FAQ: player validation options
Three routes. Most teams combine the first two.[5][13][14]
Digital credentials are not a route for most users yet: British Columbia's Digital Services Card can prove age for 19+ holders but is "only accepted by select pilot projects", and Ontario starts consultations in late 2026.[22][23]
The combination that matches the OPC's data minimisation is adaptive: estimate first, pass clear adults, stop clear minors, and send only the borderline band to a document check.[9]
1Selfie with liveness
The age estimate comes back with a liveness result.
Where the estimate falls against your threshold
Grant access
Store the over or under result only.
ID document step-up
Document checked and matched to the selfie.
Refuse or offer appeal
An alternative route, as the OPC asks.
2Delete the inputs
Images and extracted data go once the result exists.
An adaptive age check built around the OPC's must-delete rule.[9]
Example
A creator platform with adult content sets an 18 threshold and a wide borderline band up to 25, a risk choice, not an OPC requirement. A 30-year-old passes with a selfie, a 19-year-old is asked for a driver's licence matched to the selfie, keeping one field per user: over 18, yes or no, with the date.
Prepare before the bills pass
You can build the adaptive flow, the deletion setting and the appeal route now, and switch thresholds when regulations land. See how Didit runs age verification or talk to us.
A Canada age verification checklist for this month
- List every surface with adult content, gambling, cannabis, tobacco or vaping, and the age in each province you serve.[11][13][19]
- Decide whether you could be a "regulated service" under C-34 or a commercial site under S-209, and write down why.[2][5]
- Track HUMA (S-209) and CHPC (C-34) on LEGISinfo and set a review when either reaches report stage.[1][4]
- Map your current age check against S-209 s. 12(2), item by item.[2]
- Use a separate provider for the age check if you serve adult content.[2]
- Delete selfies, document images and extracted data once the result exists; keep the over or under result and the date.[9]
- For gambling, validate identity and age before the account, re-verify when the excluded list changes, and reject Alberta health cards.[11][13]
How Didit helps with age verification in Canada
Didit runs the age check and the identity check in one workflow, through ID verification and age verification, and leaves the policy decisions with you. No method is prescribed under S-209 and no measure is accepted under C-34, so no provider can claim to meet either; what Didit offers supports the controls the texts describe.[2][5]
- Age estimation predicts age from a selfie, with passive liveness included; the decline threshold is configurable (default 18). Documentation reports a mean absolute error of 1.0 year at 13 to 17 and 1.8 years at 18 to 20.[24]
- Adaptive age verification sends a borderline band you define to a document check, where the portrait is matched 1:1 against the same selfie. Minimum ages can be set per country, with state or region overrides read from the document, and the action set to Decline or Review.[24]
- With the standalone API and
save_api_requestset to false, nothing is stored. In workflows, retention runs from 1 month to 10 years and any session can be deleted by API.[25][26] - The Canada credit-bureau check "verifies input data against Credit Header data obtained from a Credit Bureau in Canada and responds with data sufficient to meet FINTRAC requirements", and AML screening covers 1,300+ sanctions, PEP and watchlist sources with daily re-screening.[31][28]
- The flow runs in French. Data is processed in the EU by default; Enterprise accounts can enable in-country processing subject to availability and contract. Didit holds SOC 2 Type 1 and Type 2, ISO/IEC 27001:2022 and iBeta Level 1 presentation attack detection.[30][27][29]
Didit provides
- Age estimation with liveness and a document step-up
- Per-country and per-region age limits
- Retention settings and deletion by API
- An audit trail of each check
Stays with you
- Whether S-209, C-34 or a provincial rule applies
- The thresholds, the borderline band and the appeal route
- Your privacy assessment and records
- The decision to admit or refuse a user
Add an age check that keeps only the result
Set up age estimation with a document step-up and deletion after the check, in one workflow.
Key takeaways
- On 31 October 2026 neither S-209 nor C-34 is law: both are in House of Commons committee and both would start on a date fixed by order.
- S-209 would make a prescribed, highly effective method, run by an arm's-length third party, the main route to a defence; C-34 would require adequate measures to keep under-16s off listed social media.
- Both bills and the OPC guidance agree on one design: collect little, use it only for age, delete the inputs, keep the result.
- Ontario (19+) and Alberta (18+) already require identity and age to be validated before an online gambling account opens.
- Estimation for most users with a document step-up for the borderline band fits every text reviewed here.
Frequently asked questions
Is age verification required by law in Canada?
Not by a general federal law yet. Bill S-209 (pornography sites) and Bill C-34 (social media and other regulated services) are both in House of Commons committee as of 31 October 2026, with no royal assent.[1][4] Provincial rules require age checks for online gambling, and the federal Tobacco and Vaping Products Act bars delivery to a young person.[11][13][20]
What is Bill S-209?
S-209 is the Protecting Young Persons from Exposure to Pornography Act, a Senate public bill sponsored by Senator Julie Miville-Dechêne.[1] It would make it an offence to make pornographic material available for commercial purposes to anyone under 18; using a prescribed age-verification or age-estimation method is the main route to a defence.[2]
Is there a social media ban for under-16s in Canada?
Not yet. Bill C-34 would require listed social media services to stop people under 16 from having accounts, but it passed second reading only on 29 October 2026 and is in committee.[4][5] The services covered would be named by regulation, and the Commission could grant exemptions.[5]
Does Canada allow facial age estimation?
Neither bill bans it. Both S-209 and C-34 refer to age-verification or age-estimation methods, and the Privacy Commissioner says verification, estimation and inference can each be highly effective.[2][5][8] Under S-209 a method would still need to be prescribed by regulation.[2]
What does highly effective mean in Bill S-209?
The bill does not define it. Section 12(2)(a) makes it the first test cabinet must apply before prescribing a method, next to six others, including an arm's-length third-party operator and destruction of personal information once the check is completed.[2]
What is the legal age for online gambling in Ontario and Alberta?
Ontario's AGCO standards make people under 19 ineligible, except 18-year-olds buying a lottery ticket.[11] Alberta's AGLC standards set the line at 18.[13] Both require player information to be validated before the account is created.[11][13]
Can an online casino in Canada verify age without viewing an ID?
In Alberta, yes: the AGLC says government-issued identification is not required to be viewed at registration and that a credit file or dual-process approach is permitted under FINTRAC rules.[14] Name and date of birth must still match FINTRAC-acceptable government identification.[13]
Does Quebec have a digital majority law?
No. The National Assembly's special commission recommended a digital majority at 14 for social media in May 2025, and the Parti Québécois platform for the 2026 election promised a digital majority without naming an age.[16][17] No bill had been tabled by 31 October 2026.
Sources
- LEGISinfo, Bill S-209 (45-1), Protecting Young Persons from Exposure to Pornography Act, Parliament of Canada, stage data as read 31 October 2026.
- Bill S-209, as passed by the Senate on 15 April 2026 (third reading text), Parliament of Canada.
- Projet de loi S-209, troisième lecture, Parlement du Canada.
- LEGISinfo, Bill C-34 (45-1), Safe Social Media Act, Parliament of Canada, stage data as read 31 October 2026.
- Bill C-34, first reading text (Digital Safety Act and Digital Safety Commission of Canada Act), Parliament of Canada, 10 June 2026.
- Bill C-34, the Safe Social Media Act, Canadian Heritage, modified 8 September 2026.
- Privacy Commissioner of Canada launches new age assurance guidance to support organizations, OPC news release, 4 May 2026.
- Age Assurance: Policy Note, Office of the Privacy Commissioner of Canada, 4 May 2026.
- Designing age assurance to be privacy-protective: Guidance for age assurance developers, OPC, 4 May 2026.
- Age assurance guidance for operators of websites and online services, OPC, 4 May 2026.
- Registrar's Standards for Internet Gaming, Alcohol and Gaming Commission of Ontario, updated 14 May 2026.
- BetGuard, Ontario's new tool to opt out of online gaming, is now available, iGaming Ontario, 14 May 2026.
- Standards and Requirements for Internet Gaming (SRIG), Alberta Gaming, Liquor and Cannabis, sections issued 14 January 2026, file of 18 June 2026.
- iGaming Compliance Guide FAQs, AGLC, 15 May 2026.
- Alberta's iGaming strategy, Government of Alberta, read 31 October 2026.
- Impacts des écrans chez les jeunes : la Commission spéciale dépose son rapport final, Assemblée nationale du Québec, 29 May 2025.
- Plateforme électorale 2026, Parti Québécois (party document).
- Le premier ministre du Québec dévoile son Conseil des ministres, Gouvernement du Québec, 21 October 2026.
- Cannabis in the provinces and territories, Health Canada.
- Tobacco and Vaping Products Act (S.C. 1997, c. 13), Justice Laws Website, current to 30 September 2026.
- Vaping products: compliance and enforcement, Health Canada, modified 11 February 2026.
- Digital Services Card, Government of British Columbia.
- Ontario Introducing Optional Digital Credentials While Guaranteeing Access to Physical I.D., Government of Ontario, 23 October 2026.
- Age Estimation overview, Didit documentation.
- Age Estimation standalone API, Didit documentation.
- Data retention, Didit documentation.
- Security and compliance, Didit documentation.
- AML Screening overview, Didit documentation.
- Certifications, Didit documentation.
- Supported languages, Didit documentation.
- Canada credit bureau (FINTRAC) database validation, Didit documentation.
Age verification in Canada is not yet federal law, but the shape the texts describe is already clear: an effective check that keeps the result and deletes the rest. Start with Didit's ID verification and age verification, see the Canada page for coverage, read the MSB and crypto KYC guide if you also move money, and check pricing.
Build your Canadian age check now
One workflow for age estimation, document step-up and deletion, ready to adjust if the bills pass.
संबंधित लेख
- The Binance breach shows the gap: a key proves a device, not a person
- AI labs are buying human data. Fraud rings are selling it.
- Didit बनाम Unit21: एक ही रिकॉर्ड पर KYC, KYB, AML और मॉनिटरिंग
- Didit बनाम Trinsic: eID साइन-इन के साथ दस्तावेज़ सत्यापन, AML और KYB
- Didit बनाम Thomson Reuters: सरकारी डेटाबेस और पूरा फ़्लो
- Didit बनाम Regula: पूरे साक्ष्य, KYB और मॉनिटरिंग के साथ होस्टेड जाँचें