When news broke that a teenager accused of a school shooting in British Columbia had been exchanging troubling messages with OpenAI’s ChatGPT—and that the company had flagged that content internally but never alerted police—something shifted in Canada’s national conversation. The February incident, which claimed nine lives, ignited outrage not just over gun violence but over the silent, unregulated role of artificial intelligence in shaping dangerous behavior. Within months, that public pressure forced the government to act. This week, Canadian legislators introduced a bill aimed at reining in AI chatbots and restricting social media use for children under sixteen, echoing a similar ban in Australia. On paper, it sounds like a decisive step. But after reading through the bill and speaking with several academics and legal experts, I have to wonder: does this legislation actually address the problem, or does it just look like it does?
The proposed law would create a new digital regulator with the power to require chatbots to reduce the risk of users seeking harmful content. Platforms would also have to include crisis intervention steps when conversations drift into topics like suicide or self-harm. That sounds responsible, even necessary. But the bill has already drawn sharp criticism for what it leaves unsaid. Evan Light, an associate professor at the University of Toronto who studies technology and privacy, told reporters he was shocked at how underdeveloped the legislation appears. He said, “If this is the preview of a law, I do not have high hopes for something that will be useful in a practical sense.” His concern is not abstract. He pointed out that restrictions on internet use can be easily bypassed with VPNs, or virtual private networks, which mask a user’s real location and identity. A teenager determined to access a banned chatbot could do so in minutes. And if young users migrate to less regulated, possibly more dangerous platforms, have we actually made anyone safer?
Then there is the timeline. The bill proposes creating an entirely new regulatory agency, drafting detailed rules, and then enforcing them across a fast-moving industry. Analysts warn that by the time the framework is fully operational, AI chatbots will have evolved again. That lag is not just an inconvenience; it could render the entire effort symbolic rather than functional. Light compared it to trying to lock a door that has already been replaced by a window. You feel like you have done something, but the opening remains.
Canada’s Identity and Culture Minister Marc Miller defended the bill during a news conference on Wednesday. He acknowledged the difficulty of balancing privacy protections with the need to regulate. He also noted that the proposed law does not apply to private messaging apps like WhatsApp or Signal, a loophole that critics say could become a gaping hole. Miller said that companies meeting criteria set by the new regulator would be able to get an exemption from the social media ban, which raises another question: who decides which companies are trustworthy, and based on what evidence? Miller pointed directly to the Tumbler Ridge shooting as a catalyst, adding that OpenAI “made an egregious human error” by not reporting the suspect’s flagged chats to police. He said the government is now pushing to make social media and AI chatbots “safer by design.”
That phrase—safer by design—sounds reassuring, but designing safety into a system whose primary economic incentive is engagement is not simple. Recommendation algorithms reward time spent on platform, not caution. Crisis intervention pop-ups may appear, but a user who wants to ignore them will. A chatbot cannot physically stop anyone from acting on harmful thoughts, and the bill does not propose that it should. Instead, it asks platforms to reduce risk, a vague standard that leaves room for interpretation. One company’s risk reduction might be another’s checkbox compliance.
There is also the question of children bypassing the system entirely. The bill’s age verification requirements, while well intentioned, assume that young people will comply or that companies will reliably enforce bans. Anyone who has watched a teenager navigate a school firewall knows that assumption is shaky. VPNs, burner email accounts, and borrowed devices make a mockery of most access restrictions. If the law pushes curious or at-risk teens toward unmoderated corners of the internet, the unintended consequence could be more harm, not less.
From a trust standpoint, the bill does some things well. It acknowledges that platforms have a responsibility to report threats. It admits that current voluntary measures have failed. And it creates a formal pathway for crisis intervention, which is more than many countries have attempted. But trust also requires honesty about limits. The legislation does not explain how it will enforce rules against platforms headquartered outside Canada. It does not address the cost of compliance for smaller companies, which might simply withdraw from the Canadian market rather than redesign their safety systems. And it does not resolve the fundamental tension between privacy and surveillance: to flag harmful chats, the regulator would need access to those chats, which raises its own set of rights issues.
