A theory has been circulating that four bills in Canada’s current Parliament — C-8, C-9, C-22, and C-34 — are not separate pieces of legislation at all but interlocking components of a single architecture: a Liberal “digital-governance” grid that defines what you can say, retains what you do, can cut you off when you misbehave, and gates the whole thing behind age checks that converge, inevitably, on a national digital ID. In this telling, C-34 is the “missing piece” that snaps the others into place.

It is a tidy story. Tidy stories about legislation usually deserve suspicion, and this one is no exception. The four bills are real, they were tabled by the same government in the same session, and at least three of them contain provisions that should worry anyone who takes privacy and free expression seriously. But they do four genuinely different things, were drafted by different ministries for different reasons, and do not — individually or together — establish a Canadian digital ID. Getting the details right matters here, because the real problems are serious enough that you don’t need to invent a master plan to be alarmed.

Let’s take them one at a time.

What the bills actually are

Bill C-8 is the cybersecurity bill, a reintroduction of the previous Parliament’s C-26 that died on the order paper. It enacts the Critical Cyber Systems Protection Act and amends the Telecommunications Act to let the government issue binding security orders to telecom carriers — banning equipment from specified suppliers (think Huawei), mandating removal of high-risk gear, and compelling companies in finance, energy, telecom, and transport to harden their systems. It passed the House in spring 2026 after substantive amendments and cleared the Senate in June.

The user’s claim is that C-8 “gives the government power to cut someone off the internet entirely.” This is a real concern in a narrow sense and a serious overstatement in a broad one. C-8’s powers run against companies and equipment, not individuals. The civil-liberties objection — raised by the Privacy Commissioner and others — is that the ministerial order powers are broad, secret, and lightly reviewed, and that an order to a carrier could in principle degrade or cut service. But “the government can cut you off the internet” is not what the statute says. It is a worst-case extrapolation, not a provision.

Bill C-9, the Combatting Hate Act, amends the Criminal Code. It creates a stand-alone hate-crime offence, criminalizes wilfully promoting hatred by displaying certain symbols (Nazi and listed-terrorist symbols), and makes it an offence to intimidate people out of accessing religious or cultural places. It passed third reading in March 2026. The Canadian Civil Liberties Association and the Canadian Constitution Foundation have warned it was rushed and that its speech provisions are dangerously vague — legitimate criticisms worth amplifying.

But C-9 does not “define what you can and cannot say online” in the platform-regulation sense. It is a criminal statute about hate propaganda and violence, enforced through courts and prosecutors, not a content-moderation regime that tells Facebook what to delete. The online-speech-control bill people are thinking of is a different one.

Bill C-22, the Lawful Access Act, is the one that should command the most attention — and it’s the bill the “data retention for up to a year” claim is actually about. C-22 revives the lawful-access provisions stripped out of the earlier Strong Borders Act (C-2) after backlash. It would compel electronic service providers to confirm, without a warrant, whether a person under “reasonable suspicion” is a subscriber, and — critically — it grants the government power to order “core providers” to retain categories of metadata, including transmission and location data, for up to one year.

Here the user’s characterization is essentially correct, and if anything understates it. This is mass metadata retention applying to everyone, suspected of nothing. Michael Geist, the Privacy Commissioner, Apple, Meta, and even the U.S. House Judiciary Committee have lined up against it. At committee, one police chief testified that three years of retention would be “ideal.” The minister has since signalled openness to trimming the one-year window — an admission that the original demand was excessive. C-22 is the bill in this cluster that most deserves sustained public pressure.

Bill C-34, the Safe Social Media Act — the supposed keystone — was tabled in June 2026. It is genuinely sweeping. It bans under-16s from holding social-media accounts, backs that ban with mandated age verification or age estimation, imposes a “duty to act responsibly” on platforms across seven categories of harmful content, requires 24-hour takedowns of child sexual abuse material and non-consensual intimate images, mandates labelling of synthetic/deepfake content, regulates AI chatbots, and creates a new Digital Safety Commission to oversee all of it.

The user’s framing of C-34 as “a social media ban with age limits” is accurate as far as it goes. But the most important fact about the bill is buried in Geist’s analysis: roughly fifty critical decisions are deferred to future cabinet regulations and a commission that does not yet exist. C-34 is less a finished law than a delegation of power to write one later, out of public view.

The age-verification problem is the real story

If there is a legitimate privacy concern that ties C-34 to a broader surveillance worry, it is age verification — not digital ID, but the thing that makes people reach for the phrase.

To keep under-16s off platforms, everyone has to prove they are over 16. That means tens of millions of adult Canadians handing a government ID, a facial scan, or a biometric age estimate to a platform or, more likely, a third-party verification vendor. The accuracy and bias problems with age-estimation technology are well documented, and the security risks are not hypothetical: an October 2025 Discord breach exposed roughly 70,000 government IDs that had been collected for exactly this kind of verification. Hundreds of researchers have publicly opposed mandatory age verification on precisely these grounds.

This is where the “convergence toward digital ID” intuition comes from, and it is not crazy. A society that normalizes proving your identity to read a website has built most of the cultural and technical scaffolding a national digital ID would need. But intuition is not legislation. None of these four bills mandates, creates, or requires a digital ID. C-34 explicitly contemplates verification through private, often foreign, third-party services — a fragmented commercial market, not a centralized state credential. That is its own privacy nightmare, arguably a worse one in some respects, but it is not the unified government ID the master-plan theory describes.

Where this leaves us

So the “missing piece” theory gets the mood right and the mechanics wrong. Four bills from one government, several of them expanding state power over the digital lives of citizens, is a fair thing to be uneasy about. But they are not gears in one machine. C-8 secures infrastructure. C-9 is criminal hate law. C-22 is the surveillance bill — the one that retains your metadata. C-34 is the age-gating and content bill. They share a direction of travel, not a blueprint, and no clause among them builds a digital ID.

The civil-liberties case does not need the conspiracy. C-22’s warrantless subscriber checks and year-long metadata retention are alarming on their own terms. C-34’s age-verification mandate threatens to make identity disclosure a price of admission to the open internet. C-9’s vagueness invites overreach. These are real, documented, and worth fighting on the merits — through committee testimony, the Privacy Commissioner’s submissions, and public scrutiny of the fifty blank cheques C-34 hands to cabinet.

The fastest way to lose that fight is to overstate it. When you tell people the government is about to “cut them off the internet” and force a national ID, and the statute says neither, you hand defenders of these bills an easy rebuttal and discredit the parts that are true. Be precise. The accurate version is frightening enough.