Bill S‑209 makes it an offence for organizations that make pornographic material available online for commercial purposes to allow access to persons under 18, and ties a conviction‑avoiding defence to the use of prescribed age‑verification or age‑estimation methods. The offence is summary in nature and carries tiered maximum fines (up to $250,000 for a first offence and $500,000 for subsequent offences).
Enforcement is administrative‑to‑judicial: an enforcement authority may issue a compliance notice requiring specified remedial steps within 20 days and then apply to the Federal Court for an order naming Internet service providers as respondents; such orders can require ISPs to prevent access and may have collateral blocking effects. The Governor in Council will set regulatory standards for what counts as acceptable age verification, with explicit privacy and third‑party operation requirements, and the Act requires annual parliamentary reporting and comes into force one year after royal assent.
At a Glance
What It Does
The bill creates a summary offence for commercial providers that make pornographic material accessible to anyone under 18 and makes a prescribed age‑verification or age‑estimation system the primary path to avoid conviction. It authorizes an enforcement authority to issue notices and, after non‑compliance, seek Federal Court orders that can require ISPs to block access.
Who It Affects
Commercial pornographic websites and platforms, third‑party age‑verification providers, hosting services and content hosts, and Internet service providers that could be named as respondents to Federal Court blocking orders. Regulators and federal enforcement bodies will also carry new administrative responsibilities.
Why It Matters
S‑209 shifts responsibility for preventing youth access from users and parents to commercial providers and, if necessary, to ISPs, while tying compliance to centralised third‑party verification with mandated privacy safeguards — a policy mix that creates operational, legal and privacy trade‑offs for industry and government.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
S‑209 defines the key terms and sets the law’s scope up front: pornographic material is described by the depiction of genitalia, anus or female breasts for a sexual purpose, and the Act expressly excludes child pornography as defined elsewhere in the Criminal Code. The statute focuses on material made available for commercial purposes; the Governor in Council will make the finer distinctions by regulation, including whether free material can be treated as commercial.
The core criminal rule makes an organization guilty of an offence if, for commercial purposes, it makes pornographic material available on the Internet to anyone under 18. The bill prescribes maximum fines for summary convictions and narrows the available defences: an organization can only escape conviction for mistaken belief about a user’s age if it implemented a verification or estimation method that the regulations prescribe.
The Act also preserves an exemption for acts with legitimate scientific, medical, educational or artistic purpose.If the designated enforcement authority has reasonable grounds to believe an offence occurred, it can issue a non‑compliance notice that identifies the organization, specifies steps to achieve compliance and gives 20 days to act. Failure to comply within that period permits the authority to apply to the Federal Court, naming the non‑complying organization and any ISPs whose services may be used to access the material.
The Court must hear the matter on an expedited basis and may order ISPs to prevent access where it finds reasonable grounds and non‑compliance — and those orders can, by their nature, interfere with access to non‑pornographic content or block adults as well as young people.Regulations play a central role in implementation. The Governor in Council will set the definition of commercial availability and prescribe acceptable age‑verification and age‑estimation methods.
Before prescribing methods, the government must ensure they are highly effective, run by arm’s‑length third parties, minimize and strictly limit personal information collection, use data only for age checking, destroy collected data after verification, and comply with privacy best practices. The Minister must table an annual report to Parliament with statistics on notices and court applications.
The Act takes effect one year after royal assent and includes a coordinating amendment to harmonize its definition of pornographic material with other Criminal Code amendments when they come into force.
The Five Things You Need to Know
The bill makes organizations that commercially provide online pornographic material to persons under 18 guilty of a summary offence with maximum fines of $250,000 for a first offence and $500,000 for subsequent offences.
An enforcement notice gives an organization 20 days to take specified remedial steps; if it fails, the enforcement authority can apply to the Federal Court for an order naming ISPs as respondents.
The Federal Court must hear applications on an expedited (summary) basis and may order ISPs to prevent access — an order that can unintentionally block non‑pornographic content or restrict access even for adults.
Regulations must prescribe age‑verification and age‑estimation methods that are operated by independent third parties, are 'highly effective', limit data collection to what is strictly necessary, and require destruction of collected personal information after verification.
The Governor in Council will define when material counts as 'made available for commercial purposes'; that regulatory definition determines which sites must comply and which may fall outside the Act’s reach.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Definitions and scope of application
Section 2 anchors the Act by defining 'pornographic material', 'young person' (under 18), 'Internet service provider', and 'making available.' Those choices steer enforcement: the focus on visual representation and the exclusion of child pornography separate this law from child‑abuse offences, while leaving the treatment of non‑visual sexual content and borderline material to interpretation and regulation. 'Making available' is broad (transmitting, distributing, selling), which could capture hosts, CDNs and distribution platforms unless regulations narrow the field.
Substantive offence and penalty structure
Section 5 creates the core offence for organizations that commercially make pornographic material accessible to under‑18s and sets tiered maximum fines for summary convictions. The use of summary procedure keeps penalties administratively simple but limits procedural protections compared with indictable offences, which could be important in contested cases involving technical compliance or age‑estimation errors.
Defences: prescribed age checks and legitimate uses
Section 7 makes an implemented prescribed age verification or estimation method the primary way to avoid conviction for a mistaken belief about a user’s age — mere good faith is insufficient. The section separately preserves a defence for material used legitimately in science, medicine, education or the arts. Practically, this pushes commercial operators toward whatever verification the regulations set out and creates a compliance framework rather than a purely subjective test.
Notice‑to‑comply and Federal Court enforcement pathway
The enforcement mechanism is stepwise: the Governor in Council can designate an enforcement authority; that body issues a notice with specified remedial steps and a 20‑day compliance window; on non‑compliance it may apply to the Federal Court naming ISPs who could be used to access the material. The Court must apply summary rules and may order ISPs to prevent access if it finds reasonable grounds and non‑compliance. Importantly, the Act explicitly contemplates that Court orders may produce collateral blocking of other material or block access for non‑young users, creating real operational consequences for ISPs and internet users.
Annual reporting to Parliament
Section 11 obliges the Minister to table an annual report with statistics on notices issued, applications to Federal Court and outcomes. That requirement provides a data stream to assess enforcement activity and trends, but the Act does not prescribe performance metrics for compliance effectiveness or privacy incidents, leaving those judgments to future reports and oversight.
Regulatory authority and mandatory design features for age checks
Section 12 gives the Governor in Council a broad regulatory mandate, including defining 'commercial purposes' and prescribing verification methods. Subsection (2) lists mandatory policy criteria — third‑party operation, high effectiveness, narrow data collection, use limits, destruction after use, and adherence to privacy best practices — effectively centralizing verification through vetted vendors. The precise technical and privacy safeguards will, however, be determined in regulations and will drive how intrusive or protective verification ends up being in practice.
Coordinating amendment with related Criminal Code reforms
Section 13 times a definitional change to align this Act’s 'pornographic material' definition with separate Criminal Code changes about child sexual abuse and exploitation material. This coordination indicates the drafters’ intent to avoid overlap with other offences, but it makes final scope contingent on other legislation coming into force.
Commencement
Section 14 fixes the coming‑into‑force date at one year after royal assent, giving industry, regulators and third‑party providers a predictable implementation window to develop compliant systems and for the government to draft required regulations.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Young persons and families — by creating a statutory regime aimed at reducing minors’ exposure to commercial pornographic material and generating data (through annual reports) to track enforcement activity.
- Public‑health and education agencies — the law frames exposure as a public‑health concern and creates a legal tool to reduce access points that agencies can rely on when designing prevention or treatment programs.
- Third‑party age‑verification providers — the regulatory requirement that verification be operated by arm’s‑length third parties creates a market opportunity and potential demand for certified verification services.
- Victims’ and gender‑based violence prevention organizations — the Act’s focus on material that demeans or depicts sexual violence aligns with policy tools these groups use to reduce harmful norms that can contribute to harassment and violence.
Who Bears the Cost
- Commercial providers of pornographic material — they face compliance costs to implement prescribed verification or the risk of large fines and potential loss of access to Canadian users if Court orders are sought.
- Internet service providers and intermediaries — ISPs may be ordered into the enforcement process, incurring technical, legal and customer‑service costs, and may face difficult operational choices when orders threaten collateral blocking.
- Federal enforcement authority and courts — designation and processing of notices, expedited Federal Court applications and related litigation will require staff, expertise and resources.
- Privacy advocates and individual users — centralised third‑party verification systems introduce privacy‑risk externalities; if verification fails to minimize data use or if data retention practices are weak, individuals bear privacy harms and identity‑security risks.
- Small hosting platforms and incidental service providers — the Act’s broad 'making available' language and later regulatory choices about 'commercial' status could pull small or incidental providers into compliance obligations or enforcement processes.
Key Issues
The Core Tension
The central dilemma is whether the state should prioritize preventing youth exposure by compelling commercial sites and intermediaries to adopt robust, centralized age‑checks — thereby improving enforceability — at the cost of concentrating personal data, increasing the risk of overbroad blocking of lawful speech, and imposing operational burdens on ISPs and smaller intermediaries.
The bill trades an access‑control approach for a regulatory/penal regime that centralizes compliance around prescribed age checks. That centralization addresses the enforcement problem — it gives regulators a clear standard to require — but it concentrates sensitive identity checks in third‑party services.
The statutory requirement that those services operate at arm’s length and destroy data aims to protect privacy; in practice, efficacy will depend on regulatory detail and auditability, and any gap between promise and practice risks presenting new privacy and security harms.
Enforcement via Federal Court orders against ISPs raises familiar technical and constitutional complications: orders that compel blocking can be imprecise and produce collateral restrictions on lawful content or adult access, and they burden ISPs with implementation decisions and legal risk. Extraterritorial hosts and decentralized distribution (CDNs, caches, peer‑to‑peer) may be difficult to control, meaning the law could push blocking upstream to ISPs instead of delivering direct compliance by content providers.
Finally, the Act leaves open significant drafting choices — notably how 'commercial purposes' will be defined and what counts as a 'highly effective' age‑estimation method — and those regulatory definitions will determine who is actually covered and how intrusive verification will be.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.