Information Technology · Thursday, 11 June 2026

01 · Briefing · what happened

Canada moves to ban social media for under-16s, and the fix means checking everyone's age

Information Technology 5 min 80 sources

A new Canadian bill would bar social media for children under 16 and set safety rules for AI chatbots — the latest in a wave of age-based bans that all run on one quiet mechanism: verifying how old every user is. Plus the EU forces WhatsApp open to rival AI assistants, and a bad week for enterprise security.

Key takeaways

Canada introduced a bill to ban social media for under-16s and regulate AI chatbots, joining Australia, Greece, and others — but enforcing an age ban means verifying the age of every user, not just children.
The EU used a rare emergency power to force Meta to reopen WhatsApp to rival AI assistants for free, treating access to the messaging app as a doorway to European consumers worth protecting before the case even ends.
A cluster of enterprise breaches — Oracle PeopleSoft, ServiceNow, North Korean remote-worker infiltration — landed as US regulators cut the deadline to patch known flaws to three days, citing faster AI-assisted attacks.

Canada’s government introduced a digital safety bill on Wednesday that would ban social media for children under 16, with exemptions for platforms that meet certain safety standards [1]. It follows Australia, which in December became the first country to do it — and within a month of that law, social media companies collectively switched off the accounts of nearly 5 million teenagers [1].

The bill goes further than a ban. It would set up a digital regulator to write safety standards for AI chatbots — the conversational AI tools like ChatGPT that millions now talk to daily [1]. Companies that fail to comply face penalties of 3% of global revenue or up to C$10 million ($7.2 million), whichever is larger [1].

The timing is not accidental. The bill arrived weeks after families affected by one of Canada’s worst mass shootings sued OpenAI, alleging the company knew through ChatGPT that the alleged attacker was planning the attack and did not warn police [1]. “Social media platforms and AI chatbots are designed to capture attention,” said Marc Miller, the minister of Canadian identity and culture. “They do not support healthy childhood development” [1].

Canada is not alone, and its approach is broader than most. Greece will bar under-15s from January 2027; France, Denmark, and Poland are all weighing tighter rules [1]. A University of Toronto privacy researcher, Brett Caraway, said the Canadian plan aims at “a redesign of the social media ecosystem to make it safer for children,” where Australia’s law is mainly about blocking access [1].

There is a catch buried in every one of these laws, and it is the same catch each time. To stop under-16s from signing up, a platform has to know who is under 16 — which means it has to check the age of everyone who signs up. The ban targets children; the verification lands on the whole population. Today’s lesson is about that mechanism, and the costs that travel with it.

The platforms are already moving — and so is the timeline

Companies are not waiting for the law. On the same day, Snapchat said users aged 13 to 15 will only be able to share its short-video Spotlight posts with people who follow them back, and under-16s get a separate profile that hides metrics like favorite counts — the numbers that turn posting into a popularity contest [2]. Instagram has made similar moves for teen accounts in recent years [2].

But the government’s own timeline shows how slow law is next to product. Officials said in a technical briefing that the bill could take a year to pass — and another 18 months to stand up the digital regulator once it does [1]. Carney’s government holds only a slim majority and Parliament breaks for summer recess soon [1]. The platforms can change a setting overnight; the state takes two and a half years to build the office that would check them.

The angle: if you build or run any consumer product with a sign-up flow, age assurance is becoming a default requirement, not an edge case. The architecture question — do you guess age from behavior, ask for a document, or buy a third-party check — is now a design decision with legal weight in a growing list of countries.

The EU pries WhatsApp open for rival AI

In Europe, regulators used a rare emergency power. The European Commission ordered Meta to restore free WhatsApp access for AI chatbots made by rival providers, while it finishes an antitrust investigation into whether Meta abused its dominance by locking competitors out [3]. It is only the second time in over 20 years the EU has reached for this interim measure [3].

The backstory: Meta banned third-party chatbots from WhatsApp, then in March let them back “for a fee” — which the Commission viewed as a fresh violation [3]. Now Meta must reinstate access on the original terms, “notably free of charge,” by June 15th [3]. Ignoring the order risks fines of up to 10% of annual revenue — roughly $20 billion on 2025 earnings [3]. Competition commissioner Teresa Ribera framed the stakes plainly: “competition can be lost long before a final decision is adopted” [3].

Why it matters: WhatsApp is how a huge share of Europe reaches the internet. Whoever controls who can build on it controls a doorway to consumers — which is exactly why the regulator moved before its own investigation concluded.

A rough week for enterprise security

Three separate enterprise-software problems surfaced. Cybercriminals claim to have breached Oracle PeopleSoft servers — the HR and finance software many large organizations run — at more than 100 organizations [4]. ServiceNow, the workflow platform used across big companies, told customers a bug left some of their data exposed to the open internet [5]. And CrowdStrike, a security firm, said North Korean operatives were behind nearly half of the hacks it tracked against the US tech industry — often by getting hired as remote workers, not by breaking in [6].

Washington responded to the broader trend. US authorities shortened the window companies have to fix certain known vulnerabilities to three days, citing AI tools that let attackers find and exploit flaws faster than before [7].

The angle: the common thread is not a single flaw but speed. If attackers can weaponize a disclosed vulnerability in hours, the old patch-it-this-quarter rhythm is gone. The dependency worth auditing this week is any third-party platform holding your data — PeopleSoft, ServiceNow, or otherwise — and how fast its vendor ships a fix.

02 · Lesson · why it matters

To keep the few out, you have to check everyone

A rule aimed at one small group is enforced on the whole group it came from — to find the children, the system has to inspect every adult too.

A rule with a hidden second clause

Canada’s new bill says something simple: people under 16 cannot use social media. Australia already does this. Greece starts in 2027. France, Denmark, and Poland are weighing it. The sentence is easy to say and easy to agree with.

But read it again as a machine would. “People under 16 cannot use social media” only works if the platform can tell who is under 16. And the only way to know that one person is under 16 is to know the age of everyone who walks in. The rule names children. The enforcement falls on all of us.

This is the part that doesn’t make the headline. A targeted rule almost always carries a hidden second clause, and the second clause is universal.

You cannot sort a crowd without inspecting the crowd

Think about what “check ages” actually requires. A bouncer who only ever cards people who look young is making a guess, and guesses are wrong often enough that the law won’t accept them. To enforce a hard line at 16, the platform has to verify age — reliably, for the marginal cases, which means for everyone, because you don’t know in advance who the marginal cases are.

There is no filter that touches only the thing being filtered. To remove the under-16s, the system has to pass every single user through the gate, look at each one, and decide. The 45-year-old proves she is 45 so the platform can confirm she is not 15. The cost of finding the few is paid by the many. That is not a flaw in the law. It is how sorting works: to separate a subset, you have to examine the whole set.

What “verify” smuggles in

Here the abstract gets concrete. To check age at scale, a platform needs one of three things. It can guess from your behavior and your face — scanning a selfie to estimate age, which is invasive and often wrong. It can demand a document — a driver’s license, a passport, a government ID uploaded to a private company. Or it can route you through a third-party verification service that does the checking and keeps the record.

Every one of those options creates something that did not exist before: a database that links a real human identity to an account. Before the rule, you could be a handle. After it, somewhere there is a row that says this person, with this ID, is this account. That row is the price of the gate, and adults pay it to keep children out.

The cost travels to people the rule never named

Now look at who is inside this. The rule was written about teenagers and their mental health — a real problem, with families in court and ministers naming anxiety and isolation. But the verification system it forces into being reaches everyone who signs up for anything.

It reaches the adult who wanted to read the news without handing over a passport. It reaches the small platform that now has to buy an age-check service it can’t really afford, while the giants absorb the cost easily — so the rule meant to discipline big tech quietly raises the wall that protects them from small competitors. It reaches the verification company you’ve never heard of, now holding millions of IDs and becoming a target worth breaking into. This same week, hackers claimed to have breached one enterprise system at over a hundred organizations, and a security firm reported foreign operatives behind nearly half of US tech-industry intrusions. A new pile of identity records is a new thing for them to want.

None of those people are under 16. None of them were the point. The rule’s force still lands on them, because enforcement doesn’t respect the boundary the rule drew.

The shape you’ll see again

This pattern is not about social media. It is the shape of any rule that targets a subset of a population it cannot pre-identify.

A toll meant to catch out-of-state drivers reads every license plate. A screening meant to catch a few dangerous fliers searches every traveler. A tax rule aimed at the wealthy adds a form for everyone who has to prove they are not. A content filter meant to block a few bad actors inspects every message that passes. Each time, the named target is narrow and the enforcement is wide, because you cannot act on the few without first processing the many.

That doesn’t make the rules wrong. Protecting children is not a small thing, and the harms are real. But it means the honest question is never just “should we stop the bad case?” It is “what does it cost to find the bad case, and who pays it?” — because the answer to the second question is almost always “everyone, including people the rule was never about.”

What this leaves you holding

When you next hear a rule described by who it targets, you now have a second question to ask: how will anyone know who to apply it to? The answer is where the real cost lives, and it usually sits outside the headline, on people who were never mentioned.

You are one of them more often than you’d guess. The ban is about someone else’s kid; the ID upload is yours. Seeing that doesn’t tell you whether the rule is good — reasonable people will weigh a child’s safety against an adult’s privacy differently, and that’s theirs to weigh. It only tells you the bill is bigger than the part you can see from your seat, and that no one — not the minister, not the platform, not you — is standing where the whole of it is visible at once.

03 · Lab · your turn

The Age Gate

Run an age-verification gate on a mixed crowd and feel how catching a few children forces you to process — and keep records on — everyone.