Authors
Partner, Privacy and Data Management, Toronto
Associate, Privacy and Data Management, Toronto
Key Takeaways
- Bill C-16, the Protecting Victims Act, would redefine “Internet service” to clarify that the Mandatory Reporting Act applies to all types of Internet services, including online platforms, social media and other application-based services, and that providers with a “connection to Canada” must report child sexual abuse and exploitation material offences to law enforcement.
- The bill would require Internet service providers to include transmission data when reporting offences involving material that is “manifestly” child sexual abuse and exploitation material to law enforcement.
- It would also centralize mandatory notifications to a designated law enforcement body and extend the preservation period for computer data related to child sexual abuse and exploitation material offence reports from 21 days to one year.
The Government of Canada has introduced Bill C-16, the Protecting Victims Act,[1] to “protect victims and survivors of sexual violence, gender-based violence, and intimate partner violence, and to keep our kids safe from predators.”[2]
Bill C-16 proposes a broad range of criminal law reforms, including a suite of targeted amendments to An Act respecting the mandatory reporting of Internet child sexual abuse and exploitation material by persons who provide an Internet service (Mandatory Reporting Act)[3] that clarify the Act’s scope of application and update law enforcement notification obligations relating to child sexual abuse and exploitation material[4] (CSAEM) for online services.
Notably, Bill C-16 reprises key elements of the Mandatory Reporting Act amendment package previously proposed under Bill C-63 (the Online Harms Act), signaling the federal government’s intent to prioritize targeted CSAEM reforms over the development of a broader online harms regime.[5]
The bill was introduced and received first reading in the House of Commons on December 9, 2025, and was ordered for second reading at the next sitting of the House.[6]
Background
Canada’s current mandatory reporting framework was established in 2011.[7] Under the Mandatory Reporting Act, “Internet service” providers must
- report to the Canadian Centre for Child Protection (C3P) if advised of an Internet address where CSAEM may be available to the public[8]
- notify a police officer and preserve related computer data for 21 days if they have reasonable grounds to believe their service is or has been used to commit a CSAEM offence[9]
For further information on compliance obligations under the Mandatory Reporting Act, please contact the authors or subscribe to the Osler AccessPrivacy Knowledge Portal.
1. Scope and jurisdiction
A. Clarified definition of ‘Internet service’
The Mandatory Reporting Act currently defines an “Internet service” as “a service providing Internet access, Internet content hosting or electronic mail.”[10]
The Act’s application was intended to apply to “all persons who provide an Internet service to the public”, such as content hosting services, social media platforms, search engines and email services.[11] However, the Act has reportedly been “interpreted by many to apply to a narrow definition of Internet Service Providers.”[12]
Bill C-16 seeks to clarify that the Act applies to “all types of internet services in Canada, including online platforms, social media, and other application-based services”[13] by redefining “Internet services” to explicitly “include” services that
- provide Internet access
- provide Internet content hosting, regardless of the originator of the content or how the content is made accessible
- facilitate interpersonal communication over the Internet, including providing electronic mail[14]
The Governor in Council would also be authorized to specify the services included in this definition via regulations.[15]
If enacted, this amendment would provide greater clarity on the Act’s application and confirm that a wider range of platforms are in scope.
B. ‘Connection to Canada’
Historically, Canadian law enforcement has faced jurisdictional challenges when investigating online crimes and enforcing the Act — for example, where platforms with a presence in Canada are incorporated or have servers abroad.[16]
Bill C-16 would introduce an express provision stating that law enforcement notification obligations apply to persons who provide Internet services to the public and have a “connection to Canada,” including because they
- have possession or control of a computer system[17] located in Canada
- are corporations incorporated in Canada or have their head office in Canada
- are partnerships or unincorporated associations or organizations with a head office in Canada[18]
This provision would codify the jurisdictional reach of mandatory law enforcement notification obligations to include foreign-incorporated entities with digital infrastructure or headquarters in Canada.
2. Law enforcement notification and evidence-handling obligations
Bill C-16 also proposes changes to operational obligations regarding law enforcement notifications and related evidence handling.
A. Centralized reporting
Currently, providers may notify suspected CSAEM offences to an “officer, constable or other person employed for the preservation and maintenance of the public peace.”[19] In other words, the Act currently allows reporting to any law enforcement across the country.[20]
Bill C-16 would centralize mandatory notifications to a specific “law enforcement body designated by the regulations.”[21] While the body would be determined by regulation, the RCMP has previously recommended designating the National Child Exploitation Crime Centre (NCECC) under the Act.[22]
If enacted, this amendment would offer greater certainty for providers and would streamline the notification process by establishing a single point of contact, while potentially requiring some providers to update internal routing workflows to align with the new agency designation.
B. Mandatory ‘transmission data’
Where providers have “reasonable grounds to believe” that their service is being or has been used to commit a CSAEM offence, notifications to law enforcement must be in writing and must include prescribed information such as the CSAEM offence at issue, a description of the material that appears to be CSAEM and its format, and a description of any other relevant evidence.[23]
Bill C-16 would introduce a new tier of notification requirements for material that is “manifestly” CSAEM. In such cases, providers would be required to include related transmission data[24] that could assist in the investigation of the offence.[25]
If enacted, providers would be required to distinguish between general suspected offences and “manifest” offences and establish processes for disclosing available transmission data for the latter.
C. One-year data preservation
The mandatory preservation period for computer data related to a law enforcement notification is currently 21 days.[26]
Addressing concerns raised regarding the loss of evidence due to short retention periods,[27] Bill C-16 would extend this period to one year after the day on which the notification is made.[28]
This extension would require service providers to adjust data retention and destruction policies and practices to ensure that relevant evidence is preserved for the longer 12-month period.
Osler Online Harms Series
This Update is the third installment in Osler’s Online Harms Series, tracking Canada’s evolving framework for online safety, platform regulation and children’s privacy. Read earlier installments: Insights into Canada’s development of children’s privacy framework (July 21, 2025) and Canada’s new Online Harms Act (C-63): what you need to know (March 1, 2024).
[1] Bill C-16, An Act to amend certain Acts in relation to criminal and correctional matters (child protection, gender-based violence, delays and other measures), 1st Sess., 45th Parl., 2025.
[2] Department of Justice Canada, “Canada overhauls Criminal Code to protect victims and keep kids safe from predators” (news release: December 9, 2025).
[3] An Act respecting the mandatory reporting of Internet child sexual abuse and exploitation material by persons who provide an Internet service, S.C. 2011, c. 4 (Mandatory Reporting Act).
[4] Bill C-291, An Act to amend the Criminal Code and to make consequential amendments to other Acts (child sexual abuse and exploitation material), S.C. 2024, c. 23 (assented to October 10, 2024; in force October 10, 2025). Bill C-291 initially proposed replacing “child pornography” with “child sexual abuse material” (CSAM) to more accurately describe the material, recognize the victimization of children, and align with recommended terminology (see, e.g., Terminology Guidelines for the Protection of Children from Sexual Exploitation and Sexual Abuse, Terminology and Semantics Interagency Working Group on Sexual Exploitation of Children, ECPAT International, 2016 [PDF]). At committee, “and exploitation” was added to ensure the statutory terminology reflected the full scope of the existing definition and offences under s. 163.1 of the Criminal Code.
[5] Bill C-63, An Act to enact the Online Harms Act, to amend the Criminal Code, the Canadian Human Rights Act and An Act respecting the mandatory reporting of Internet child pornography by persons who provide an Internet service and to make consequential and related amendments to other Acts, 1st Sess., 44th Parl., 2024, Part 4, ss. 45–51. Bill C-63 died on the order paper when Parliament was prorogued on January 6, 2025.
[6] House of Commons, Journals, 45th Parl., 1st Sess., No. 70 (December 9, 2025).
[7] Bill C-22, An Act respecting the mandatory reporting of Internet child pornography by persons who provide an Internet service, 3rd Sess., 40th Parl., 2011 (assented to March 23, 2011), S.C. 2011, c. 4.
[8] Mandatory Reporting Act, s. 2; Internet Child Pornography Reporting Regulations, SOR/2011-292 (Regulations), ss. 2, 10. A provider may also meet its obligation to report to C3P by complying with the CSAEM reporting laws of another province or foreign jurisdiction (Mandatory Reporting Act, s. 9).
[9] Mandatory Reporting Act, ss. 3–4; Regulations, ss. 11–12.
[10] Mandatory Reporting Act, s. 1.
[11] Dominique Valiquet, “Legislative Summary – Bill C-22: An Act respecting the mandatory reporting of Internet child pornography by persons who provide an Internet service,” [PDF] Publication No 40-3-C22-E (Ottawa: Library of Parliament, 2010; updated 2011); Department of Justice, “Government of Canada Introduces Legislation Protecting Children from Online Sexual Exploitation” (news release, May 2010); Department of Justice, “Backgrounder: Protecting children from online sexual exploitation” (May 2010) [archived by Wayback Machine: March 5, 2014].
[12] Public Safety Canada, “Mandatory Reporting Act and Jurisdiction Challenges” in Parliamentary Committee Notes: Minister Blair’s Appearance Before the Standing Committee on Access to Information, Privacy and Ethics (ETHI) (April 12, 2021).
[13] Department of Justice Canada, “Backgrounder: Protecting Victims Act: Proposed legislation to protect victims and keep kids safe from predators” (December 9, 2025).
[14] Bill C-16, s. 180.
[15] Bill C-16, s. 184.
[16] House of Commons, Standing Committee on Access to Information, Privacy and Ethics, “Ensuring the Protection of Privacy and Reputation on Platforms such as Pornhub” [PDF] (June 2021); “Mandatory Reporting Act and Jurisdiction Challenges.”
[17] As defined in Criminal Code, s. 342.1(2).
[18] Bill C-16, s. 181.
[19] Mandatory Reporting Act, s. 3.
[20] “Ensuring the Protection of Privacy and Reputation on Platforms such as Pornhub” [PDF].
[21] Bill C-16, s. 181, 184.
[22] “Ensuring the Protection of Privacy and Reputation on Platforms such as Pornhub” [PDF].
[23] Mandatory Reporting Act, s. 3; Regulations, s. 11.
[24] As defined in Criminal Code, s. 487.011.
[25] Bill C-16, s. 181.
[26] Mandatory Reporting Act, s. 4(1).
[27] “Mandatory Reporting Act and Jurisdiction Challenges.”
[28] Bill C-16, s. 181.
