Canada is overhauling its privacy laws for the first time in over 25 years to address how artificial intelligence systems make decisions about people, but experts say the legislation tackles only part of a much larger problem. Bill C-36, the Protecting Privacy and Consumer Data Act, announced in June 2026, explicitly recognizes privacy as a fundamental right and requires greater transparency when automated systems make significant decisions about individuals. The reforms arrive amid growing scrutiny of AI following incidents such as the Tumbler Ridge shooting in British Columbia in February, which raised questions about AI chatbots, vulnerable users, and technology company responsibilities.

What Makes AI's Privacy Threat Different From Traditional Data Collection?

The core challenge with modern AI systems is that they don't necessarily need you to voluntarily disclose sensitive information. Patterns in your shopping habits, browsing history, location data, or online activity can be enough for algorithms to make surprisingly accurate predictions about your health, finances, or behaviors. This represents a fundamental shift in where privacy harms actually occur.

"The danger now is in what a company infers about you from data you never handed over, and in what it does with that AI inference," explained Ignacio Cofone, professor of law and regulation of AI at the University of Oxford.

Ignacio Cofone, Professor of Law and Regulation of AI at the University of Oxford

Cofone further noted that a model trained on anonymous data can produce decisions that disadvantage entire categories of people without pointing to any named individual who can complain. This distinction matters enormously because it moves the legal focus away from data collection and toward the inference and decision-making stages, where AI harm actually occurs.

How Does Bill C-36 Address AI Decision-Making?

The legislation responds to these concerns in several ways. Bill C-36 expands the definition of personal information to include inferred information and requires organizations to explain certain automated decisions. The bill also establishes a framework for the responsible use of de-identified data, with safeguards designed to reduce the risk of re-identifying individuals while supporting research, accountability, and innovation.

Canada's Minister of AI and Digital Innovation, Evan Solomon, told Al Jazeera that the government's responsibility is "to protect Canadians online and to ensure Canadians can benefit from artificial intelligence and emerging technologies. These goals are not mutually exclusive". However, experts argue that the real challenge is ensuring regulation targets harmful uses of AI rather than just data collection.

Digital Innovation, Evan Solomon

Key Protections in Bill C-36 for Vulnerable Users

• Children's Data Classification: Information belonging to anyone under 18 is classified as inherently sensitive, raising the bar for consent and organizational security obligations.
• Deletion Rights: Young people receive stronger rights to have their personal information deleted from company systems.
• Algorithmic Fairness Focus: The legislation moves beyond privacy to address how algorithms might misjudge individuals based on their digital footprints.

Stephany Oliveros, ethical AI lecturer and CEO of Just Lyra, an AI talent-matching platform, emphasized that data privacy and consent are fundamentally about user agency. She noted that it is one thing to donate data toward cancer research but quite another if tech firms discover sensitive information about a child's blood type and behaviors.

"Privacy isn't just about controlling data; it's about not being misjudged by an algorithm," said Jill Ma, a tech founder who works in children's AI products. "A child's early digital footprint shouldn't become a lifelong label. Our job as product builders is to teach AI how to respect people, not just collect their data."

Jill Ma, Tech Founder, Children's AI Products

What Are the Limitations of the New Law?

Despite these reforms, experts caution that Bill C-36 addresses only part of the problem. Cofone acknowledged that the changes are worthwhile but will help only modestly and less than the framing suggests. The heavier protections people need with children online are age-appropriate design and limits on what platforms can do with their data.

One contentious issue is the bill's treatment of de-identified information. While the legislation seeks to prevent organizations from reconstructing people's identities from de-identified datasets, experts debate how organizations and researchers should be allowed to use such data responsibly. The bill maintains exemptions for journalistic, artistic, and literary work, protecting investigative journalism as it was under the old law.

Privacy is only one part of governing AI. Experts say future AI laws will need to balance user safety, journalism, and public interest. As technologies continue to evolve, Canada's government plans to continue engaging with researchers, journalists, privacy experts, civil society, and other stakeholders to ensure the privacy framework remains effective, balanced, and responsive to Canadians' expectations.

Steps Organizations Should Take to Align With Bill C-36

• Audit Inference Practices: Review how your AI systems make predictions about individuals from indirect data sources and document the decision-making process.
• Implement Transparency Mechanisms: Develop systems to explain automated decisions to users, particularly when those decisions affect their access to services or opportunities.
• Strengthen Child Data Protections: Classify all data belonging to users under 18 as sensitive and establish clear deletion protocols that go beyond standard data retention policies.

The broader question facing regulators worldwide is whether privacy legislation can keep pace with technology designed to predict, profile, and influence human behavior. Bill C-36 represents Canada's attempt to address this challenge, but as experts continue to emphasize, the real frontier of AI governance lies not in controlling what companies collect, but in controlling what they infer and how they act on those inferences.