Québec tackling deepfakes by introducing new consumer protections against misleading or fraudulent use of a person’s identity or image

Bill 24, the Act to protect consumers against the misleading or fraudulent use of a person’s identity or image, came into force on June 12¹.

What you need to know

• Bill 24 aims to protect consumers against misleading or fraudulent commercial representations by expressly prohibiting the use, without consent, of a person’s identity or image for such purposes.
• Bill 24 grants powers to the president of the Office de la protection du consommateur (OPC), and to the President and Chief Executive Officer of the Autorité des marchés financiers, to issue orders, and extends liability to any person who contributes directly or indirectly to such unlawful practices.

Background

This legislation, first mentioned in March 2026, seeks to address a growing number of cases in which fraudsters use the images of public figures to promote fake products or services². Moreover, it aims to better protect consumers in Québec against fraud, which can result in significant financial losses, sometimes amounting to hundreds of thousands of dollars. Accordingly, Bill 24 is intended to strengthen efforts to combat online fraud and to enable a faster response to online identity theft.

The main elements of the reform include the following:

• a ban on using, or allowing the use of, a person’s identity or image without their consent for the purpose of making representations to consumers;
• a broad definition of the concept of “image”, which includes images—altered or not—that represent or appear to represent the non-consenting person, and any visual or sound recording of that person;
• an expansion of the scope of application through the creation of the new section 238.1, which also applies to transactions, including those set out in section 6 of the Consumer Protection Act (CPA), such as transactions governed by the Derivatives Act and the Securities Act, and those relating to the sale, lease, or construction of an immovable, notwithstanding the exclusions in that section³;
• the granting of new powers to issue orders to cease prohibited practices and to preserve evidence; and
• the imposition of penal sanctions and administrative penalties in the event of a breach.

Overview of changes and new measures

New prohibition on the use of a non-consenting person’s identity or image

Bill 24 introduces a new section 238.1 into the CPA that prohibits the use, whether direct or indirect, of the identity or image of a non-consenting person for commercial purposes. This provision therefore imposes a liability on intermediaries, such as digital platforms and service providers.

This same provision also provides a broad definition of “image”, which includes any image, whether altered or not, of the non-consenting person; any image appearing to represent the person; and any visual or sound recording of the person. This definition faithfully reflects the current context, characterized by the growing influence of artificial intelligence, and makes it possible to encompass the emerging uses that result from it.

Expansion of the scope of application

Bill 24 also introduces an amendment to section 6 of the CPA so that the new prohibition in section 238.1 applies, notwithstanding the exclusions provided for, to transactions traditionally excluded from the scope of the CPA, particularly those governed by the Securities Act or the Derivatives Act, and those relating to the sale, lease or construction of an immovable.

This expansion reflects the legislation’s intention to ensure uniform consumer protection, regardless of the sector of activity, while forming part of the broader purpose of Bill 24 to combat online fraud. Notably, it responds to the resurgence of schemes involving the unauthorized use of people’s images or voices, often those of public figures, to promote fraudulent products or services, which can result in significant financial losses for consumers. By expanding the application of section 238.1 to sectors traditionally excluded, the legislature seeks to enable a more rapid and efficient response to identity theft and misleading representations online.

Granting new powers to issue orders

The Bill confers powers on the president of the OPC to issue orders. Specifically, the president may:

• order any person to cease a prohibited practice;
• order that such practices be prohibited, including those carried out through technology services; and
• require the preservation of evidence, both by persons who are or could be the subject of an inspection or investigation, and by any other person holding any evidence related to non-compliance or an offence.

Sanctions and remedies

Non-compliance with these new obligations may result in significant consequences, notably the following:

• the imposition of penal sanctions, including a minimum fine of $2,500 (natural person) or $5,000 (other cases), and a maximum fine of $62,500 (natural person) or $125,000 (other cases); or, if greater, an amount equal to 5% of worldwide turnover for the preceding fiscal year, particularly in cases of failure to comply with an order to cease a prohibited practice or to preserve evidence;
• The imposition of monetary administrative penalties of up to $1,250 (natural person) or $2,500 (other cases), particularly in the event of a breach of section 238.1 of the CPA⁴;

In addition, Bill 24 amends section 253 of the CPA by establishing a presumption that the consumer would not have entered into the contract or agreed to pay such a high price had they been aware of the prohibited practice, which may lead to the annulment of the contract.

Practical implications for organizations

Bill 24 significantly expands the liability of organizations, particularly those acting as intermediaries. By introducing liability for “allowing” a prohibited practice, Bill 24 establishes a regime that may capture a wide range of parties. In this context, several categories of organizations must pay particular attention to their practices. Notably:

• Organizations operating platforms or distributing advertising content, particularly where they allow third parties to publish advertisements in environments they control, should ensure that the content being distributed complies with the requirements of Bill 24, especially when it is generated by users or external advertisers.
• Organizations developing or making available technological tools, including artificial intelligence tools, should ensure that their tools cannot be used to generate or disseminate content that contravenes the new prohibition.
• Organizations that rely on third parties for the creation or dissemination of marketing content as part of their own commercial activities, including agencies or technology service providers, should include appropriate contractual provisions to ensure compliance with applicable legal requirements.

More specifically, these obligations translate, among other things, to the need to:

• implement appropriate monitoring and compliance mechanisms;
• take prompt action in the event of misuse or non-compliance;
• adopt internal policies governing the use of artificial intelligence tools in marketing activities; and
• strengthen verification and due diligence processes with respect to partners and suppliers.

In the absence of such measures, organizations may face significant financial, regulatory and reputational risks.