Who Owns Your Face and Voice? A Deeper Dive into the AI Privacy Right Gaps Within Canada.
In Canada, it is illegal to rob someone's house, yet, it is not always illegal to rob someone of their face and voice through AI. This past March, a Nova Scotia courtroom proved it. A former classmate had taken multiple photos of young women from social media, used AI to make them appear naked, and shared these images without their consent. The result? He was acquitted of the deepfake charge, not because the damage wasn’t done, but because the Criminal Code’s definition of an ‘intimate image’ did not cover AI-generated images. On June 18, 2026, the Protecting Victims Act expanded that definition, coming three months too late and leaving the victims vulnerable and misrepresented. Canada reacted to this issue instead of preventing it. This leads to a major question: who owns your face and voice, and what major gaps exist in the federal and Ontario law.
You may think this means that the issue is fixed. Think again. Even under the new law that was enacted after the issue in Nova Scotia, making those images still is not a crime. It only becomes a crime if you are sharing them or threatening to. Bill C-16 focuses on sharing and threats, not the creation of these images. Yet, there are complications with further procedures. Criminalizing the creation of a deepfake photo raises real free-speech concerns under the Canadian Charter of Rights and Freedoms. Section 2(b) protects the freedom of expression, and the Supreme Court reads “expression” broadly, meaning it covers art, parody and memes, which is why Ottawa left it out of the new law. However, the Charter isn’t absolute. Section 1 allows the government to limit a right when it can show the limit is reasonable and justified in a free and democratic society. Prevention does not always mean prison: labelling rules and, most of all, the right to your own face and voice would prevent much of the harm without silencing anyone. A label would tell a viewer that a video is fake before it can ruin someone’s reputation. Ottawa has actually proposed labelling rules, but more on that later. Having a legal right to your likeness means you could act the moment it has been misused, not after the damage is done. That is the difference between preventing harm and reacting to it.
How about the companies that are constructing these tools? Well, it’s the same story as the Nova Scotia case; the law showed up after the damage was already done. In July 2025, xAI, the company and the developer of the chatbot Grok, switched to a new image model, Grok Imagine. It was better at preserving a person's facial likeness in edited images. That same year, xAI added an “Edit Image” button to images on X, which included images of other users. Afterwards, the lack of safeguards was prevalent. Reports cited in the Privacy Commissioner full Report of Findings (#2026-004) estimated more than 6,000 sexualized deepfakes were created per hour worldwide by January 8, an estimated 1.8 million sexualized images since December 29. The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to organizations outside of Canada when there is a “real and substantial connection” to the country. The Privacy Commissioner of Canada found that the companies did not obtain valid consent to use anyone's personal information to generate sexualized deepfakes. The result? The complaint was well-founded yet not resolved. What could’ve prevented this harm? Well, the Commissioner stated that building safeguards prior to launch instead of fixing them afterwards could’ve likely prevented the harm. Furthermore, it took the companies more than ten days to introduce technical safeguards. The Privacy Commissioner asked them to pause the tool. They said no, and under current legislation, he couldn’t make them. Most importantly, the Commissioner found that a deepfake of you is your personal information, even if it is not a real photo or video. So, logically, your face is yours. In practice? No one could make them stop.
But what if the deepfake isn’t sexual at all? What if someone created a video of you that will cost you your career in the future? Well, criminally you’re out of luck. No federal law targets non-sexual deepfakes of you and your family. Victims would have to hope that an old offence fits under the Criminal Code of Canada, such as fraud (s.380), identity fraud (s. 403), identity theft (s.402.2), criminal harassment (s. 264), or extortion (s.346). All of these offences need something extra, such as a specific intent, repeated conduct, fear for safety, or money. Yet, a fake video just to humiliate you might meet none of those. The main issue here is that many deepfake photos or videos are posted anonymously. You cannot charge or sue someone that you cannot identify. Furthermore, unmasking these people usually takes a court order, which is money and time that not everyone has access to. And that's only if you’ve found out who's made this content. Bill C-34, the proposed online-safety law now at its second reading, states that for most harmful content, platforms aren't required to proactively search their services for harmful content, (s. 12(1) of the proposed Digital Safety Act). Even more concerning, none of the seven categories that are listed as “harmful content” include any non-sexual deepfake of an adult. Additionally, we’ve only been speaking about visual content, C-16's new definition does not cover a voice deepfake. So sadly, the deepfake stays up, the person who did it stays anonymous and it’s not even ‘harmful’ on paper.
Regarding Ontario? It doesn’t get much better. Compared to other provinces, Ontario falls behind on sexual deepfakes. Ontario is the only common law province with no civil statute on non-consensual creation, distribution and alteration of intimate images. Meanwhile, a student at UBC can apply online to a tribunal, get a takedown order without a lawyer, and claim up to $75,000 in damages. In Ontario, there is no efficient way to get it taken down or be compensated for the harm done to you. Regarding non-sexual deepfakes, Ontario is in the same position as the federal government. It has not done much to fix the gap either. However, Ontario is starting to pay attention. Earlier this year, the Law Commission of Ontario opened a project on intimate images and deepfakes, studying whether the law should allow takedown orders, the destruction of copies, and the prevention of future creation or distribution. The project is still in progress. Furthermore, a victim could also sue under a privacy tort called ‘false light’, which in simple terms protects your right to control how you’re presented to the world. Yet, a lawsuit is expensive, involves a lot of time and the tort has not been tested on deepfakes. This shows that prevention protects not just the harm of the wrongdoings but also the people’s energy, time and money.
You’re probably thinking, is anyone doing something? Believe it or not, yes. As mentioned earlier, Bill C-16 made sharing sexual deepfakes a crime, threatening to share these images is also a separate crime with a potential maximum penalty for distribution going from five years to ten. Bill C-25 targets political deepfakes, such as election deepfakes as fake images or voices of officials, candidates and party leaders. Furthermore, some federal bills that are incoming are Bill C-34 where platforms would have to take down any sexual deepfakes shared without consent, as well as proposes labeling videos or photos generated by AI. This bill is currently at its second reading. Additionally, Bill C-36 includes a right to have companies delete your personal information which includes deepfakes of you. Going back to the Grok case earlier, this bill proposes the Digital Safety and Data Protection Commission of Canada. This would replace the Office of the Privacy Commissioner and enforce a new regulator with real penalty powers to these big companies such as up to $10 million or 3% of companies’ global revenue, whichever is greater. Furthermore, more serious offences can raise that bar to $25 million or 5% of their global revenue. The new Commission could also issue binding orders, forcing a company to stop. Yet, C-36 is still awaiting a second reading. Transitioning to provincial, the Law Commission of Ontario is studying takedown orders, tribunal, and even preventing future creation whose report is due later in the year. It’s progress in the right direction, yet I want you to notice the main pattern: almost every one of the laws kicks in after damage has already been done, and most of these aren’t even law yet.
So, who owns your face and voice? On paper, you do. Practically, whoever has a laptop, an AI tool and five minutes. Privacy is essential and even the Privacy Commissioner found that a deepfake of you is your own personal information, however, no law fully protects it, showing clear gaps in legislation. Making a sexual deepfake of an adult is not a crime in Canada. Non-sexual fakes fall through the gaps, your voice is not covered by the new deepfake law, regulators cannot force companies to stop, and Ontario has no statute of its own. Still, C-16 is now in law, C-34,C-36 are in Parliament, and the Law Commission of Ontario is looking deeper into these issues. Attention has been drawn, it's just a matter of whether Canada acts before the next victim, or after.
Works Cited
Anggadol, K., & Anggadol, K. (2026, September 8). Intimate Images Protection Act: a province-by-province guide. Canadian Lawyer. https://www.canadianlawyermag.com/practice-areas/personal-injury/intimate- images-protection-act-a-province-by-province-guide/394613
BC Civil Resolution Tribunal. (2026, August 24). Intimate Images - BC Civil Resolution Tribunal. BC Civil Resolution Tribunal - an Accessible, Affordable Way to Resolve Disputes Without Needing a Lawyer or Attending Court. https://civilresolutionbc.ca/solution-explorer/intimate-images/
C-25 (45-1) - LEGISinfo - Parliament of Canada. (n.d.). LEGISinfo. https://www.parl.ca/legisinfo/en/bill/45-1/c-25
C-34 (45-1) - LEGISinfo - Parliament of Canada. (n.d.). LEGISinfo. https://www.parl.ca/legisinfo/en/bill/45-1/c-34
Canada Has a New Law to Stop Deepfake Nudes. Will it Work? (n.d.). The Walrus. https://thewalrus.ca/canada-has-a-new-law-to-stop-deepfake-nudes-will-it- work/
Corporation, G. L. L. (2026, September 20). The word the criminal code was missing. Gleelaw. https://gleelaw.com/blogs/the-word-the-criminal-code-was-missing/
Government Bill (House of Commons) C-34 (45-1) - First reading - Safe Social Media Act - Parliament of Canada. (n.d.). https://www.parl.ca/DocumentViewer/en/45-1/bill/C- 34/first-reading
Government Bill (House of Commons) C-36 (45-1) - First Reading - An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts - Parliament of Canada. (n.d.). https://www.parl.ca/DocumentViewer/en/45-1/bill/C- 36/first-reading
Government of Canada, Department of Justice, Electronic Communications. (2026, April 13). The Canadian Charter of Rights and Freedoms. https://www.justice.gc.ca/eng/csj-
Hounsell, K. (2026, June 26). Canada's new law criminalizing sexualized AI deepfakes 'too little, too late,' woman says. CBC. https://www.cbc.ca/news/canada/nova- scotia/ai-deepfakes-new-canadian-law-intimate-images-criminal-code-9.7249071
Law Commission of Ontario. (2026, July 6). Intimate images and deepfakes – Law Commission of Ontario. https://lco-cdo.org/en/projects/intimate-images-and- deepfakes/
Legislative Services Branch. (2026a, July 18). Consolidated federal laws of Canada, Criminal Code. https://laws-lois.justice.gc.ca/eng/acts/C-46/index.html
Legislative Services Branch. (2026b, September 3). Consolidated federal laws of Canada, Protecting Victims Act. https://lois.justice.gc.ca/eng/AnnualStatutes/2026_19/FullText.html
Major, D. (2026, June 15). New privacy bill would give Canadians right to request companies delete AI deepfakes. CBC. https://www.cbc.ca/news/politics/ask-private-
McLauchlan, M., & McLauchlan, M. (2026, June 11). Elon Musk’s X continues to violate Canadian privacy law with Grok deepfakes, watchdog finds | BetaKit. BetaKit. https://betakit.com/elon-musks-x-violated-canadian-privacy-law-with-grok- deepfakes-watchdog-finds/
Nichols, T., & Nichols, T. (2026, June 19). Canada bans “sophisticated deepfakes” of political figures | BetaKit. BetaKit. https://betakit.com/canada-bans-sophisticated-
Office of the Privacy Commissioner of Canada. (2026a, June 11). News release: Privacy Commissioner of Canada investigation into the Grok chatbot and sexualized deepfakes finds companies violated privacy law. https://www.priv.gc.ca/en/opc-news/news-and-
Office of the Privacy Commissioner of Canada. (2026b, June 11). PIPEDA Findings #2026-
004: Commissioner-initiated complaints concerning X Corp.’s and X.AI LLC’s compliance with PIPEDA. https://www.priv.gc.ca/en/opc-actions-and-
Ontario recognizes new privacy tort | Insights | Torys LLP. (n.d.). Torys LLP.
Sargeant, E. (2026, July 8). Canada has a new law to stop deepfake nudes. Will it work? The Walrus. https://thewalrus.ca/canada-has-a-new-law-to-stop-deepfake-nudes-will-it-
Walsh, M., Guilmain, A., & Wagner, W. (2026, June 24). Understanding Bill C-36: What organizations need to know about Canada’s proposed privacy reform bill. Gowling WLG. https://gowlingwlg.com/en-ca/insights- resources/articles/2026/understanding-bill-c36
What an important topic as AI is continuously developing! Great read, Kody!