Consumer protection, synthetic media and online harms

Consumer protection law is one of the most flexible and immediately enforceable tools for addressing AI harms. It prohibits deceptive and unfair practices, whatever the technology, and regulators have used it against exaggerated claims about AI, undisclosed data practices, fake reviews and harmful applications. At the same time, generative AI has made it easy to create realistic synthetic images, audio and video, deepfakes, which can defraud, defame, harass and mislead voters, prompting new laws on disclosure, intimate images, election integrity and platform duties. This lesson covers deceptive claims about AI ("AI washing"), deceptive and manipulative uses of AI, fake reviews and impersonation, synthetic media and its regulation, content provenance and detection, protections for children, and online platform responsibilities.

Deceptive claims about AI

Organizations sometimes exaggerate what their AI can do, claim to use AI when they do not, or fail to disclose limitations: practices regulators call AI washing. Consumer protection and securities laws apply.

In Canada, the Competition Act prohibits false or misleading representations to the public, both as a civil reviewable practice and, when made knowingly or recklessly, as a criminal offence. Representations about product performance must be based on adequate and proper testing, and amendments in 2022 to 2024 increased penalties (up to three times the benefit derived or 3 % of worldwide revenue) and expanded private access to the Competition Tribunal. The Competition Bureau has studied AI and competition, including algorithmic pricing, and warned businesses that claims about AI capabilities must be accurate and substantiated. Provincial consumer protection acts and securities regulators, through the Canadian Securities Administrators' guidance on AI disclosures, add further obligations.

Practical rules for marketing AI products follow from these laws: describe capabilities accurately, with evidence from realistic testing; disclose material limitations (such as error rates or the need for human review); do not claim AI is used when it is not; and do not imply human involvement when there is none, or vice versa.

Deceptive and manipulative uses of AI

AI can also be used to deceive or manipulate consumers directly:

• Chatbots that pretend to be human, or conceal that they are AI, where that matters to consumers; several laws now require disclosure (Lesson 3 for the EU; California and Utah have disclosure rules for certain bot interactions).
• Dark patterns: interface designs that steer people into choices against their interests, which AI can personalize and optimize, such as making cancellation difficult or exploiting urgency.
• Personalized pricing based on inferred willingness to pay, sometimes called surveillance pricing, which raises consumer protection, privacy and discrimination questions and has attracted regulatory study in both countries.
• Exploiting vulnerabilities, such as targeting people in financial distress or with gambling problems, which the EU AI Act prohibits when it causes significant harm.

Consumer protection regulators treat manipulative design as an unfair practice, and privacy law limits the data used to personalize it.

Fake reviews and impersonation

Generative AI makes it cheap to produce fake reviews, testimonials and endorsements at scale, and to impersonate businesses, officials and individuals.

In Canada, fake reviews and testimonials can be false or misleading representations under the Competition Act, and the Competition Bureau has taken action against fake reviews and undisclosed endorsements. Ad Standards' influencer disclosure guidelines apply to AI-generated influencers and endorsements. Impersonation for fraud is a criminal offence, and the Canadian Anti-Fraud Centre has warned about AI voice-cloning scams targeting families and businesses.

Synthetic media and deepfakes

Deepfakes, realistic synthetic images, video or audio of real people saying or doing things they did not, are used for fraud (voice cloning in "emergency" calls and executive impersonation to authorize payments), non-consensual intimate imagery, harassment, defamation, election disinformation and political satire. Laws address them in several ways:

• Intimate images: laws criminalizing the creation or distribution of non-consensual intimate images increasingly cover synthetic images, and require platforms to remove them.
• Elections: rules prohibiting or requiring disclosure of deceptive synthetic media of candidates near elections.
• Disclosure and labelling: requirements to mark AI-generated content and to label deepfakes, such as Article 50 of the EU AI Act and China's labelling rules.
• Personality and privacy rights against unauthorized use of likeness (Lesson 6).
• Fraud and impersonation laws.

In Canada, the Criminal Code prohibits publishing intimate images without consent, and the federal government has proposed explicitly extending this to synthetic deepfakes; Bill C-36 would give people the right to request deletion of deepfakes containing their personal information, and a new online harms bill was announced in 2026. Several provinces provide civil remedies for non-consensual intimate images, and some have extended them to altered images. The Canada Elections Act prohibits impersonating election officials, candidates and parties to mislead, and Elections Canada has addressed AI-generated disinformation.

Provenance, watermarking and detection

Technical measures support these laws. Provenance standards, notably the C2PA (Coalition for Content Provenance and Authenticity) Content Credentials specification, attach cryptographically signed metadata to media describing how it was created and edited, including whether AI was used; camera makers, editing software and AI generators increasingly support them. Watermarking embeds imperceptible signals in generated content that detectors can recognize, though watermarks can be removed or degraded, and text watermarks are especially fragile. Detection classifiers try to identify synthetic content without cooperation from the generator, but their reliability is limited, and their usefulness depends heavily on how common synthetic content is among the items examined.

# A deepfake detector with 95 percent sensitivity and 98 percent specificity: how trustworthy are its alerts?
sens, spec = 0.95, 0.98
for prevalence in (0.20, 0.02, 0.002):
    tp = sens * prevalence
    fp = (1 - spec) * (1 - prevalence)
    ppv = tp / (tp + fp)
    per_10k_fp = fp * 10_000
    print(f"share of media that is synthetic {prevalence:6.1%}: alerts that are real deepfakes {ppv:5.1%}, "
          f"false alarms per 10,000 items {per_10k_fp:5.0f}")

share of media that is synthetic  20.0%: alerts that are real deepfakes 92.2%, false alarms per 10,000 items   160
share of media that is synthetic   2.0%: alerts that are real deepfakes 49.2%, false alarms per 10,000 items   196
share of media that is synthetic   0.2%: alerts that are real deepfakes  8.7%, false alarms per 10,000 items   200

When a fifth of the material screened is synthetic, 92 % of alerts are genuine deepfakes. But when only 2 in 1,000 items are synthetic, as in most general content streams, fewer than 9 % of alerts are genuine, and the detector produces about 200 false alarms per 10,000 items. Treating detector output as proof would wrongly accuse many authentic recordings, a serious problem for journalism, courts and moderation. Detection is therefore best used to prioritize human review, combined with provenance information and context, rather than as an automatic verdict.

Children and vulnerable users

AI products used by children raise particular concerns: data collection, inappropriate content, manipulative design, and emotional dependence on companion chatbots. Privacy laws protect children's data (COPPA in the United States; Canadian law treats children's information as sensitive, and Bill C-36 would make this explicit). Age-appropriate design codes, adopted in the United Kingdom and some US states, require services likely to be used by children to prioritize their best interests. In 2025 and 2026, regulators and legislatures turned attention to companion chatbots after reports of harm to young users: the FTC opened an inquiry into AI companions, California enacted safeguards for companion chatbots including disclosure, protocols for responding to self-harm and restrictions for minors, and lawsuits were filed against chatbot providers. Developers of consumer AI should assume that children may use their products and design safeguards accordingly.

Platforms and online harms

Online platforms host vast amounts of AI-generated content and use AI to moderate it. Platform regulation, such as the EU Digital Services Act, requires large platforms to assess and mitigate systemic risks including disinformation and harms to minors, to be transparent about recommender systems, and to act on illegal content. In Canada, a proposed Online Harms Act died in 2025 and the government announced a new online harms bill in 2026. In the United States, Section 230 shields platforms from most liability for user content, with exceptions such as federal criminal law and intellectual property, and new duties such as those in the TAKE IT DOWN Act. Organizations deploying generative AI on public platforms should have content policies, moderation, reporting channels and processes for takedown requests.

Building consumer trust

Consumer protection law sets minimum standards, but organizations that go further often gain trust and avoid disputes. Practical steps include plain-language explanations of how AI features work and what data they use; easy ways to reach a human; clear labels on AI-generated content in marketing; publishing results of testing for accuracy and safety in consumer-facing products; offering opt-outs from AI features where feasible; and fast, generous remedies when AI systems make mistakes that affect customers. Complaints and support tickets about AI features are also a valuable source of monitoring data, often revealing problems before formal testing does.

Regulators increasingly look at whether organizations have acted on the signals available to them. A company that received repeated complaints about an AI feature giving harmful advice, and did nothing, is far more exposed than one that investigated, fixed the problem and informed affected customers.

Finally, consumer protection obligations extend to the whole customer journey around AI features: onboarding screens, default settings, renewal and cancellation flows, and customer support. Reviewing these with the same care as the AI model itself often reveals the most significant risks.