Stop Bill S-209’s De-Anonymization of Every Canadian Adult


Stop Bill S-209’s De-Anonymization of Every Canadian Adult
The Issue
Bill S-209 is a mistake, plain and simple. It threatens every Canadian’s right to private, anonymous browsing.
Under this proposed law, any website that hosts “sexually explicit material”—from mainstream adult platforms to mental-health support forums and LGBTQ communities—would be required to collect government-issued IDs or facial scans before granting access. This bill could mean
1. Absolute De-Anonymization = Catastrophic Data-Breach Risk
Immutable Biometrics: Unlike passwords, you can’t “reset” your face if it leaks. A breach of the ID/facial-scan database would grant hackers lifelong keys to spoof your identity—undermining everything from bank logins to building security.
Scale & Sensitivity: Think Ashley-Madison- × 100. Bill S-209 covers every Canadian adult. If even 1% of the 30 million affected users suffer a breach, that’s 300,000 compromised identities—and likely far more once you factor in linked browsing logs.
Precedent Costs: The average cost of a data breach in 2024 was USD 4.45 million—and that’s for a single corporation, not a government-mandated super-registry loaded with biometrics and sensitive browsing histories.
2. Overbroad “Explicit” Definition → Mission Creep & Collateral Censorship
Wide Net: The bill’s language covers “any material that, in the opinion of the regulator, depicts sexual activities or organs for primarily sexual purposes.” That could include: Mental-health forums discussing self-harm triggers.
LGBTQ support groups sharing anatomy diagrams.
Educational sites with reproductive-health content.
ISP Black-Holes: Regulators can order ISPs to block entire domains if a single page violates the “explicit” rule. Overnight, Canadians might lose access to:
Peer-reviewed medical journals.
University art-history archives.
Crisis hotlines hosted behind shared subdomains.
3. Erosion of Charter Rights & Equity Violations
Equality & Mobility: The Charter of Rights and Freedoms guarantees equal access to services. Yet, millions of Canadians—those experiencing homelessness, survivors of abuse, recent immigrants—lack up-to-date photo ID. Bill S-209 erects a digital “ID checkpoint” that effectively bars them from essential online resources.
Freedom of Expression: Anonymous browsing underpins whistle-blowing, political dissent, and journalistic research. Requiring ID for “explicit” content chills speech far beyond adult entertainment.
4. Real Expert Alarm Bells
Michael Geist (University of Ottawa):
“S-209 presents a direct threat to privacy and free expression by institutionalizing biometric de-anonymization without meaningful oversight or accountability.”
Read his analysis here: www.michaelgeist.ca/2025/05/herewegoagain/
Electronic Frontier Foundation (EFF):
Warns that centralized biometric schemes are “inherently risky” and often violate data-protection best practices (e.g., data minimization, purpose limitation).
OpenMedia:
Argues that age-verification can be achieved via self-certification or credit-card tokenization without leaking personal identities.
Better, Privacy-Preserving Alternatives
Zero-Knowledge Proofs (ZKPs)
Users cryptographically prove they’re over a certain age without revealing birthdate or identity.
Decentralized Identity (DID)
Leverage blockchain-style credentials: you hold your own proof of age, and sites verify it against a public registry without storing your raw data.
Mobile Carrier Verification
Use age-verification APIs from telcos that confirm age brackets, not full birthdates or photos, and then immediately discard the input data.
Self-Declaration + Random Audits
Require a checkbox plus periodic site audits for compliance, rather than sweeping ID collection from every visitor.
This approach is unjust and unnecessary. There are better, privacy-preserving technologies that protect minors online without forcing adults to hand over sensitive personal information.
I believe Canadians deserve online safety without sacrificing privacy or free access to legitimate resources. That’s why I’ve started this petition. If you agree, please take a moment to sign and share it—your voice matters.
For those who want to read the bill itself, here it is: https://www.parl.ca/documentviewer/en/45-1/bill/S-209/first-reading
13,810
The Issue
Bill S-209 is a mistake, plain and simple. It threatens every Canadian’s right to private, anonymous browsing.
Under this proposed law, any website that hosts “sexually explicit material”—from mainstream adult platforms to mental-health support forums and LGBTQ communities—would be required to collect government-issued IDs or facial scans before granting access. This bill could mean
1. Absolute De-Anonymization = Catastrophic Data-Breach Risk
Immutable Biometrics: Unlike passwords, you can’t “reset” your face if it leaks. A breach of the ID/facial-scan database would grant hackers lifelong keys to spoof your identity—undermining everything from bank logins to building security.
Scale & Sensitivity: Think Ashley-Madison- × 100. Bill S-209 covers every Canadian adult. If even 1% of the 30 million affected users suffer a breach, that’s 300,000 compromised identities—and likely far more once you factor in linked browsing logs.
Precedent Costs: The average cost of a data breach in 2024 was USD 4.45 million—and that’s for a single corporation, not a government-mandated super-registry loaded with biometrics and sensitive browsing histories.
2. Overbroad “Explicit” Definition → Mission Creep & Collateral Censorship
Wide Net: The bill’s language covers “any material that, in the opinion of the regulator, depicts sexual activities or organs for primarily sexual purposes.” That could include: Mental-health forums discussing self-harm triggers.
LGBTQ support groups sharing anatomy diagrams.
Educational sites with reproductive-health content.
ISP Black-Holes: Regulators can order ISPs to block entire domains if a single page violates the “explicit” rule. Overnight, Canadians might lose access to:
Peer-reviewed medical journals.
University art-history archives.
Crisis hotlines hosted behind shared subdomains.
3. Erosion of Charter Rights & Equity Violations
Equality & Mobility: The Charter of Rights and Freedoms guarantees equal access to services. Yet, millions of Canadians—those experiencing homelessness, survivors of abuse, recent immigrants—lack up-to-date photo ID. Bill S-209 erects a digital “ID checkpoint” that effectively bars them from essential online resources.
Freedom of Expression: Anonymous browsing underpins whistle-blowing, political dissent, and journalistic research. Requiring ID for “explicit” content chills speech far beyond adult entertainment.
4. Real Expert Alarm Bells
Michael Geist (University of Ottawa):
“S-209 presents a direct threat to privacy and free expression by institutionalizing biometric de-anonymization without meaningful oversight or accountability.”
Read his analysis here: www.michaelgeist.ca/2025/05/herewegoagain/
Electronic Frontier Foundation (EFF):
Warns that centralized biometric schemes are “inherently risky” and often violate data-protection best practices (e.g., data minimization, purpose limitation).
OpenMedia:
Argues that age-verification can be achieved via self-certification or credit-card tokenization without leaking personal identities.
Better, Privacy-Preserving Alternatives
Zero-Knowledge Proofs (ZKPs)
Users cryptographically prove they’re over a certain age without revealing birthdate or identity.
Decentralized Identity (DID)
Leverage blockchain-style credentials: you hold your own proof of age, and sites verify it against a public registry without storing your raw data.
Mobile Carrier Verification
Use age-verification APIs from telcos that confirm age brackets, not full birthdates or photos, and then immediately discard the input data.
Self-Declaration + Random Audits
Require a checkbox plus periodic site audits for compliance, rather than sweeping ID collection from every visitor.
This approach is unjust and unnecessary. There are better, privacy-preserving technologies that protect minors online without forcing adults to hand over sensitive personal information.
I believe Canadians deserve online safety without sacrificing privacy or free access to legitimate resources. That’s why I’ve started this petition. If you agree, please take a moment to sign and share it—your voice matters.
For those who want to read the bill itself, here it is: https://www.parl.ca/documentviewer/en/45-1/bill/S-209/first-reading
13,810
Supporter Voices
Petition created on July 31, 2025