The IDScan Breach Is Ottawa’s Age-Check Warning

If governments want private age-check systems to guard the internet, Canadians deserve proof that their driver-licence scans will not become the next breach database.

Canada’s Privacy Commissioner has opened an investigation into IDScan.net after reports that an unauthorized third party accessed a company database and stole personal information, including digital scans of driver’s licences and other government-issued identification. That should stop Ottawa’s online-safety debate in its tracks long enough to ask the obvious question: who exactly will hold Canadians’ identity documents when government normalizes age checks?

The Office of the Privacy Commissioner says IDScan.net technology is used by businesses such as hospitality and nightlife establishments to verify government ID. The investigation will examine the safeguards in place at the time of the breach and whether notifications to affected individuals were adequate under PIPEDA, Canada’s federal private-sector privacy law.

IDScan.net says it learned around September 1 that certain data may have been accessed without authorization. The company says an unauthorized third party may have accessed or copied customer information stored in IDScan.net cloud accounts, including full names and driver’s licence or other government-issued identification numbers. Global News reports the breach is believed to involve Canadians’ driver’s licences and notes that the number of affected individuals has not been confirmed by the company or government agencies.

This is not an argument against protecting children online. Predators, pornography access, fraud and exploitative design are real problems. But conservative accountability requires government to solve those problems without building a casual internet checkpoint culture. The Privacy Commissioner’s own age-assurance material says online services may determine a user’s age or age range through age verification, age estimation or age declaration, and that such methods may be required by law to prevent access to harmful content.

That is precisely why the IDScan breach matters. Once age assurance becomes a compliance expectation, private vendors and platforms become the enforcement layer. Some may only estimate age. Others may ask for government ID. Some may store too much, keep it too long, or fail to notify people quickly when something goes wrong. Canadians should not have to discover the rules after their licence image is for sale on a criminal forum.

Before Ottawa advances any age-check-heavy online regime, publish the ID-check privacy ledger: approved methods, data-minimization rules, no-retention defaults, audit standards, breach-notice timelines, vendor liability, independent testing, and a right to verify age without surrendering a reusable image of a driver’s licence to a private cloud database.

The standard is simple. Protect children. Punish illegal conduct. But do not let “safety” become a blank cheque for permanent identity infrastructure. The IDScan investigation is a warning shot. Parliament should treat it like one.