Protection Against Online Fraud Act

Bill C-288, the Protection Against Online Fraud Act, creates new legal obligations for companies that operate online platforms connecting to the internet, such as social media services and online video gaming services. These companies, called "operators" in the bill, would be required to take reasonable steps to prevent fraudulent content from being spread through their products and services, and to remove any content that has been identified as fraudulent. Operators would also have to set up a system to notify users who interacted with fraudulent content, and to confirm that those users actually read the notice.

The bill further requires operators to keep records of all fraudulent content they remove and all notices they send to users, and to publish regular public reports about the fraudulent content they took down, following details to be set out in future government regulations. Companies that fail to meet these requirements could be prosecuted and fined up to one million dollars, though they can avoid conviction if they can show they took reasonable care to prevent the violation.

Separately, the bill amends the Criminal Code so that when someone is sentenced for identity theft or identity fraud, the judge must treat it as an aggravating factor if the victim was vulnerable because of their personal circumstances, such as their age, health, or financial situation. This means such offences could lead to harsher sentences when committed against vulnerable people.

This bill creates the Protection Against Online Fraud Act, imposing duties on platform operators to prevent, remove, and report fraudulent content, and adds a new aggravating factor for sentencing in identity theft and fraud cases under the Criminal Code.

• Who is bound — any "operator," defined broadly to include owners or operators of platforms, online services, applications, social media services, or online video gaming services connected to the Internet, provided the service is accessible in Canada.
• Obligations created — operators must take "reasonable steps" to prevent dissemination of fraudulent content, remove content identified as fraudulent, establish an internal process to notify affected users, ensure users have read that notification, keep records of removals and notifications, and publish a report on removed content.
• Undefined terms left open — the Act does not define "reasonable steps," "fraudulent content," or who identifies content as fraudulent, leaving these determinations to operators or to future regulation.
• Regulation-making power — the Governor in Council (Cabinet) may make regulations, without further parliamentary vote, prescribing the form and content of the records under section 4 and the reports under section 5.
• Penalties — an operator who contravenes the prevention, removal, notification, record-keeping, or reporting duties is guilty of an offence punishable on summary conviction by a fine of up to one million dollars; an operator can avoid conviction by establishing they exercised due diligence.
• Criminal Code amendment — courts sentencing someone convicted of identity theft or identity fraud (sections 402.2 or 403) must now treat the victim's vulnerability — due to age, health, or financial situation — as an aggravating circumstance, with no further definition of "vulnerable" provided.
• Oversight — the Act does not include a sunset clause, mandated review period, or appeal mechanism specific to operator obligations or penalties beyond the due-diligence defence.