Initial Thoughts on the Online Harms Act
Canada's Online Harms Act — Bill C-63 — has been tabled. After years of consultation, false starts, and political hesitation, the government has finally put forward its framework for regulating harmful content online. Here is my initial read.
The Seven Defined Harms
The Act identifies seven categories of harmful content that fall within its scope: non-consensual sharing of intimate images, child sexual abuse material (CSAM), content that induces self-harm in minors, cyberbullying of children, hate speech, incitement to violence, and violent extremism and terrorism.
This is a targeted list rather than a sweeping one. The government has clearly tried to focus on areas where there is broad societal consensus that harm is real and significant. Each category carries its own set of regulatory obligations, reflecting the reality that not all online harms are alike or require the same response.
The Regulatory Structure
The Act establishes three new institutional bodies. The Digital Safety Commission will serve as the primary regulator, responsible for oversight, enforcement, and the development of codes of practice. The Digital Safety Ombudsperson will act as an advocate for the public, providing a channel for complaints and ensuring that the voices of affected individuals — particularly children and victims — are heard within the regulatory process. The Digital Safety Office will provide operational and research support to both the Commission and the Ombudsperson.
This three-part structure is designed to separate the enforcement, advocacy, and research functions. Whether it proves to be effective or unwieldy will depend on how the bodies are resourced and how clearly their mandates are delineated in practice.
The Four Core Duties
At the heart of the Act are four duties imposed on regulated platforms.
Duty to Act Responsibly. This is perhaps the most significant and nuanced obligation in the bill. Platforms are required to take steps to minimize the risk of harm arising from content on their services. Critically, the duty is framed around product design and systems — not around the elimination of specific pieces of content. The emphasis is on how platforms build and operate their systems, including recommendation algorithms, content moderation processes, and user interfaces. This is a systemic approach, and it is the right one.
Duty to Protect Children. Platforms must implement age-appropriate design principles and take specific measures to protect minors from harmful content and exploitative practices. This aligns with a growing international consensus that children require distinct protections online, and that platforms bear responsibility for the design choices that expose young users to risk.
Duty to Make Content Inaccessible. For the most severe categories of content — particularly CSAM and non-consensual intimate images — the Act imposes a 24-hour takedown obligation. Once flagged, platforms must act quickly to remove the material. This recognizes that for the most egregious harms, speed matters and delayed action compounds the damage to victims.
Duty of Data Transparency. Platforms are required to provide researchers with access to data necessary for understanding the scale and nature of online harms. This is a crucial provision. Without access to platform data, independent research into the effects of algorithmic systems and content moderation practices is essentially impossible. Transparency is the foundation on which evidence-based policy depends.
International Alignment
The Act positions Canada within a growing international movement toward platform regulation. Its structure and approach draw on lessons from the EU's Digital Services Act, the UK's Online Safety Bill, and Australia's eSafety Commissioner model. There are meaningful differences in design, but the direction is consistent: governments are moving toward systemic, risk-based regulation of platforms rather than content-by-content moderation.
This alignment matters. The platforms that will be regulated under C-63 operate globally, and regulatory coherence across jurisdictions strengthens the capacity of any single country to enforce meaningful standards.
Looking Ahead
This is a first read, and there is much more to work through in the details. The Act will go through committee review, and significant questions remain about resourcing, enforcement mechanisms, and the interaction between the new regulatory bodies and existing institutions. But the tabling of C-63 represents a meaningful step. Canada has entered the platform regulation conversation with a framework that is serious, targeted, and structurally sound. The work now is to get the details right.