Safety by Design: How platforms can reduce harm without more surveillance

Online safety isn't a choice between surveillance and doing nothing. Let’s talk about how platforms can be safer for kids and everyone without using age verification measures.

Most people living in Canada agree on one thing regarding online platforms: they should be safer. Children shouldn't be pushed toward harmful content by recommendation algorithms. People shouldn't have to endure frauds, scams, and harassment just to participate online. Illegal content shouldn't spread quickly just because platforms haven’t bothered to stop it.

These concerns are at the heart of Bill C-34, Canada's proposed Safe Social Media Act. The bill introduces an important principle: platforms have a responsibility to reduce foreseeable harms on their services. It puts on them a duty to protect children, to act responsibly, and to be transparent – and in most cases measures their success by overall systemic outcomes that follow, not by requiring they remove or fail to remove specific content. This "duty of care" approach is something OpenMedia and many digital rights advocates have supported for years.

But the bill also proposes broad age-verification requirements and restrictions on young people's access to social media – heavy-handed approaches that have raised concerns and opposition among privacy experts, researchers, and civil liberties advocates. These measures could force the creation of new surveillance systems without addressing the design choices that contribute to online harms in the first place. Fortunately, there is another approach: Safety by Design. More than theoretical, a Safety by Design approach has many concrete features that can improve our online experiences, and they should be at the center of the debate.

“Why I Changed My Mind About Age-Gating and Social Media Bans”

When psychologist Candice Odgers first began studying adolescents and technology nearly twenty years ago, she believed age restrictions made sense to reduce online harms. Today, after years of research and conversations with experts in privacy, internet governance, and child development, she has reached a different conclusion.

Candice Odgers reflects in her substack that “Eventually, I came to believe that mandatory age verification and blanket social media bans are likely to create a new set of problems, while failing to address the issues they are trying to solve.” She explains that age verification “forces all of us to hand over our sensitive data to companies who have repeatedly shown that they are unwilling or unable to protect it”, that considering the experiences in other countries “young people are telling us that they can and will likely get around the bans”, and that the “bans may even make things worse by pushing teens into less regulated and less safe spaces online.”

In reality, age verification mainly changes who gets through the door, not how safe the space is once you’re in. Teens who want to will continue to be able to get into by different known workarounds, while everyone will have to pay a toll with our ID, face recognition, or other invasive mechanisms to verify our age and identity. Instead, safety by design changes what happens once people are inside.

Safety by Design: Where Are the Concrete Requirements?

The White Hatter is an educational company that facilitates workshops on technology safety and privacy subjects, and has already reached 700,000 kid and teenager students in Canada. Its co-founder and instructor, Darren Laur says: “I agree with about three-quarters of the legislation. But I disagree with the remaining quarter, like the age verification and the removal of powers from the Privacy Commissioner of Canada. We don’t agree with age gating platforms. If I am 15 today, I can’t go on Snapchat, but if tomorrow I turn 16 I would be able to go, despite the dangers not changing, they are identical.”

He highlights the bill name checks safety by design, but is not including it properly: “We still don’t know what the regulations are going to be, and those regulations cover the safety by design features. We only know what the bill looks like; but in order for the legislation to have any punch, we need to know what the regulations are going to be, and they are not going to be created until the Commissioner is put in place.”

He also worries the legislation “is removing parents and caregivers from the equation. I know what is the best for my kid, so I should have the say of if my kid should have access or not to whatever social media platform. The problem with age verification is that there is no technology which is 100% effective. So, we are now giving up biometric private information to third party vendors and big tech, and do we really want to be doing that? This is going to affect all Canadians. It doesn’t make a lot of sense.”

But What Would Safety by Design Actually Look Like?

After reviewing articles and experts' research, but also practical experiences in some social media platforms about this approach, we wanted to share concrete features that aim to make online platforms safer:

1. Give Users More Control

Algorithms shouldn't be mysterious. Platforms should transparent them and allow users to:

Switch to chronological feeds – no manipulative curation, just the people you follow in the order they post;
Get explanations of “why I am seeing this” in algorithmic feed;
Mute topics we don’t want to see;
Reduce recommendations we don’t appreciate;
Control notifications from the platform and other users.

2. Slow Harmful Content Before It Goes Viral

Not every potentially harmful post should be deleted immediately. Sometimes simply slowing its spread is enough. Platforms already use techniques like:

Warning labels;
"Read before sharing" prompts;
Limiting mass forwarding;
Temporary friction before reposting.

These small interruptions can dramatically reduce viral misinformation without restricting legitimate expression.

3. Build In Protection Against Fraud and Scams

People shouldn't have to become cybersecurity experts to use online platforms safely. Safety by design can make scams harder to launch, spread, and scale. Platforms could:

Make reporting scams, harassment, and illegal content easy to find with a clear “Report” button or link;
When users report harmful content, let them quickly save a screenshot and the content’s URL, username, and timestamp before it can disappear;
Tell users what happens after they report something and give them a way to appeal decisions;
Detect suspicious links, accounts, and impersonation attempts;
Warn users before they interact with potential scams;
Add friction before sending money or sensitive information;
Limit mass messaging from new or suspicious accounts;
Make scam reporting faster and easier.

Some platforms do some of these things already; but implementation is spotty at best. A common floor of safe design practices could prevent scams before users become victims, not simply ask people to protect themselves after the harm occurs.

4. Better Protection Against Harassment

One abusive message can drive someone offline. Safety by design means making abuse harder – not asking victims to work harder. Examples include:

Limiting unsolicited messages;
Stronger blocking tools;
Detecting coordinated harassment;
Preventing unknown adults from messaging children;
Warnings before sending abusive messages.

Digital literacy remains essential, but product design can prevent many harms before they occur.

4. Privacy Should Be The Default

Safety shouldn't come at the expense of privacy. Platforms can protect young users without collecting more personal information. Examples include:

Private accounts by default;
Geolocation turned off;
Minimized data collection;
Stronger protections against unwanted contact;
Deleting unnecessary information.

This is known as privacy by design – building privacy into products from the beginning rather than adding it later. So, if needed the user can even activate these tracking features, such as geolocation in their social media for example, but they wouldn't be the default setting.

5. Age-appropriate Experiences, Not Blanket Bans

Children don't necessarily need a completely different internet. They do need different defaults. Platforms could automatically:

Disable autoplay;
Reduce infinite scrolling;
Strengthen messaging protections;
Hide potentially risky recommendations;
Limit contact from unknown adults;
Parental control.

6. Hold Platforms Accountable, Not Just Users

Instead of asking every person living in Canada to prove their identity, governments could expand on the best parts of Bill C-34. This means requiring companies:

Assess foreseeable risks to their users;
Conduct safety testing before launching new features;
Publish transparency reports;
Give researchers access to platform data while protecting user privacy;
Explain how recommendation systems work;
Undergo independent audits.

Just as other companies already test products for security and reliability, multi-billion dollar online platforms should be expected to test them for foreseeable systematic harms to millions of Canadians.

Age Verification Systems: Are All The Same?

Age assurance is not one-size-fits-all. If policymakers decide it is necessary, the approach should be informed by privacy experts, child-safety researchers, technologists, civil liberties groups, and young people – not by industry or one-size-fits-all solutions. Different approaches carry different risks:

Government ID checks: Verify age using a passport or driver's licence.
Risks: data breaches, identity theft.
Biometric age estimation: Estimates age from a face or other biometric data.
Risks: sensitive data collection, inaccurate in biased ways against some identities, misuse of the resulting data.
Financial checks: Use credit cards or other financial information.
Risks: financial data exposure, fraud, and financial profiling.
Third-party age tokens: Confirm an age category through a third party entity and without necessarily revealing identity.
Risks: data breaches, potential tracking.
On-device age estimation: Estimates age locally without sending biometric data to a platform.
Risks: inaccuracies and device security vulnerabilities.
Zero-knowledge proofs: Can prove someone meets an age threshold without revealing their identity or birth date.
Risks: the less invasive solution available – but still risking identity tracking or linkability, depending on implementation.

Canada Has An Opportunity To Lead

Bill C-34 has started an important national conversation – but Canadians need to decide how that conversation ends. The question isn't simply whether Canada should regulate online platforms; most people want that. It's how to regulate to make the Internet better for ordinary people that matters. Safety by design recognizes that safer online spaces don't begin with collecting more information about users, manipulative algorithms and addictive designs relying on polarization and dopamine rushes. They begin with building better, more thoughtfully designed products. Platforms should be accountable for the problems with systems they create – not users in Canada who want to participate online.

As Parliament continues studying Bill C-34, Canada has an opportunity to become a global leader by encouraging innovation that reduces harm while protecting privacy, free expression, and children's rights. Inviting experts in the subject, and creating a legislation that requires to prove and test safer features. Because the safest internet isn't one where everyone is constantly being identified. It's one that was designed to be safer from the very beginning. Join the debate and tell your MP to fix online platforms, without banning or surveilling users!