🍁 civid v1

Status and purpose

• Bill C-288 was introduced at first reading on June 17, 2026. It would enact the Protection Against Online Fraud Act and amend the Criminal Code.
• The bill would require platform owners and operators to take steps against fraudulent content and notify users who engaged with it.

Platform duties

• The duties apply to owners or operators of internet-connected platforms, including online services, applications, social media and online video gaming services.
• Operators would have to take reasonable steps in designing and operating their products and services to prevent fraudulent content from spreading, and remove content identified as fraudulent.
• They would have to establish a notification process and notify users they know, or reasonably should know, engaged with identified fraudulent content. They would also have to ensure those users have read the notification.
• Operators would have to keep records of removed content and notifications, and publish reports about removed fraudulent content.

Regulations and enforcement

• The Governor in Council could make regulations concerning the records operators must keep and the form, manner and contents of their reports.
• An operator that breaches the duties in sections 3 to 5 could be convicted by summary conviction and fined up to $1 million. An operator would have a defence if it established that it exercised due diligence to prevent the offence.

Criminal Code amendment

• For sentencing after a conviction for identity theft or identity fraud, a court would have to treat the victim’s vulnerability as an aggravating circumstance. Relevant personal circumstances include age, health and financial situation.