Bill C-277 would create a new law, the Regulating the Online Use of Deepfakes Act; it does not amend another Act in the supplied text. Its stated goal is to protect people from significant harm caused by deepfakes and increase transparency. These are proposed provisions, not rules currently in force.
Online service and platform operators would have to set up a process to identify deepfakes shared through their products or services, including ways for users to report them.
Operators would have to take reasonable steps to clearly label shared deepfakes and to prevent deepfakes that may cause significant harm from being shared.
Operators would have to remove a deepfake that may cause significant harm as soon as feasible after it is identified.
Operators would have to keep records needed to assess whether they are complying. The Governor in Council could set record-keeping rules.
Operators, and directors or officers who directed, authorized, agreed to, or took part in a violation, could face administrative monetary penalties. The amounts and process would be set by regulations.
People using online services: The bill would require operators to provide reporting mechanisms. It does not set out how reports would be handled, or require operators to accept every report as proof that content is a deepfake.
People depicted in deepfakes: The bill’s stated purpose is to protect individuals and their interests. It does not set out a direct process for an individual to require removal, seek compensation, or appeal an operator’s decision.
Online service and platform operators: They would have to establish identification and reporting processes, take reasonable steps to label deepfakes and prevent potentially harmful ones from being shared, remove identified deepfakes covered by the removal duty, and keep compliance records.
Directors and officers: They could be liable for a penalty if they directed, authorized, agreed to, or participated in an operator’s violation.
People who create or share deepfakes: The bill does not directly create a penalty for an individual just for making or sharing a deepfake. The penalty scheme applies to operator violations and involved directors or officers. It says a violation is not a criminal offence.
No publicly available information gives an estimate of public cost, operator costs, or penalty amounts.
Operators would have to provide staff time and other resources for the required processes, steps, removals, and records; the bill gives no cost estimate.
Penalties would be set by regulations. The bill does not set amounts.
The bill does not specify public funding for administering the law.
“Significant harm” includes examples such as psychological harm, reputational damage, lost work opportunities, and identity theft, but the bill does not explain how operators must decide whether a particular deepfake may cause it.
The bill does not set detailed rules for identifying deepfakes, responding to reports, deciding whether content must be removed, or notifying affected people.
The bill leaves penalty amounts, investigation and hearing procedures, possible defences, and review or appeal rules to regulations.
It is unclear how the duties would apply to different types of online operators, or how they would interact with existing laws. The supplied material does not include those laws for comparison.
The bill appears intended to address deepfakes that can cause personal, reputational, psychological, or economic harm.
Requiring reporting processes and clear labels could help users identify deepfakes and alert operators to them.
Requiring reasonable steps to prevent and remove potentially harmful deepfakes gives operators a duty to act, rather than relying only on voluntary measures.
Penalties for operators and responsible directors or officers could encourage compliance. The bill says penalties are meant to promote compliance, not punish.
The bill’s central tests—such as what counts as “reasonable steps” and when a deepfake may cause “significant harm”—are not made more specific in the text. This could leave important decisions to operators.
The bill requires operators to take steps to identify and label deepfakes, but does not explain how to avoid misidentifying authentic content or how users can challenge a decision.
The detailed penalty rules are left to future regulations, so the bill itself does not show the possible financial exposure or how a finding could be challenged.
Operators would have to build processes and keep records, but the bill provides no cost estimate or detail about the resources required.