Debunking the Bill S-210 (Age Verification) Supporters “FAQ” Page

Supporters of Bill S-210 (or Canada’s age verification bill) have apparently released a so-called “FAQ”. We debunk some of the claims of that page.

Last year, we published an analysis of Bill S-210 – Canada’s age verification bill. During our analysis, we found numerous problems with the bill such as a lack of scope for which website would be subject to this law, mandating the use of technology that doesn’t actually exist, an unprecedented spike in surveillance measures over people’s every day online activities, and a massive increase of government mandated internet censorship. This under the fake premise of “save the children”.

When MP’s were asked how the bill would actually work, they generally didn’t have a clue and decided to punt this fools errand to committee to let them sort it all out. The mainstream media has generally been complicit in this internet crackdown bill and simply took government talking points at face value without checking the facts before publishing their articles. This has resulted in outrageously inaccurate stories such as how the bill would protect against child luring or even wild claims about how the Liberal party is out of step with the rest of the world when they oppose such laws.

Lucky for you, there are news type people out there who actually know how to properly do our jobs. So, when Senator Julie Miville-Dechene claimed that this legislation only applies to adult oriented website, we debunked that myth by pointing out that there is no such provision in the bill that provides a scope of any kind for websites. We also took the time to debunk the myths pushed by the Canadian mainstream media for good measure.

Civil rights organizations have taken note of what all is happening in the debate. They have released their own FAQ which basically acts as third party confirmation of what we have been saying all along about the bill. Further, they signed a joint open letter to the government calling for this legislation to be stopped.

Recently, it came to our attention that supporters have quickly thrown together a webpage purporting to be an FAQ page about the legislation. The page can be found here and, at first blush, contains a considerable amount of misinformation and disinformation. So, let’s run through this page together to spot the problems with this page.

The Summary

The site starts off with quite a whopper:

At the root of Bill S-210 is a simple idea: the rules that apply to pornography offline should apply to pornography online. In the real world, businesses are required to verify the age of their customers to prevent minors from accessing adult content. The same requirements should apply on the Internet. We know that children as young as 7 or 8 are accidentally or willfully accessing pornography. The detrimental effects of pornography on children are well documented. Acting to prevent minors from accessing adult content online is a legitimate government response to a serious public health crisis.

While the claims that pornography constitutes a national health crisis sounds grossly exaggerated, we will simply choose to stay in our lane in our field of expertise and focus on the technological side of things.

The opening paragraph is extremely misleading because this is simply not the reality proposed by the law. Simply put, there are no provisions in the bill that talks about a scope of what websites are subject to the legislation and what websites are not. As a result, every website is subject to this legislation. So, to tackle the proported premise above, a more accurate comparison is that every building in the country must have age verification checks. It doesn’t matter if you are a business that sells gardening supplies or books or even just someone’s apartment, every building must have an age verification check because there might be pornographic material out there somewhere. It’s an absurd overreaction to such a “problem” in the first place and few would even consider this a reasonable thing to do.

The second paragraph of the summary is simply packed with misinformation:

How can this be done? Bill S-210 proposes a targeted and effective mechanism: websites offering pornographic content will be required to meaningfully verify the age of their users before they can access adult content, or face fines of up to $250,000 per violation. Non-compliant sites, especially those located abroad, could be subject to a blocking order. The Bill specifically provides that all approved age verification must be reliable, maintain user privacy and protect user personal information, destroy any personal information collected and generally comply with best practices in the fields of age verification and privacy protection. Pornographic websites will have no access to personal user information.

This is one of those paragraphs where I find myself asking, “Wow, where do I begin to describe what is wrong with this?”

As mentioned, all websites regardless of content would be subject to this legislation, not just websites “offering pornographic content”.

Second, there is no technology that exists today that both “meaningfully verify the age of their users” and, at the same time, “maintain user privacy and protect user personal information”. You might as well publish a law that demands website owners use technology that turns lead into gold. It’s an equally absurd ask. You either have an extremely high level of surveillance or you have a technology that would be insufficient at verifying people’s age. If you don’t believe me when I say this, you can ask French privacy regulator, the CNIL instead as they have made the same conclusions.

Separately, website blocking orders could very easily be considered unconstitutional as it is a government curtailing the speech of a website in the first place over content that would otherwise be considered perfectly legal. Essentially, it violates Canada’s Charter rights to freedom of expression.

Further, while there is a provision in the bill that mandates “destroy any personal information collected” by services that run such age verification check technology, there are no provisions in either the bill or existing law that prescribe penalties of any kind for those who violate such provisions. In fact, when I advocate for privacy reform as I have for the last more than half a decade now, one of the things I call for is financial penalties for companies that mishandle people’s personal information. Today, when a major data breach or leak happens in Canada, the only time a company faces any kind of penalty is when private citizens affected by such a security incident have to go to court and show damages to them personally as a result of that. The only thing government can do is, through privacy commissioners, issue strongly worded letters asking companies to pretty please don’t do that again. That’s it.

Further, the claim that the bill asks companies to “generally comply with best practices in the fields of age verification and privacy protection” is quite silly because, to our knowledge, such “best practices” don’t actually exist.

The paragraph ends by saying that “Pornographic websites will have no access to personal user information”. This is actually a hilarious claim because it completely misinterprets the source of concern in the first place. The concern is much less that a porn website will have access to said personal information and more that nefarious third parties, the services tracking this information, and whoever the services sell that information to will have access to such data. In fact, a leak or a breach doesn’t even need to occur before damage can be done. Fraudsters can simply claim to have such information and demand payments or else the information gets posted publicly, potentially bilking Canadian’s out of millions. This isn’t even getting into the questionable ethics of buying and selling personal information with shady data brokers.

The Questions

the FAQ starts off with this:

Is S-210 a censorship bill, an attack on free expression or a limit to legal pornographic content for adults?

Bill S-210 will have no impact on any adult’s ability to access pornographic content online. All legal pornography available online today will continue to be accessible to adults once Bill S-210 is passed. The only difference is that accessing pornographic websites will require a quick age verification process.

The answer here is not only false, but self-contradictory. First, the answer says there is “no impact”, then, two sentences later, says “The only difference is…”. So, even the answer admits that there is a difference.

While we don’t know what “best practice” will ultimately be enforced when it comes to what verification process that will ultimately be chosen, most methods are far from “a quick age verification process”. The best case scenario is that a credit card would be required (which can be very easily stolen). Other methods known in the community is a facial recognition scan, biometric surveillance, or requiring users to fork over government ID such as a drivers license or Social Insurance Number (SIN number). To put into perspective just how intrusive such a thing is, modern banking services today don’t require a facial recognition scan just to log in and perform any kind of banking whatsoever.

Either way, the answer provided here is false.

The next section shows this:

Is there a risk that Bill S-210 will target all forms of nudity or sexual content?

No. The Bill refers to the legal definition of pornographic material contained in clause 171.1(5) of the Criminal Code. It does not introduce a new or expanded definition of pornographic content, relying instead on a neutral and well established standard. Moreover, at clause 6(2), Bill S-210 explicitly states that it is not an offence to show sexual content for a legitimate purpose related to science, medicine, education or the arts.

OK, so what is clause 171.1(5)? This:

171.1(5) In subsection (1), “sexually explicit material” means material that is not child pornography, as defined in subsection 163.1(1), and that is (a) a photographic, film, video or other visual representation, whether or not it was made by electronic or mechanical means, (i) that shows a person who is engaged in or is depicted as engaged in explicit sexual activity, or (ii) the dominant characteristic of which is the depiction, for a sexual purpose, of a person’s genital organs or anal region or, if the person is female, her breasts; (b) written material whose dominant characteristic is the description, for a sexual purpose, of explicit sexual activity with a person; or (c) an audio recording whose dominant characteristic is the description, presentation or representation, for a sexual purpose, of explicit sexual activity with a person.

This is one of those laws where the further down you go, the more vague it gets. Broadly speaking, age verification laws in other countries are well known for being a covert attempt to crack down on LGBT content. So, if one were to talk about material talking about, say, gender affirming care, there are those that would cite “(b)” as saying that such material constitutes an offence because it would be construed as “for a sexual purpose”.

The section of the bill, 6(2) states the following:

(2) No organization shall be convicted of an offence under section 5 if the act that is alleged to constitute the offence has a legitimate purpose related to science, medicine, education or the arts.

Some might say that such material would fall under “education”. While that may ultimately be a viable defence, it would be up to the website owner to take a website blocking order or fine to court to argue that the purpose of that material was ultimately perfectly legal. As many in the legal community knows full well, a court challenge is extremely costly. It’s a similar problem for issues such as a SLAPP (Strategic Lawsuit Against Public Participation) lawsuit. The website owner might have a perfectly valid defence, but wouldn’t have a hope in affording the legal fees in fighting such lawsuits in court. It’s an extremely common problem. Further, if its an offshore website, there is an even greater disincentive to fight a blocking order in the first place because Canada has a small population in the first place.

Either way, the onus would be on the website owner to pay up enormous legal fees to defend their website should they run into problems. In a vast majority of the cases, however, the website owner would either choose not to fight the claim against them or simply choose to shut down the website because they have a bank account with $12 to their name. This as overzealous moral panic crusaders simply move on to other websites and demand blocking orders for them as well. Further, the law is vague enough to allow such abuse in the first place because it doesn’t take much to figure out what the law can do rather than what the law was designed to do.

The next question is this:

Will S-210 impose age verification on all web sites and services?

Bill S-210 is a straightforward and focused piece of legislation: in order to access pornographic material, web sites must verify that their users are 18 or older. Web sites that specialize in pornographic content will be required to implement prescribed age check mechanisms before users can access the site. Web sites that offer pornographic and non-pornographic content may be required to verify the age of their users before they can access the pornographic portions. Because the vast majority of web sites do not host pornographic content, they will not be affected by S-210. The age verification obligations under Bill S-210 are similar to those imposed under Part 5 of the recently adopted Online Safety Act in the UK, whereby Internet services have a duty to ensure, by the use of age verification or age estimation (or both), that children are not normally able to encounter pornographic content. The European Union, France, Germany and other jurisdictions have also adopted similar rules in recent years.

As mentioned already, it is 100% false to state that the bill, in its current form, only targets pornographic material. Again, there is no scope for what website is in the bill or is out of the bill as per the legislation itself. It just asks that all websites must have these age gates in place. If you don’t host adult content, you will be affected anyway because the bill doesn’t distinguish between adult content and innocuous quilting patterns.

So, this answer is also completely false.

The next question has quite the hilarious answer:

How will the law work? Will this involve facial recognition? Will I have to give a credit card number? Is this a digital ID program?

When discussing Bill S-210, it is very important to distinguish the What and the How. Bill S-210 focuses on the What: preventing children from accessing online porn by making sure that users of pornography are over 18. The question of How to do this – the specific age-verification methods and processes — is technical and subject to technological evolution. For this reason, Bill S-210 does not prescribe any specific approach. It does not mandate or imply digital identification, facial recognition or other process. The bill only states that any age-verification method approved by the government must be reliable, maintain user privacy, destroy any personal information collected, and generally comply with best practices. While there are legitimate debates about the effectiveness and desirability of different age-verification methods, these discussions are somewhat premature. It is only at the stage of regulations, once the bill is passed, that consultations can take place concerning the merits and limits of different age-verification tools and processes.

The “answer” doesn’t really answer the question here. Instead, it actually dodges the question entirely. So, breaking this down, the provided “answer” says that what practice is adopted simply “comply with best practices”. So, a legitimate question is what approach is “reliable” and “maintain user privacy” that doesn’t involve credit cards, digital ID, or facial recognition scans? The provided answer does not say. In fact, it doesn’t even envision any other approach. Instead, it punts the issue to a later process and dusts its hands of the issue. The reality is that facial recognition scams and government ID are common demands for such systems (which have questionable reliabilty in the first place). That is why these methods are brought up when people have concerns about this.

So, ultimately, it’s a non-answer that doesn’t add any value to the debate.

The next question and answer is this:

What about the privacy of users? How can we protect personal information?

Privacy and the protection of personal information are vital considerations that are specifically addressed in clause 11(2) of Bill S-210. This clause states that, before authorizing an age verification method, government regulations must consider whether the method (a) is reliable; (b) maintains user privacy and protects user personal information; (c) collects and uses personal information solely for age-verification purposes, except to the extent required by law; (d) destroys any personal information collected for age-verification purposes once the verification is completed; and (e) generally complies with best practices in the fields of age verification and privacy protection. This clause is based on an amendment proposed by Keith Jansa, CEO of the Digital Governance Council, during his Senate testimony in favour of Bill S-210.

OK, so, first, what does 11(2) say? This:

Age-verification method

(2) Before prescribing an age-verification method under subsection (1), the Governor in Council must consider whether the method

(a) is reliable;

(b) maintains user privacy and protects user personal information;

(c) collects and uses personal information solely for age-verification purposes, except to the extent required by law;

(d) destroys any personal information collected for age-verification purposes once the verification is completed; and

(e) generally complies with best practices in the fields of age verification and privacy protection.

First question here: what are the penalties for companies that violate such provisions? Go ahead and read the section yourself because that is the entire extent of it. Doesn’t say, does it? That is the crux of the problem with this. If a company decides to gather all that personal information and sell it off to third party data brokers for tens of millions of dollars, the company would face no repercussions. The absolutely worst case scenario is that the company in question would face a strongly worded letter from the privacy commissioner. That’s it. All this provision does is ask that companies pretty please play nice with that massive trove of personal information.

This may be news to some supporting these laws, but companies pushing their verification systems are only doing so with the intent of turning a profit. If you honestly believe that the free market will sort it out, well, then you are relying on the same free market that brought us the Cambridge Analytica scandal, the Tim Hortons privacy scandal, the Home Hardware privacy scandal, and even the Clearview AI RCMP privacy scandal. Time and time again, the free market has proven that they cannot be trusted to handle such issues. Yet, here we are, expecting a market force that repeatedly proves otherwise to handle even more sensitive personal information and relying on the age old method of pinky swearing not to do wrong this time. You can’t be serious.

The next exchange is this:

Does Bill S-210 target or pose a threat to LGBT individuals?

No. Bill S-210 only seeks to prevent minors from accessing online pornography. The bill does not distinguish between different types of pornographic content or the different identities of users: the goal is simply to keep all children away from all types of pornographic content, through age verification. Bill S-210 does not introduce new or expanded definitions of pornography, relying instead on the well established definition at clause 171.1(5) of the Criminal Code. The bill also excludes the distribution of sexual content for a legitimate purpose related to science, medicine, education or the arts. There is simply no basis to claim that Bill S-210 targets LGBT individuals in any way.

The problem with this is that such laws internationally have a long history of being a tool to crack down on the LGBT community. In the United States, for instance, age verification laws are well known to do exactly this:

Age verification mandates serve three functions: surveillance, intimidation, and social control. It is point-blank unacceptable to commit people to verifying their ages or identities in the name of safeguarding the digital well-being of young people. This is because this would force web users of all backgrounds and ages to further risk their personal information with sites that have very little business retaining that information for only the simple purposes of complying with local and state laws. The concept of age verification on content that is “pornographic” is also a trying issue to address. At a time when most mainstream right-wing lawmakers in the United States go as far as to liken queer young adult literature to hardcore pornography for adults, it’s naïve to say that age verification mandates aren’t tools of censorship. Utah, Arkansas, Louisiana, and Virginia are all at the heart of conservative America’s base that tries to justify anti-LGBTQ censorship as a means to “protect children” from so-called ‘wokeism’ and ‘gender ideology.’ Being that an age verification measure can be structured in a manner that is so punitive and restrictive, providers of non-pornographic sexual wellness and health information could fall victim to private tort action and intervention by the state for disseminating information that includes crucial sexual health and wellness material. LGBTQ advocates have also pointed out that an age restriction on social media websites, like in Utah, could prohibit the ability of young people looking for information and resources that could be life-changing. While this is a fear, it isn’t so far-fetched to consider.

Let’s consider laws that require pornography filters to be installed on mobile devices again. I mention in another Techdirt column that content filters aren’t consistent and could lead to the “under-” and “over-blocking” of content that is legitimately obscene to minors or it is actually dealing with health education, LGBTQ subject matter, or in dealing with youth relationships.

Age verification laws negatively impact young people and adults equally. When this type of data is shared, there is very little that users have control over when their data is handled. Some of the laws do have guidelines for the retention of data but the risk of a catastrophic security incident still hangs over the entire operation. Additionally, users are forced to favor the trust of companies that they have never heard of and are at the whim of as approved vendors that were ultimately preselected to manage the entire data business related to verification. That is kind of what has happened in Louisiana when they adopted their porn age verification law. In order to access porn in the state, residents and visitors must submit their identification cards to LA Wallet – a little known outfit that develops a mobile digital driver license application for the state government.

This touches on the prospect of targeting otherwise innocent websites and subjecting them to court costs just to defend their content that I mentioned earlier. It’s a tool that is ripe for legal abuse by those who view the LGBTQ community as a “mental disorder” or nothing but a bunch of “perverts” all in the name of fighting “woke”. In the end, it is a method to suppress certain communities who are part of our broader society. Canada’s age verification laws will be no different as there are no provisions protecting against fraudulent claims against innocent websites.

The next exchange really is out of left field:

Will age verification simply redirect Internet searches and web traffic to illegal porn sites that do not check the age of their users?

Large pornographic platforms and other opponents of age verification sometimes claim that imposing age checks on online pornography will cause age-verified sites to become less popular as users refuse to access them (thus raising bounce rates) and that illegal, unverified sites will feature more prominently on Google and other search engines if their bounce rates are lower. But that is incorrect. As Colin McKay, of Google Canada, testified, search engines attach more importance to the illegality of a web site than to its bounce rate when delivering search results. As a consequence, porn web sites that do not implement age verification mechanisms, in violation of the law, would actually be disadvantaged in Internet search results.

First of all, I have been following this debate for months. I have never heard of this argument against age verification until I read it in this page. So, it’s questionable whether this is even a widely adopted criticism of the bill.

Second of all, even if this were a valid counterargument, the censorship provisions in this bill would override such issues because accessing the website would theoretically be blocked anyway. So, I view Google rankings as kind of a moot point.

The next exchange is quite the hoot:

How can such a bill work? Won’t minors simply get around age verification using VPNs or other means?

No law is ever perfect. Even in the real world, minors are sometimes able to obtain alcohol, tobacco and pornographic materials despite laws designed to prevent this. We should expect similar results online. That said, as age verification expert John Carr notes: It is a convenient myth that every child is a super-cool internet user who knows every technical trick in the book and wants to break every rule or ignore every boundary. (…) The evidence points in a different direction and suggests that, in fact, most kids do not know how to get around most blocks and even among those who do only a small proportion (6%) actually bother.

I’ll give you a moment to stop laughing. The answer is literally just saying that the kids these days are too stupid to figure this out and will just give up most of the time. This while admitting that VPNs are a viable way of circumventing such laws. This completely ignores history about “kids” and their file-sharing habits. Once a road block is put in place, it motivates people to circumvent such a roadblock. For instance, in 2018, when it became evident that network neutrality was going to get repealed in the US, VPN adoption soared. Even if you think that VPNs charging is more than enough to stop them, there’s still TOR that is distributed for free to users. The answer provided in the FAQ doesn’t get any more naive than this.

Astonishingly, the FAQ went on to say this:

Why should the government get involved with controlling what kids access on the Internet? Isn’t that the responsibility of parents?

Parents have a primary responsibility to educate their kids and supervise their online habits. School sex education programs are also critical. But this does not mean the government should abdicate all responsibility for protecting children. Parents also have a duty to educate their kids about alcohol, tobacco and gambling, but this in no way prevents the government from adopting laws to require businesses to verify the age of their customers. Internet filters have limited effectiveness. In the age of mobile phones and free porn sites, parents have become almost completely powerless to supervise their children’s online activities. The case for targeted government intervention is clear.

So, in other words, according to this FAQ, parents are completely worthless and so are filtering technology. This answer is a slap in the face of parents all over, plain and simple. To use that as an excuse for heavy handed censorship is also an insult.

From there, the FAQ says this:

What public support is there for such a law? What do the experts think?

Bill S-210 is supported by the National Council of Women of Canada, the Canadian Centre for Child Protection, the International Centre on Sexual Exploitation, the Québec Association of pediatricians, the Digital Governance Council and several others. Many other associations and experts have expressed support for Bill S-210 or its predecessor (Bill S-203), including the Canadian Pediatric Society, the Canadian Academy of Child and Adolescent Psychiatry, the London Abused Women Center, la CLES and others. Bill S-210 is a non partisan bill that passed with no opposition in the Senate and is supported by four out of the five parties represented in the House of Commons: the NDP, the Bloc Québécois, the Green Party and the Conservative Party, along with 15 Liberal MPs.

The bill is also opposed by OpenMedia, Action Canada for Sexual Health and Rights, BC Civil Liberties Association, BC Coalition of Experiential Communities, Centre for Law and Democracy, Erotic Service Providers Legal Education and Research Project (ESPLERP), Ligue des droits et libertés, Privacy & Access Council of Canada, Brenda McPhail (Director of Executive Education, Master of Public Policy Program, McMaster University), and Michael Geist (University of Ottawa). Of course, who is counting here?

Have other jurisdictions done this?

Yes. In fact, the number of jurisdictions implementing meaningful age verification processes for online pornography is increasing quickly. The European Union recently adopted such a rule. Germany has had strong age verification laws since 2002 and all challenges to the law have failed. France adopted an age verification law in 2020 and is in the process of strengthening it. In the fall of 2023, the United Kingdom adopted its Online Safety Act that includes significant age verification obligations for providers of pornographic content. Spain recently moved in the same direction. In the United States, the states of Louisiana, Virginia, North Carolina, Texas and others have passed age verification laws with overwhelming bipartisan support. A challenge to the Louisiana law was rejected in October 2023. In Texas, the Court of Appeals for the Fifth Circuit recently allowed the Texas age verification law to take effect. A dozen other U.S. states are currently considering age verification bills. There is significant, worldwide, non-partisan momentum in favour of these child protection measures.

We are aware of the Texas ruling which apparently put the law into effect with absolutely no explanation whatsoever. The ruling has exasperated legal experts and observers since the lower court declared the bill unconstitutional with a very detailed reason why.

Further, the point that everyone else is doing it, so should we is incredibly poor reasoning to push such a law in the first place.

Ultimately, the FAQ page is chalk full of misinformation, disinformation, and misleading statements. Still, it’s nice to be able to debunk a whole suite of wild claims in one convenient article. On the plus side, it proves, yet again, that there is no real viable defence for such laws in the first place. If this is the best supporters can come up with, then I am more confident than ever that my own personal opposition to the bill is well founded.

Drew Wilson on Twitter: @icecube85 and Facebook.