By Armando L. I. de Miranda and Michelle Abel, June 4, 2026
Once, in the early internet age, people used to “go online.” Today, they live there – and that shift has become a growing social problem, contributing to rising mental health concerns, declining productivity, and especially among children, increasingly compulsive patterns of internet use.
Making matters worse, policymakers often fail to grasp the nature of the system they are regulating, responding with partial solutions – like banning children from social media – that target symptoms rather than the underlying architecture driving the crisis.
It wasn’t always this way. Before 2006, the internet was temporary. Dial-up modems constrained it to utilitarian functions; users connected with specific intent and disconnected when done. Entertainment existed offline. However, everything changed in 2004 and 2007, with the advent of broadband, YouTube, Facebook, and the iPhone. Algorithmic curation converted the infrastructure underneath daily life into an all-encompassing environment.
Major tech companies quickly realized that their commercial interest lay in capturing and sustaining continuous user attention. Using an engagement-maximization model that treats human attention as inventory, the major tech platforms extract it as time, cognitive bandwidth, and behavioural data, then sell it to advertisers. They designed their websites and apps around compulsion. Features such as variable reward schedules, infinite scroll, algorithmically amplified outrage, and interruptive notifications exist because compulsion is what makes the inventory valuable. As Andrew MacDougall documented in a recent Macdonald-Laurier Institute study, these same mechanics are hollowing out traditional journalism and corroding the democratic information environment.
Unfortunately, most laws misinterpret the source of the problem. They treat tech platforms as neutral carriers of harmful content rather than as active systems that engineer user behaviour for commercial ends. This results in legislation that regulates what people say rather than how platforms are built to manipulate them. Calls to ban children from social media reflect this same misreading. Child bans may reduce exposure at the margins, but they leave the real problem – the architecture – intact.
Legislators, for the most part, have not grasped what they are regulating. Many politicians use social media apps themselves, and don’t feel manipulated. This creates a blind spot to the real harms these platforms are causing.
In reality, the tech companies’ manipulation goes far deeper than most policymakers – and the public – suspect. Digital applications track not just what you click but how long you hover, how fast you scroll, where you pause, and what you do across devices. That data feeds predictive models identifying cognitive biases users themselves have not recognized.
Children are especially vulnerable to this form of manipulation, and the evidence is now a matter of court record. But the same design logic that exploits a thirteen-year-old’s reward circuitry operates identically on adults, voters, and entire populations. The scale simply changes.
The surveillance infrastructure built to maximize engagement does not stay in the hands of platforms. It becomes a weapon. Cambridge Analytica demonstrated this in 2016, harvesting data from approximately 87 million Facebook users, segmenting them into psychological profiles, and delivering targeted messaging designed to exploit emotional vulnerabilities during the 2016 US presidential election. Modern platforms have since automated and industrialized these processes, running them continuously and in real time, against entire user bases.
Platform AI systems apply the same logic to children directly. A Wall Street Journal investigation found that Meta Platforms’ AI companions across Instagram, Facebook, and WhatsApp engaged in explicit sexual roleplay with users identifying as minors. Reuters reported that Meta’s official guidelines stated it was acceptable to engage a child in conversations that are romantic or sensual, language the company claimed was an error only after public exposure. New Mexico’s lawsuit alleges that Meta founder Mark Zuckerberg personally approved allowing minors access to chatbot companions that safety staff warned were capable of sexual interactions. Internal documents show Meta’s head of child safety policy wrote in January 2024 that creating under-18 romantic AIs for adults is neither advisable nor defensible. The same filings show the platform recommended 1.4 million potentially inappropriate adults to teenage users in a single day. Zuckerberg rejected parental controls, framing the decision as a commitment to user autonomy rather than what it was: a refusal to accept the revenue loss that safety guardrails would impose.
TikTok presents a parallel case. The US Department of Justice accused TikTok in August 2024 of breaching a 2019 Children’s Online Privacy Protection Act (COPPA) court order by collecting data from millions of young users without parental consent. Canada’s Privacy Commissioner found that TikTok collects sensitive personal information, including health data, political opinions, gender identity, and sexual orientation, from all users, including children, despite claiming otherwise. The investigation produced findings but not consequences. That gap is precisely what a serious policy framework would need to close.
The national security implications extend the same logic to the state level. The 2015 US Office of Personnel Management breach gave China security clearance records for 22.1 million personnel: names, social insurance numbers, fingerprints, psychological evaluations, and background investigations. A Congressional investigation concluded it jeopardized national security for more than a generation. That breach compromised a single government database. Social media platforms aggregate equivalent data on entire populations, continuously updated and accessible to any sufficiently resourced actor. The teenagers being manipulated today are the intelligence officers, military personnel, and politicians of tomorrow. Their behavioural profiles do not expire when they turn eighteen.
Addressing the engagement-maximization model requires regulation that targets the architecture directly, not the content it carries. The existing approach has not produced structural change: platforms absorb fines that amount to fractions of a single quarter’s revenue and continue operating the same model. Four mechanisms would do that:
- Data sovereignty legislation would require behavioural data collected from Canadian users to be stored on Canadian servers, prohibited from transfer to entities operating under the legal authority of adversarial states. Financial data and health records already operate under equivalent restrictions; behavioural data at population scale warrants the same treatment.
- Algorithmic transparency requirements would compel platforms to disclose how recommendation systems work and submit to independent audit, not merely provide self-reported summaries. The European Union’s Digital Services Act provides a working model Canada has not built, and no serious attempt to build one has survived Parliament.
- Device-level controls would shift parental oversight to the operating system layer, where they cannot be quietly disabled when quarterly earnings disappoint.
- “Threat attribution capability” would give Canadian institutions the legal authority to identify influence operations and require platforms to report them to Canadian authorities rather than manage them quietly. The Hogue Inquiry confirmed the detection capacity exists.
Regulating the business model rather than the content is not a novel idea. It is the only one that works. Without such measures, the harms already visible – especially among children – will only be amplified.
Armando L.I. de Miranda is a legislative strategist.
Michelle Abel is the founder of Bridge2Future, a Canadian non-profit combating sexual exploitation of women and children.
