Regulating the Online Use of Deepfakes Act

Bill C-277 would create a new law called the Regulating the Online Use of Deepfakes Act, aimed at protecting people from harm caused by deepfakes — realistic AI-generated or AI-altered photos, videos, or audio that misrepresent someone's appearance or voice without their consent. The law defines a "deepfake" broadly and applies to "operators," meaning companies that run online platforms, apps, or social media services accessible in Canada.

Under the bill, these operators would have several new legal duties. They must set up systems to detect deepfakes shared on their platforms, including ways for users to report them. They must take reasonable steps to clearly label deepfake content so people know it isn't authentic. They must also take reasonable steps to prevent deepfakes that could cause serious harm — such as psychological damage, harm to reputation or relationships, financial loss, or identity theft — from being shared, and must remove such harmful deepfakes as soon as possible once identified. Operators are also required to keep records showing they are complying with these obligations, with further details on record-keeping to be set by government regulation.

To enforce these rules, the bill sets up a system of administrative monetary penalties — essentially fines — for operators who violate the Act. Company directors or officers who knowingly directed or participated in a violation can also be personally fined. These penalties are explicitly meant to encourage compliance, not to punish like a criminal offence, and violations under this law are not treated as crimes. Many of the specific details — such as exact penalty amounts, enforcement procedures, appeals processes, and who administers the system — are left to be established later through regulations made by the federal government.

This bill creates new legal duties for operators of online platforms regarding deepfakes, and establishes a system of administrative monetary penalties enforced through future regulations to be made by the Governor in Council (Cabinet).

• Who is covered — any "operator," defined as the owner or operator of an online undertaking (under the Broadcasting Act) or a platform connected to the Internet, including social media services.
• Duties imposed — operators must establish a process to detect deepfakes shared on their products or services, including user reporting mechanisms; take reasonable steps to clearly label deepfakes; take reasonable steps to prevent sharing of deepfakes that may cause "significant harm"; remove such harmful deepfakes "as soon as feasible" once identified; and keep records showing compliance.
• Rule-making left to Cabinet — the Governor in Council may make regulations on what records operators must keep, which provisions count as violations (including ongoing daily violations), penalty amounts or ranges, factors used in setting penalties, defences, confidentiality in proceedings, compliance agreements, and who may exercise powers under the enforcement scheme — none of these specifics are fixed in the bill itself.
• Penalties — operators found in violation are liable to an administrative monetary penalty of an amount set by future regulations, with no ceiling stated in the bill; directors or officers who directed, authorized, or knowingly participated in a violation are personally liable to a penalty, also to be set by regulation, regardless of whether the operator itself is penalized.
• Nature of penalties — the Act states the penalties exist "to promote compliance," not to punish, and specifies that a violation is not a criminal offence, so section 126 of the Criminal Code (relating to contravention of federal statutes) does not apply.
• Oversight — the regulations may include provisions for review or appeal of violation findings and penalty decisions, but the bill does not itself set out an appeal body, reporting requirement to Parliament, or a sunset clause.