Social Media Policies
There is no such thing as a risk-free presence in the social media space. For businesses, individuals, and organizations that operate on social platforms — whether as brand owners, content publishers, advertisers, or employers — the absence of well-crafted policies creates exposure across a broad range of legal disciplines. Three categories of policy address the most significant risks: posting policies, moderation policies, and employment policies. Each serves a distinct protective function, and collectively they form the legal foundation for any responsible online presence.
Posting Policies
A posting policy is a public-facing document that governs the rules of engagement for users who wish to contribute content to a social media website or page. It must clearly outline the rights and obligations of participating users. Because brand owners often resist burdening their audience with dense legal text, best practice is to display a brief summary on the main page — with a link to a more comprehensive policy — making it accessible without being intrusive.
A legally sound posting policy should address the following core elements:
- Right to moderate: Reserve the express right to remove, edit, or otherwise modify any content at any time and at the operator's discretion, without explanation to the user.
- Community standards: Enumerate categories of impermissible content — profanity, offensive language, derogatory characterizations of ethnic, racial, sexual or religious groups, endorsement of illegal activity — while making clear the list is not exhaustive.
- Intellectual property warranties: Require participants to represent and warrant that they hold the right to share any submitted content, including trademarks and copyrighted material, and prohibit the posting of third-party materials without prior consent.
- Content licence: Obtain a worldwide, royalty-free, non-exclusive licence to publish, display, reproduce, modify, and otherwise use any submitted content in any format, together with a waiver of all moral rights in that content.
- Disclaimer of liability: Clearly communicate that the views of contributors do not represent those of the organization, and disclaim liability for third-party posts.
- Anti-spam provision: State that content containing advertisements, spam, or references to unrelated websites will be removed.
- Privacy reminder: Remind participants that the page is public and caution them against submitting personal information such as addresses, phone numbers, or email addresses.
- Indemnity clause: Obtain an indemnity from contributors in relation to any claims arising out of their submitted content.
- Testimonial authenticity: Require that any testimonials represent true and honest beliefs based on the contributor's genuine experience with the product or service.
Moderation Policies
Moderation in the social media space is a double-edged sword. Failing to moderate leaves defamatory, unlawful, or brand-damaging content visible to the public; over-moderating risks alienating users and creating the perception of censorship. The challenge is compounded by the fact that comments appearing on a brand's page — even with disclaimers — can appear to carry the brand's tacit endorsement.
A moderation policy must define: the categories of content that will be removed; the procedures by which removal decisions are made and escalated; and the persons responsible for each category of concern. A casual complaint about a product can typically be handled by a trained moderator. A sensitive political matter, a claim of health harm, or an allegation implicating the company in ongoing litigation should be escalated immediately to legal counsel or senior management. The policy must identify those escalation pathways explicitly — not merely in general terms.
Effective moderators must internalize several principles when engaging with users. Every response is public. Responses should be timely, personal, and written in plain language — avoiding legal terms, jargon, and cookie-cutter phrasing. Social media users place a premium on transparency and will disengage from pages perceived as heavily censored. At the same time, some content simply cannot remain online: harassment, defamatory statements, content infringing third-party intellectual property, and spam all warrant prompt removal.
Defamation and Reputation ManagementDefamatory content posted by third parties on a brand's social media page raises urgent legal questions about takedown obligations and platform liability. Grigoras Law handles online defamation and reputation management matters, including targeted injunctions and strategic claims where defamatory posts cause measurable reputational or economic harm.
Employment Policies
Social media communications made by employees — even on personal accounts and outside working hours — can cause significant reputational damage to an employer. An employee's casual Facebook post identifying their employer and voicing dissatisfaction, or a video uploaded by a staff member depicting workplace misconduct, can reach millions of viewers within hours. The penalties for employees can range from suspension and dismissal to criminal charges. For employers, the consequences can include damage to goodwill, regulatory scrutiny, and litigation.
A comprehensive employment policy governing social media use must address the following:
- Define what "social media" means and which activities and platforms the policy covers — including mention of specific platforms while not limiting coverage to them.
- Identify who is authorized to post official communications on behalf of the organization.
- Explain the durability and reach of electronic information, including the risk that content posted anonymously can often be traced.
- Specify the extent to which the policy applies to off-duty social media activity conducted on personal time and personal devices.
- Prohibit employees from disparaging the employer, co-workers, customers, or business partners on social media — at or outside the workplace.
- Remind employees of their confidentiality obligations and identify the categories of information whose disclosure constitutes grounds for termination for cause.
- Prohibit the unauthorized use of the employer's trademarks, logos, and slogans.
- Prohibit speaking on behalf of the employer, particularly on matters currently in the news.
- Advise employees of the consequences of policy violations, including that unlawful activity may be reported to authorities.
- Provide alternative internal channels through which employees may raise workplace concerns.
Employment Issues and Social Media
Employment and social media law intersect at several critical points. Many employees are required to use the Internet and social media as part of their work. The law's conceptualization of property in this context is evolving rapidly, and employers who have not proactively addressed social media in their employment agreements, collective agreements, and policies face meaningful legal risk — particularly with respect to ownership of accounts and confidential contacts, and the use of social media in pre-employment screening.
Employment Contracts and Social Media
Appropriately drafted employment contracts and collective agreements provide the strongest available protection for an employer's interests in social media assets. A contract provision should expressly stipulate that all social media accounts created by the employee or employer for the purpose of carrying out the employer's business remain the exclusive property of the employer — both during and after the employment relationship. Such a provision can be incorporated within a broader clause addressing the ownership of employer-provided devices and the obligation to return company property at the end of employment.
In unionized workplaces, equivalent protections can be negotiated into the collective agreement. The benefit of addressing ownership in these instruments is twofold: it sets clear expectations at the outset of the relationship and provides a legal basis for enforcement in the event of a breach.
Background Checks
The use of social media in pre-employment background screening raises significant legal risks that employers must navigate carefully. The principal concern is that a review of a candidate's public social media profile will expose the employer to information about a prohibited ground of discrimination under the Ontario Human Rights Code — including disability, sexual orientation, ethnic origin, or family status — which could give rise to a human rights complaint if the candidate is not hired.
Where criminal background checks are required, Canadian arbitral and tribunal decisions have consistently held that such checks must be connected to a genuine and demonstrable occupational requirement. In Ottawa (City) v. Ottawa Professional Firefighters Association, arbitrator Picher held that an employer has no inherent entitlement to the criminal histories of its employees: the nature of the job must itself give rise to the requirement, such as roles involving close contact with children or vulnerable adults, or positions with access to sensitive financial or security systems.
When conducting social media background checks, employers should limit themselves to publicly available information, refrain from attempting to circumvent privacy settings or connect with candidates under false pretenses, and carefully document their screening process. The mere fact that an employee uses social media as part of their role is generally insufficient justification for mandatory criminal record checks.
Ownership of Social Media Accounts and Contacts
The ownership of social media accounts and the contacts associated with them — particularly LinkedIn connections and Twitter/X followers built during employment — is one of the most contentious emerging issues in Canadian employment law. Canadian courts have not yet definitively resolved this question, although the issue has been heavily litigated in the United States.
PhoneDog v. Kravitz (N.D. Cal., 2011) [U.S. — persuasive]
An employee who built a Twitter following of 17,000 under an employer-associated account was sued for trade secret misappropriation and unjust enrichment after leaving his employer and renaming the account. The employer valued the contacts at $42,500 per month. Although the case settled without a judicial ruling on the merits, it opened a significant dialogue about the legal status of social media audiences built during employment — and the danger of failing to address this contractually before a dispute arises.
Eagle v. Morgan (E.D. Pa., 2013) [U.S. — persuasive]
A senior executive was terminated and her former employer immediately accessed and locked her LinkedIn account, which she had maintained under employer guidelines but without a formal ownership policy. The court held that misappropriation of identity and privacy claims were made out, but declined to award damages for want of proof. The lesson for Canadian employers and employees alike is that contractual clarity — at the outset of the employment relationship — is essential.
In the absence of Canadian authority directly on point, the prudent approach for employers is to address account and contact ownership expressly in employment agreements, ensure that accounts used for business purposes are registered to the company and not to individual employees, and use role-specific email addresses (such as domainnameclerk@company.com) for all domain and account registrations.
Domain Names
What is a Domain Name?
A domain name is a memorable address that identifies a website or other location on the Internet, representing an Internet Protocol (IP) address in the Domain Name System (DNS). The DNS translates domain names into the corresponding IP addresses and routes Internet traffic accordingly. It also enables email delivery, connecting outgoing messages to their intended recipients. Because IP addresses are complicated strings of numbers that are difficult to remember, domain names function as mnemonic devices: rather than typing the raw IP address for a website, users type the domain name instead.
Domain names are divided into hierarchical parts. The component to the right of the final dot is the Top-Level Domain (TLD). Generic TLDs (gTLDs) include .com, .net, .org, and an expanding range of new extensions; country-code TLDs (ccTLDs) are assigned to particular jurisdictions, with .ca being Canada's ccTLD, administered by the Canadian Internet Registration Authority (CIRA). The second-level domain — the part immediately to the left of the TLD — is typically what registrants register. The domain name system is overseen globally by the Internet Corporation for Assigned Names and Numbers (ICANN), which has dramatically expanded the number of available TLDs in recent years.
Domain Names as Property
Registries and registrars have historically taken the position that domain names are not property. CIRA's Registrant Agreement, for instance, expressly states that a domain name registration does not create any proprietary right. However, Canadian courts have pushed back against this characterization in significant ways.
The Ontario Court of Appeal held that domain names and personal property share many fundamental characteristics, and that a domain name can be considered "personal property" under Ontario law. The court observed that the registered owner of a domain name has the right to exclusively direct traffic to the corresponding website and to exclude anyone else from using the same name — a hallmark attribute of property rights. Because the bundle of rights associated with a domain name satisfies the standard indicia of property, the Court concluded it qualifies as personal property enforceable against all others.
The characterization of domain names as property has important downstream consequences: it supports the use of proprietary claims in litigation, enables domain names to be treated as assets in corporate transactions, and provides a foundation for injunctive relief where domain names are transferred or used in breach of contract. Canadian courts have also held that a domain name can be corporate property even if it was registered in the name of an individual employee or contractor — a consideration that reinforces the importance of proper registration practices.
Registration Requirements and Portfolio Management
Domain names are generally available on a first-come, first-served basis. To register a domain name, the registrant must agree to the relevant registry's terms and conditions, which typically require: accurate contact information; a representation that the domain name and its proposed use will not violate applicable laws or third-party rights; and agreement to submit to the applicable dispute resolution policy in the event of a trademark conflict.
For .ca domain names, CIRA imposes Canadian Presence Requirements, restricting registrations to Canadian citizens, permanent residents, corporations incorporated in Canada, and certain other qualifying entities. This represents a material eligibility restriction that does not apply to gTLDs such as .com.
Sound portfolio management requires several disciplines:
- Register domain names in the name of the business entity, not individual employees, contractors, or web designers — a common source of expensive disputes on departure.
- Designate a domain name administrator and associate all registrations with a role-specific email address that the organization controls unconditionally.
- Register defensively across key TLDs (.com, .ca, and relevant new gTLDs) and common typographical variations that could be exploited by bad-faith registrants.
- Monitor registration renewal dates carefully — lapsed registrations are a frequent source of domain hijacking.
- Register social media usernames on all major platforms simultaneously with domain names to prevent username squatting.
Domain Name Disputes: CDRP and UDRP
Where a domain name has been registered by a third party in bad faith, specialized dispute resolution mechanisms exist to reclaim it — often faster and less expensively than conventional litigation.
| Mechanism | Applicable TLDs | Administrator | Remedies Available |
|---|
| CDRP (CIRA Domain Name Dispute Resolution Policy) | .ca domains | CIRA (Canadian Internet Registration Authority) | Transfer or cancellation of the domain name registration |
| UDRP (Uniform Domain Name Dispute Resolution Policy) | Most gTLDs (.com, .net, .org, etc.) | ICANN-approved providers (WIPO, NAF, ADNDRC) | Transfer or cancellation of the domain name registration |
Under both the CDRP and the UDRP, the complainant must establish three elements to succeed: first, that the disputed domain name is identical or confusingly similar to a trademark or other right in which the complainant has an interest; second, that the registrant has no legitimate interest in the domain name; and third, that the domain name was registered and is being used in bad faith. The burden rests on the complainant throughout.
Under the CDRP, the complainant must hold a prior right that is recognized under Canadian law — which can include a registered trademark, a common law trademark arising from use in Canada, a personal name, or a trade name. This requirement reflects the CDRP's distinctly Canadian orientation and the eligibility restrictions on .ca registrations. The UDRP's scope is broader, operating as a global instrument applicable across participating gTLDs.
Cybersquatting
Cybersquatting is the bad-faith registration of a domain name that incorporates another party's trademark or name, typically with the intention of selling it to the legitimate owner at a premium, diverting Internet traffic, or tarnishing the brand. Classic examples include registering a well-known brand's name with a different TLD, registering deliberate misspellings of well-known domains (known as "typosquatting"), and registering domain names incorporating the personal names of prominent individuals.
Beyond the CDRP and UDRP, cybersquatting can give rise to trademark infringement claims, passing off claims, and, where the registered domain is used to publish defamatory content, defamation claims. Particularly where a cybersquatter is operating outside Canada or using multiple proxy registrations, early legal intervention — including injunctive relief — is often necessary to prevent ongoing damage to the brand.
Trademarks in Social Media
Trademark law under the Trademarks Act, R.S.C. 1985, c. T-13 protects brand owners from the unauthorized use of their marks, from the use of confusingly similar marks, and from conduct that depreciates the value of a mark. In the social media and Internet environment, these principles are tested constantly — through username squatting, impersonation, metatag manipulation, and keyword advertising.
Unauthorized Use: Squatting and Impersonation
Unauthorized trademark use on social media takes several forms. Username squatting — also known as social media cybersquatting — occurs when a third party registers a username consisting of another party's trademark or personal name, preventing the legitimate owner from establishing a presence under that name. Unlike domain name disputes, most social media platform dispute mechanisms are governed by the platform's own terms of service rather than by ICANN-sanctioned policies. Brand owners must familiarize themselves with the intellectual property enforcement policies of each platform they use before taking enforcement action, as those policies may not align with Canadian trademark law.
Impersonation goes a step further: a user creates an account purporting to represent an individual or company, then publishes content under that false identity for defamatory or commercially harmful purposes. Some social media platforms have implemented verification systems (such as blue-tick verification on X/Twitter and Instagram) to assist legitimate rights holders, but the effectiveness of these systems varies and platform-level enforcement is not a substitute for legal action where damages have already occurred.
Metatags are HTML elements embedded in a webpage's code that are not visible to ordinary visitors but are read by search engine crawlers and used to index the page. Including a competitor's registered trademark in a webpage's metatags — without displaying that trademark on the page itself — raises the question of whether this constitutes trademark infringement or passing off.
The Federal Court of Appeal considered whether a competitor's metatags incorporating the plaintiff's trademarks — where those trademarks were invisible on the defendant's webpage — constituted infringement or passing off. Both the Federal Court and the Federal Court of Appeal held that the use did not, on these facts, create a likelihood of confusion sufficient to establish infringement or passing off. However, the Federal Court of Appeal expressly noted that inserting a registered trademark in a metatag may constitute advertising of services giving rise to an infringement claim — leaving the door open depending on the circumstances of the display.
Keyword Advertising
Keyword advertising is the practice of purchasing search engine keywords — so that a business's advertisement appears when a user searches for a particular term — including, controversially, a competitor's trademark. The question is whether purchasing a competitor's trademark as a keyword constitutes passing off or trademark infringement.
The British Columbia Court of Appeal unanimously reversed the trial judge, holding that trademark confusion in the keyword advertising context occurs at the moment the consumer first encounters the trademark in search results — not at the point of clicking through and arriving at the advertiser's landing page. The Court granted a permanent injunction against the use of "VCC" and "VCCollege" on the Internet. However, the Court also confirmed that the mere act of bidding on a keyword does not, standing alone, constitute passing off: how the purchaser presents itself to the consumer in the resulting advertisement remains the critical inquiry.
The Federal Court has taken a nuanced position on the related practice of using a competitor's trademark as a hashtag, acknowledging conflicting approaches between the metatag and keyword advertising lines of authority without resolving the tension. The practical takeaway is that businesses bidding on competitors' keywords must pay close attention to how their advertisements are presented in the resulting search display — particularly the first impression a consumer will form upon seeing the results page.
Trademark Monitoring and Best Practices
Proactive trademark protection in the social media and Internet environment requires a combination of registration, monitoring, and policy enforcement. Best practices include:
- Register usernames incorporating the brand on all major platforms (Facebook, Instagram, X/Twitter, LinkedIn, TikTok, YouTube) immediately upon developing a new trademark — before a competitor or bad-faith actor can.
- Be aware that some platforms (including X/Twitter) will deactivate accounts after extended inactivity, creating windows of vulnerability for legitimate brand owners.
- Engage a brand protection service to systematically "watch" social media platforms for unauthorized and brand-damaging use — a practice known in the industry as social media watching.
- Register trademarks with the Trademark Clearinghouse, a global repository that provides notice to domain name registrants of potential conflicts through the Trademark Claims Service and allows priority registration through the Sunrise Service before new TLDs are opened to general registration.
- Note that Canada has eliminated the historical requirement that a trademark be used prior to registration, creating heightened risk of trademark trolling — particularly in the online space where marks may be visible before being registered. Early filing is more important than ever.
- Establish social media policies explicitly prohibiting employee use of third-party trademarks and intellectual property, which may assist in limiting employer liability for employee misconduct.
Worldwide Injunctions Against Search Engines
Canadian courts have demonstrated a willingness to grant injunctions with worldwide extraterritorial effect against search engines — a development of significant practical importance for brand and rights holders dealing with online infringement.
The Supreme Court of Canada upheld a worldwide interlocutory injunction requiring Google to delist specific websites from all of its search results globally — not merely from google.ca — where the defendant websites were selling counterfeit products in violation of trade secret and intellectual property rights. Google argued the British Columbia court lacked jurisdiction and the order was an unwarranted intrusion. The Supreme Court disagreed, holding that the court had jurisdiction in personam over Google based on its carrying on business in British Columbia, and that injunctions aimed at maintaining the rule of law are not limited to the parties to the litigation. The Court confirmed that where case-by-case URL removal results in an endless "whac-a-mole" pattern — as new infringing pages are generated automatically — a broader injunction against the search engine's indexing activity may be appropriate.
For businesses pursuing online intellectual property enforcement, the Equustek decision establishes that Canadian courts can compel search engines to take down not just specific URLs but categories of infringing content globally. Federal Court precedent also supports orders requiring parties using trademarks without authorization to transfer social media accounts incorporating those marks to the legitimate brand owner — a remedy that should be included in trademark litigation strategy from the outset.
Copyright in Social Media
Scope of Copyright
Copyright under the Copyright Act, R.S.C. 1985, c. C-42 is the sole right to produce, reproduce, perform, publish, or otherwise exercise specified rights in relation to original literary, dramatic, musical, and artistic works. Copyright arises automatically upon the creation of an original work, without registration. It encompasses not only reproduction rights but also moral rights — the right of an author to be or not to be associated with a work, and the right to the integrity of the work (i.e., the right to prevent modification or use in a manner prejudicial to the author's honour or reputation). Moral rights cannot be assigned but can be waived, and a copyright assignment does not operate as a waiver of moral rights.
In the social media context, virtually every piece of user-generated content — photographs, videos, written posts, graphic designs, musical compositions — is a copyright work as soon as it is created. The person who uploads content to a social media platform does not surrender copyright in that content simply by posting it; however, the platform's terms of service typically require the user to grant the platform a broad licence to host, display, reproduce, and distribute the content. The scope of that licence, and its interaction with Canadian copyright law, is a recurring area of dispute.
Fair Dealing: Parody, Satire, and User-Generated Content
The Copyright Act was significantly modernized in 2012 to expand the categories of activity qualifying as "fair dealing" — exceptions to copyright infringement that operate as complete defences. The newly added fair dealing activities of direct relevance to social media are:
01
Parody
The use of a copyrighted work to ridicule that work itself. Parody accounts and satirical posts ridiculing original content may qualify for this defence, provided the use is genuinely parodic of the original work rather than simply using the original as a vehicle to mock something else.
02
Satire
The use of a copyrighted work to mock something other than the original work itself — for example, using a song or image to make a political point. Many social media memes fall within this category, though the boundaries of the defence remain untested in Canadian courts.
03
Non-Commercial User-Generated Content
The so-called "mashup" or "YouTube exception" — the creation of a new work incorporating an existing work for non-commercial purposes, with acknowledgment of the source, that does not have a substantial adverse effect on the original work's market. This exception codifies the legality of remix culture, subject to strict non-commercial conditions.
To qualify as permissible non-commercial user-generated content, the Copyright Act requires that the activity: involve creation of a new work; use a published work in which the user reasonably believes no infringement is present; serve non-commercial purposes; acknowledge the source where reasonable; and not have a substantial adverse effect — financial or otherwise — on the exploitation of the underlying work, including by substituting for it in the market. The interaction between these statutory fair dealing provisions and platform-specific terms of use — which may be more or less permissive — requires careful analysis. A court may find copyright infringement notwithstanding that a platform's terms of use purport to permit a particular use.
Copyright Infringement Online
Canadian courts have awarded substantial damages for online copyright piracy and have developed the procedural tools necessary to identify infringing users. The Federal Court has awarded what is believed to be the largest copyright infringement damages award issued by Canadian courts — $10.5 million, including $10 million in statutory damages and $500,000 in punitive and exemplary damages — for unauthorized downloading, streaming, and copying of television episodes over the Internet, expressly citing the need for punishment and deterrence.
The Federal Court has also ordered Internet Service Providers (ISPs) to disclose subscriber information to rights holders pursuing claims against alleged infringers, subject to conditions designed to protect subscriber rights: the case must be specially managed; the plaintiff must pay the ISP's compliance costs; all correspondence must disclose the order and make clear that no court has yet ruled on the subscriber's liability; and subscriber information must remain confidential and not be disclosed publicly.
For infringement analysis, the Supreme Court of Canada in Cinar Corp. v. Robinson, 2013 SCC 73 confirmed that infringement must be assessed using a qualitative and holistic approach: the inquiry is whether a substantial portion of the originality in the plaintiff's work has been copied, assessed cumulatively across all copied features in the context of the whole original work. The Court's distinction between "perceptible" similarities (directly observable) and "intelligible" similarities (structural, atmospheric, or experiential) has particular relevance to website and mobile application interface design — an area of growing importance in online intellectual property disputes.
Technological Neutrality
The principle of technological neutrality holds that the Copyright Act should not be interpreted or applied to favour or discriminate against any particular method of delivering content to an end user. Where a new technology simply provides a more efficient means of doing something that was already legally permissible, it should not attract additional copyright royalties solely by virtue of using a different technological mechanism.
The Principle AppliedIn CBC v. SODRAC, 2015 SCC 57, the Supreme Court of Canada applied the technological neutrality principle to the determination of licence fees for broadcast-incidental copies — copies made by a broadcaster for technical operational reasons in the course of preparing a program for broadcast. The Court held that where the financial risks of adopting new technology are borne by the user and the reproduction of copyrighted works is merely incidental to the technological process, the balance principle implies relatively low licence fees. Decision-makers must compare the value derived from the reproduction across technologies and balance the rights of users and rights holders accordingly — not simply impose an additional layer of fees based on the method of delivery.
The technological neutrality principle has direct implications for Internet-based content delivery. The Supreme Court has confirmed that downloading a digital file is a reproduction, while streaming constitutes communication to the public by telecommunication — a distinction that affects which royalty regimes apply. The same logic applies to mobile applications, ringtone downloads, and other Internet-delivered content, and continues to be litigated as new delivery mechanisms emerge.
Patents in the Digital Context
Patents under the Patent Act, R.S.C. 1985, c. P-4 grant the patentee the exclusive right to make, construct, use, and sell the subject matter of an invention in exchange for public disclosure of that invention. In the social media and Internet context, the most commercially significant categories of patents are software patents and business method patents — both of which remain areas of evolving and uncertain law in Canada.
Business Method Patents
A business method patent is intended to protect an innovative way of conducting business. The leading Canadian authority is the Federal Court of Appeal's decision in Canada (Attorney General) v. Amazon.com, Inc., 2011 FCA 328, which considered Amazon's "one-click" ordering system — an interface allowing a customer to purchase goods with a single mouse click by using stored payment and shipping information. The Court declined to determine definitively whether the one-click system was patentable subject matter, but its analysis strongly suggested that both business methods and software could be patentable in appropriate circumstances. CIPO ultimately issued Amazon's one-click patent following the decision.
Following Amazon, CIPO rescinded its earlier practice notice and issued two replacement practice notices clarifying its approach to business method and computer-implemented inventions. The Patent Office confirmed that it no longer assesses patentability based on notions of "substance", "inventive concept", or "inventive contribution" — concepts that had been used to deny patents to software and business methods at the application stage.
Computer-Implemented Inventions
The patentability of computer-implemented inventions turns critically on whether the claimed invention amounts to something more than a mathematical calculation or an abstract idea. The Federal Court of Appeal's earlier decision in Schlumberger Canada Ltd. v. Commissioner of Patents (affirmed by Amazon) held that mathematical operations, as such, are not patentable. Patent Appeal Board decisions since Amazon have applied this framework in both directions: claims involving multi-node computer systems are more likely to constitute patentable subject matter than processes that occur entirely within a single computer.
The current test, as clarified by CIPO and the Patent Appeal Board, requires that a computer-implemented invention have a "physical existence" or "manifest a discernible effect or change" — that is, something more than a well-known instrument such as a computer merely implementing an abstract method or performing mathematical calculations. Claims that are primarily mathematical in nature, even when implemented on a computer, face a significant patentability challenge. Applicants in this space should engage patent counsel early in the development process to assess whether the invention can be claimed in a manner that satisfies the physicality requirement and to evaluate the strategic business case for a patent application.
Privacy Law and Social Media
Privacy law and social media intersect at multiple points: the collection and use of user data by platforms, the obligations of businesses that operate online, the use of personal information for targeted advertising, and the rights of individuals to control their digital footprint. For detailed discussion of privacy law in Ontario and the federal framework as it applies to individuals and organizations, see Grigoras Law's Privacy Law practice area. This section addresses the key statutory frameworks that apply to businesses operating in the social media and e-commerce environment.
PIPEDA and the Federal Privacy Framework
The Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA) is the primary federal statute governing how private-sector organizations collect, use, and disclose personal information in the course of commercial activities. PIPEDA applies to federally regulated organizations, to personal information collected in the course of interprovincial and international commercial activity, and to transactions involving personal information in provinces that have not enacted substantially similar provincial legislation — which currently includes Ontario. Organizations in Ontario engaged in commercial activities are therefore subject to PIPEDA for the collection, use, and disclosure of personal information.
PIPEDA is built on ten Fair Information Principles, which include: accountability (an organization is responsible for personal information in its control), identifying purposes (the purpose for collecting personal information must be identified at or before the time of collection), consent (knowledge and consent of the individual are required for collection, use, and disclosure), limiting collection, limiting use and disclosure, accuracy, safeguards, openness (policies and practices must be openly available), individual access, and challenging compliance. In the social media context, consent is the most frequently litigated principle: the question of what constitutes meaningful informed consent for the collection and use of personal data in connection with social media activity, targeted advertising, and the sharing of data with third parties has been the subject of ongoing investigation and enforcement by the Office of the Privacy Commissioner of Canada (OPC).
Bill C-27, the Digital Charter Implementation Act, proposes to replace PIPEDA with the Consumer Privacy Protection Act (CPPA) — a more rigorous framework that would significantly strengthen individual privacy rights and organizational obligations, including a right to data portability, enhanced consent requirements, higher administrative monetary penalties (up to the greater of $10 million or 3% of global revenue), and a private right of action for individuals following an OPC finding of a violation. The CPPA had not yet been proclaimed in force as of the knowledge cutoff for this guide; businesses should monitor legislative developments carefully.
Canada's Anti-Spam Legislation (CASL)
Canada's Anti-Spam Legislation (S.C. 2010, c. 23) came into force in 2014 and is among the strictest commercial electronic messaging regimes in the world. CASL prohibits the sending of commercial electronic messages (CEMs) to an electronic address — including email addresses, social media accounts, instant messages, and SMS — without the prior express or implied consent of the recipient. A CEM is broadly defined as any electronic message sent to an electronic address that, having regard to its content, links, or contact information, it would be reasonable to conclude is sent for a commercial purpose.
CASL imposes three core requirements on every CEM: consent (express or implied, obtained in accordance with prescribed conditions); identification (the sender must clearly identify themselves and any person on whose behalf the message is sent); and an unsubscribe mechanism (the message must contain a functioning mechanism allowing recipients to withdraw consent, effective within 10 business days). Express consent must be obtained in the prescribed manner and cannot be inferred from inaction. Implied consent arises in limited circumstances: an existing business relationship within the past two years, an inquiry made within the past six months, or a business card or electronic address publicly published without a restriction against receiving unsolicited messages.
CASL PenaltiesCASL imposes significant administrative monetary penalties: up to $1 million per violation for individuals and up to $10 million per violation for organizations. Directors, officers, and agents of a corporation can be held personally liable where they directed, authorized, or acquiesced in a violation. CASL also provides a private right of action for recipients of non-compliant CEMs, though the coming-into-force of that provision has been indefinitely delayed. Any business using email marketing, social media direct messaging, or push notifications for commercial purposes must comply with CASL at every stage of its campaigns.
Privacy Obligations for Businesses Online
For businesses operating websites, social media pages, or e-commerce platforms, privacy compliance requires a layered approach:
- Privacy policy: A publicly accessible, plain-language privacy policy disclosing what personal information is collected, how and why it is used, with whom it is shared, how it is protected, how long it is retained, and how individuals can access or correct their information.
- Cookie consent: Where cookies, tracking pixels, and similar technologies are used to collect personal information — including for behavioural advertising — meaningful consent must be obtained in advance, typically through a cookie consent banner with granular opt-in controls.
- Data breach notification: Under PIPEDA, organizations must notify the OPC and affected individuals of a breach of security safeguards involving personal information where it is reasonable to believe the breach creates a real risk of significant harm.
- Data minimization: Collect only the personal information necessary for the identified purposes — a principle that cuts against the social media ecosystem's tendency toward maximal data collection.
- Third-party disclosures: Where personal information is transferred to third-party processors (advertising platforms, analytics providers, payment processors), contractual safeguards must be in place and the privacy policy must disclose those transfers.
Electronic commerce has become a dominant channel for commercial activity in Canada. As of 2019, Canadian businesses reported over $305 billion in e-commerce sales, a figure that increased substantially during the COVID-19 pandemic and remains materially above pre-pandemic levels as a proportion of total retail sales. The legal frameworks governing e-commerce — the formation of online contracts, the validity of electronic signatures and records, and consumer protection obligations — are critical for any business operating in the online environment.
The Act excludes certain categories of documents from its scope, including wills, codicils, trusts created by wills, powers of attorney relating to property or personal care, documents creating or transferring interests in land, and negotiable instruments. Businesses engaged in e-commerce must identify which of their standard transaction documents may fall within these exclusions and ensure that separate compliant processes exist for them.
The general principles of contract law — offer, acceptance, consideration, and intention to create legal relations — apply to online contracts. The digital medium, however, raises particular issues about when and where a contract is formed, and whether the parties have genuinely assented to contractual terms.
A hybrid model — sometimes called "sign-in wrap" — presents terms at the point of account creation: the user is informed that creating an account constitutes acceptance of the linked terms. Courts assess these agreements based on the prominence of the disclosure and the clarity of the notice that account creation equals acceptance. The more clearly the terms are brought to the user's attention before the critical action occurs, the more likely a court is to enforce the agreement.
Terms of use (also called terms of service) are the contractual foundation governing the relationship between a platform or website operator and its users. A well-drafted terms of use agreement addresses:
Terms of use must be read against the backdrop of consumer protection legislation, which in Ontario imposes mandatory standards that cannot be contracted out of. The Consumer Protection Act, 2002, S.O. 2002, c. 30, Sch. A applies to contracts for goods and services made with consumers in Ontario, including distance contracts (such as contracts made over the Internet), and contains specific disclosure requirements for e-commerce transactions that cannot be waived in favour of the operator.
The consumer must have the opportunity to accept or decline the agreement and to correct errors immediately before the order is submitted. Failure to comply with these disclosure requirements entitles the consumer to cancel the agreement within a prescribed period. Operators of e-commerce platforms with Ontario consumers must audit their checkout and agreement flows carefully to ensure compliance.
The term "virtual property" encompasses forms of property made possible by the Internet and digital technologies — property that has no physical analogue and cannot exist independently of the digital environment. This is to be distinguished from "intangible property" in the broader, traditional sense (which includes intellectual property, goodwill, and similar rights with a long history of legal recognition). Virtual property, in the narrower sense used here, refers to property types that are uniquely digital: items existing within online games and virtual worlds, digital currencies, and non-fungible tokens (NFTs).
The boundaries of this category remain unsettled, partly because the law has not yet fully resolved whether virtual property rights give rise to legal interests that can be enforced in court, passed on through estates, or transferred in commercial transactions without restriction. The challenge is compounded by the fact that virtual property typically exists within privately controlled platforms — games, virtual worlds, digital exchanges — whose operators impose contractual terms that may purport to limit or eliminate user property rights.
Notwithstanding legal uncertainty, virtual property has matured into a commercially significant market. Virtual goods — items with value that exist exclusively within online games and platforms, such as avatar customizations, in-game currency, weapons, real estate within virtual worlds, and collectible digital items — represent a multi-billion-dollar global industry. Within virtual worlds such as Second Life, users have transferred hundreds of millions of U.S. dollars' worth of in-game assets. Social gaming revenues driven primarily by the sale of virtual goods have exceeded comparable revenues from physical goods in certain market segments.
Legal disputes involving virtual property have included: claims for breach of contract where platforms have unilaterally deleted user accounts and their associated assets; tort claims for conversion where virtual items have been stolen through unauthorized account access; and disputes over whether virtual currency acquired through gameplay constitutes taxable income. Canadian courts have not yet comprehensively addressed these questions, but the volume of transactions and their commercial significance makes eventual judicial and legislative engagement inevitable.
Crypto-assets — including cryptocurrencies such as Bitcoin and Ether, stablecoins, and non-fungible tokens — represent a distinct and rapidly evolving category of digital asset. Unlike in-game virtual property, crypto-assets are typically designed to operate independently of any single platform or operator, using distributed ledger (blockchain) technology to maintain records of ownership and transfers. Their defining characteristics are decentralization, pseudonymity, and — in most implementations — a fixed or algorithmically constrained supply.
The legal classification of crypto-assets varies by use and structure. The Canadian Securities Administrators (CSA) have taken the position that many crypto-assets — particularly those sold in initial coin offerings (ICOs) and initial token offerings (ITOs) that involve investors expecting a return from the efforts of others — constitute securities subject to registration and prospectus requirements under provincial securities legislation. Crypto-asset trading platforms dealing in such assets must be registered as dealers or exchanges. For a comprehensive analysis of crypto-asset securities regulation, see Grigoras Law's Capital Markets & Securities practice area.
Beyond securities regulation, crypto-assets raise questions in property law (can they be the subject of an equitable lien or a Mareva injunction?), contract law (what is the enforceability of smart contracts?), insolvency law (how are crypto-asset holdings treated in a bankruptcy?), and estate law (how are crypto-assets administered on death, and what happens when private keys are lost?).
The Canada Revenue Agency (CRA) has issued guidance confirming that crypto-currencies are treated as a commodity for Canadian income tax purposes — not as legal tender. This has several important implications:
The taxation of virtual goods within games and virtual worlds — items that cannot be converted into fiat currency or used outside the virtual environment — is treated differently by the CRA. In general, purely in-game virtual items that are not convertible into real-world currency are not treated as giving rise to taxable income. However, where a user is generating real-world income by buying and selling in-game assets or virtual currency that can be converted to fiat currency, income tax obligations arise and must be reported accordingly.
Table of Contents ▼
Social Media Policies
There is no such thing as a risk-free presence in the social media space. For businesses, individuals, and organizations that operate on social platforms — whether as brand owners, content publishers, advertisers, or employers — the absence of well-crafted policies creates exposure across a broad range of legal disciplines. Three categories of policy address the most significant risks: posting policies, moderation policies, and employment policies. Each serves a distinct protective function, and collectively they form the legal foundation for any responsible online presence.
Posting Policies
A posting policy is a public-facing document that governs the rules of engagement for users who wish to contribute content to a social media website or page. It must clearly outline the rights and obligations of participating users. Because brand owners often resist burdening their audience with dense legal text, best practice is to display a brief summary on the main page — with a link to a more comprehensive policy — making it accessible without being intrusive.
A legally sound posting policy should address the following core elements:
Moderation Policies
Moderation in the social media space is a double-edged sword. Failing to moderate leaves defamatory, unlawful, or brand-damaging content visible to the public; over-moderating risks alienating users and creating the perception of censorship. The challenge is compounded by the fact that comments appearing on a brand's page — even with disclaimers — can appear to carry the brand's tacit endorsement.
A moderation policy must define: the categories of content that will be removed; the procedures by which removal decisions are made and escalated; and the persons responsible for each category of concern. A casual complaint about a product can typically be handled by a trained moderator. A sensitive political matter, a claim of health harm, or an allegation implicating the company in ongoing litigation should be escalated immediately to legal counsel or senior management. The policy must identify those escalation pathways explicitly — not merely in general terms.
Effective moderators must internalize several principles when engaging with users. Every response is public. Responses should be timely, personal, and written in plain language — avoiding legal terms, jargon, and cookie-cutter phrasing. Social media users place a premium on transparency and will disengage from pages perceived as heavily censored. At the same time, some content simply cannot remain online: harassment, defamatory statements, content infringing third-party intellectual property, and spam all warrant prompt removal.
Defamatory content posted by third parties on a brand's social media page raises urgent legal questions about takedown obligations and platform liability. Grigoras Law handles online defamation and reputation management matters, including targeted injunctions and strategic claims where defamatory posts cause measurable reputational or economic harm.
Employment Policies
Social media communications made by employees — even on personal accounts and outside working hours — can cause significant reputational damage to an employer. An employee's casual Facebook post identifying their employer and voicing dissatisfaction, or a video uploaded by a staff member depicting workplace misconduct, can reach millions of viewers within hours. The penalties for employees can range from suspension and dismissal to criminal charges. For employers, the consequences can include damage to goodwill, regulatory scrutiny, and litigation.
A comprehensive employment policy governing social media use must address the following:
Employment Issues and Social Media
Employment and social media law intersect at several critical points. Many employees are required to use the Internet and social media as part of their work. The law's conceptualization of property in this context is evolving rapidly, and employers who have not proactively addressed social media in their employment agreements, collective agreements, and policies face meaningful legal risk — particularly with respect to ownership of accounts and confidential contacts, and the use of social media in pre-employment screening.
Employment Contracts and Social Media
Appropriately drafted employment contracts and collective agreements provide the strongest available protection for an employer's interests in social media assets. A contract provision should expressly stipulate that all social media accounts created by the employee or employer for the purpose of carrying out the employer's business remain the exclusive property of the employer — both during and after the employment relationship. Such a provision can be incorporated within a broader clause addressing the ownership of employer-provided devices and the obligation to return company property at the end of employment.
In unionized workplaces, equivalent protections can be negotiated into the collective agreement. The benefit of addressing ownership in these instruments is twofold: it sets clear expectations at the outset of the relationship and provides a legal basis for enforcement in the event of a breach.
Background Checks
The use of social media in pre-employment background screening raises significant legal risks that employers must navigate carefully. The principal concern is that a review of a candidate's public social media profile will expose the employer to information about a prohibited ground of discrimination under the Ontario Human Rights Code — including disability, sexual orientation, ethnic origin, or family status — which could give rise to a human rights complaint if the candidate is not hired.
Where criminal background checks are required, Canadian arbitral and tribunal decisions have consistently held that such checks must be connected to a genuine and demonstrable occupational requirement. In Ottawa (City) v. Ottawa Professional Firefighters Association, arbitrator Picher held that an employer has no inherent entitlement to the criminal histories of its employees: the nature of the job must itself give rise to the requirement, such as roles involving close contact with children or vulnerable adults, or positions with access to sensitive financial or security systems.
When conducting social media background checks, employers should limit themselves to publicly available information, refrain from attempting to circumvent privacy settings or connect with candidates under false pretenses, and carefully document their screening process. The mere fact that an employee uses social media as part of their role is generally insufficient justification for mandatory criminal record checks.
Ownership of Social Media Accounts and Contacts
The ownership of social media accounts and the contacts associated with them — particularly LinkedIn connections and Twitter/X followers built during employment — is one of the most contentious emerging issues in Canadian employment law. Canadian courts have not yet definitively resolved this question, although the issue has been heavily litigated in the United States.
An employee who built a Twitter following of 17,000 under an employer-associated account was sued for trade secret misappropriation and unjust enrichment after leaving his employer and renaming the account. The employer valued the contacts at $42,500 per month. Although the case settled without a judicial ruling on the merits, it opened a significant dialogue about the legal status of social media audiences built during employment — and the danger of failing to address this contractually before a dispute arises.
A senior executive was terminated and her former employer immediately accessed and locked her LinkedIn account, which she had maintained under employer guidelines but without a formal ownership policy. The court held that misappropriation of identity and privacy claims were made out, but declined to award damages for want of proof. The lesson for Canadian employers and employees alike is that contractual clarity — at the outset of the employment relationship — is essential.
In the absence of Canadian authority directly on point, the prudent approach for employers is to address account and contact ownership expressly in employment agreements, ensure that accounts used for business purposes are registered to the company and not to individual employees, and use role-specific email addresses (such as domainnameclerk@company.com) for all domain and account registrations.
Domain Names
What is a Domain Name?
A domain name is a memorable address that identifies a website or other location on the Internet, representing an Internet Protocol (IP) address in the Domain Name System (DNS). The DNS translates domain names into the corresponding IP addresses and routes Internet traffic accordingly. It also enables email delivery, connecting outgoing messages to their intended recipients. Because IP addresses are complicated strings of numbers that are difficult to remember, domain names function as mnemonic devices: rather than typing the raw IP address for a website, users type the domain name instead.
Domain names are divided into hierarchical parts. The component to the right of the final dot is the Top-Level Domain (TLD). Generic TLDs (gTLDs) include .com, .net, .org, and an expanding range of new extensions; country-code TLDs (ccTLDs) are assigned to particular jurisdictions, with .ca being Canada's ccTLD, administered by the Canadian Internet Registration Authority (CIRA). The second-level domain — the part immediately to the left of the TLD — is typically what registrants register. The domain name system is overseen globally by the Internet Corporation for Assigned Names and Numbers (ICANN), which has dramatically expanded the number of available TLDs in recent years.
Domain Names as Property
Registries and registrars have historically taken the position that domain names are not property. CIRA's Registrant Agreement, for instance, expressly states that a domain name registration does not create any proprietary right. However, Canadian courts have pushed back against this characterization in significant ways.
The Ontario Court of Appeal held that domain names and personal property share many fundamental characteristics, and that a domain name can be considered "personal property" under Ontario law. The court observed that the registered owner of a domain name has the right to exclusively direct traffic to the corresponding website and to exclude anyone else from using the same name — a hallmark attribute of property rights. Because the bundle of rights associated with a domain name satisfies the standard indicia of property, the Court concluded it qualifies as personal property enforceable against all others.
The characterization of domain names as property has important downstream consequences: it supports the use of proprietary claims in litigation, enables domain names to be treated as assets in corporate transactions, and provides a foundation for injunctive relief where domain names are transferred or used in breach of contract. Canadian courts have also held that a domain name can be corporate property even if it was registered in the name of an individual employee or contractor — a consideration that reinforces the importance of proper registration practices.
Registration Requirements and Portfolio Management
Domain names are generally available on a first-come, first-served basis. To register a domain name, the registrant must agree to the relevant registry's terms and conditions, which typically require: accurate contact information; a representation that the domain name and its proposed use will not violate applicable laws or third-party rights; and agreement to submit to the applicable dispute resolution policy in the event of a trademark conflict.
For .ca domain names, CIRA imposes Canadian Presence Requirements, restricting registrations to Canadian citizens, permanent residents, corporations incorporated in Canada, and certain other qualifying entities. This represents a material eligibility restriction that does not apply to gTLDs such as .com.
Sound portfolio management requires several disciplines:
Domain Name Disputes: CDRP and UDRP
Where a domain name has been registered by a third party in bad faith, specialized dispute resolution mechanisms exist to reclaim it — often faster and less expensively than conventional litigation.
Under both the CDRP and the UDRP, the complainant must establish three elements to succeed: first, that the disputed domain name is identical or confusingly similar to a trademark or other right in which the complainant has an interest; second, that the registrant has no legitimate interest in the domain name; and third, that the domain name was registered and is being used in bad faith. The burden rests on the complainant throughout.
Under the CDRP, the complainant must hold a prior right that is recognized under Canadian law — which can include a registered trademark, a common law trademark arising from use in Canada, a personal name, or a trade name. This requirement reflects the CDRP's distinctly Canadian orientation and the eligibility restrictions on .ca registrations. The UDRP's scope is broader, operating as a global instrument applicable across participating gTLDs.
Cybersquatting
Cybersquatting is the bad-faith registration of a domain name that incorporates another party's trademark or name, typically with the intention of selling it to the legitimate owner at a premium, diverting Internet traffic, or tarnishing the brand. Classic examples include registering a well-known brand's name with a different TLD, registering deliberate misspellings of well-known domains (known as "typosquatting"), and registering domain names incorporating the personal names of prominent individuals.
Beyond the CDRP and UDRP, cybersquatting can give rise to trademark infringement claims, passing off claims, and, where the registered domain is used to publish defamatory content, defamation claims. Particularly where a cybersquatter is operating outside Canada or using multiple proxy registrations, early legal intervention — including injunctive relief — is often necessary to prevent ongoing damage to the brand.
Trademarks in Social Media
Trademark law under the Trademarks Act, R.S.C. 1985, c. T-13 protects brand owners from the unauthorized use of their marks, from the use of confusingly similar marks, and from conduct that depreciates the value of a mark. In the social media and Internet environment, these principles are tested constantly — through username squatting, impersonation, metatag manipulation, and keyword advertising.
Unauthorized Use: Squatting and Impersonation
Unauthorized trademark use on social media takes several forms. Username squatting — also known as social media cybersquatting — occurs when a third party registers a username consisting of another party's trademark or personal name, preventing the legitimate owner from establishing a presence under that name. Unlike domain name disputes, most social media platform dispute mechanisms are governed by the platform's own terms of service rather than by ICANN-sanctioned policies. Brand owners must familiarize themselves with the intellectual property enforcement policies of each platform they use before taking enforcement action, as those policies may not align with Canadian trademark law.
Impersonation goes a step further: a user creates an account purporting to represent an individual or company, then publishes content under that false identity for defamatory or commercially harmful purposes. Some social media platforms have implemented verification systems (such as blue-tick verification on X/Twitter and Instagram) to assist legitimate rights holders, but the effectiveness of these systems varies and platform-level enforcement is not a substitute for legal action where damages have already occurred.
Metatags
Metatags are HTML elements embedded in a webpage's code that are not visible to ordinary visitors but are read by search engine crawlers and used to index the page. Including a competitor's registered trademark in a webpage's metatags — without displaying that trademark on the page itself — raises the question of whether this constitutes trademark infringement or passing off.
The Federal Court of Appeal considered whether a competitor's metatags incorporating the plaintiff's trademarks — where those trademarks were invisible on the defendant's webpage — constituted infringement or passing off. Both the Federal Court and the Federal Court of Appeal held that the use did not, on these facts, create a likelihood of confusion sufficient to establish infringement or passing off. However, the Federal Court of Appeal expressly noted that inserting a registered trademark in a metatag may constitute advertising of services giving rise to an infringement claim — leaving the door open depending on the circumstances of the display.
Keyword Advertising
Keyword advertising is the practice of purchasing search engine keywords — so that a business's advertisement appears when a user searches for a particular term — including, controversially, a competitor's trademark. The question is whether purchasing a competitor's trademark as a keyword constitutes passing off or trademark infringement.
The British Columbia Court of Appeal unanimously reversed the trial judge, holding that trademark confusion in the keyword advertising context occurs at the moment the consumer first encounters the trademark in search results — not at the point of clicking through and arriving at the advertiser's landing page. The Court granted a permanent injunction against the use of "VCC" and "VCCollege" on the Internet. However, the Court also confirmed that the mere act of bidding on a keyword does not, standing alone, constitute passing off: how the purchaser presents itself to the consumer in the resulting advertisement remains the critical inquiry.
The Federal Court has taken a nuanced position on the related practice of using a competitor's trademark as a hashtag, acknowledging conflicting approaches between the metatag and keyword advertising lines of authority without resolving the tension. The practical takeaway is that businesses bidding on competitors' keywords must pay close attention to how their advertisements are presented in the resulting search display — particularly the first impression a consumer will form upon seeing the results page.
Trademark Monitoring and Best Practices
Proactive trademark protection in the social media and Internet environment requires a combination of registration, monitoring, and policy enforcement. Best practices include:
Worldwide Injunctions Against Search Engines
Canadian courts have demonstrated a willingness to grant injunctions with worldwide extraterritorial effect against search engines — a development of significant practical importance for brand and rights holders dealing with online infringement.
The Supreme Court of Canada upheld a worldwide interlocutory injunction requiring Google to delist specific websites from all of its search results globally — not merely from google.ca — where the defendant websites were selling counterfeit products in violation of trade secret and intellectual property rights. Google argued the British Columbia court lacked jurisdiction and the order was an unwarranted intrusion. The Supreme Court disagreed, holding that the court had jurisdiction in personam over Google based on its carrying on business in British Columbia, and that injunctions aimed at maintaining the rule of law are not limited to the parties to the litigation. The Court confirmed that where case-by-case URL removal results in an endless "whac-a-mole" pattern — as new infringing pages are generated automatically — a broader injunction against the search engine's indexing activity may be appropriate.
For businesses pursuing online intellectual property enforcement, the Equustek decision establishes that Canadian courts can compel search engines to take down not just specific URLs but categories of infringing content globally. Federal Court precedent also supports orders requiring parties using trademarks without authorization to transfer social media accounts incorporating those marks to the legitimate brand owner — a remedy that should be included in trademark litigation strategy from the outset.
Copyright in Social Media
Scope of Copyright
Copyright under the Copyright Act, R.S.C. 1985, c. C-42 is the sole right to produce, reproduce, perform, publish, or otherwise exercise specified rights in relation to original literary, dramatic, musical, and artistic works. Copyright arises automatically upon the creation of an original work, without registration. It encompasses not only reproduction rights but also moral rights — the right of an author to be or not to be associated with a work, and the right to the integrity of the work (i.e., the right to prevent modification or use in a manner prejudicial to the author's honour or reputation). Moral rights cannot be assigned but can be waived, and a copyright assignment does not operate as a waiver of moral rights.
In the social media context, virtually every piece of user-generated content — photographs, videos, written posts, graphic designs, musical compositions — is a copyright work as soon as it is created. The person who uploads content to a social media platform does not surrender copyright in that content simply by posting it; however, the platform's terms of service typically require the user to grant the platform a broad licence to host, display, reproduce, and distribute the content. The scope of that licence, and its interaction with Canadian copyright law, is a recurring area of dispute.
Fair Dealing: Parody, Satire, and User-Generated Content
The Copyright Act was significantly modernized in 2012 to expand the categories of activity qualifying as "fair dealing" — exceptions to copyright infringement that operate as complete defences. The newly added fair dealing activities of direct relevance to social media are:
The use of a copyrighted work to ridicule that work itself. Parody accounts and satirical posts ridiculing original content may qualify for this defence, provided the use is genuinely parodic of the original work rather than simply using the original as a vehicle to mock something else.
The use of a copyrighted work to mock something other than the original work itself — for example, using a song or image to make a political point. Many social media memes fall within this category, though the boundaries of the defence remain untested in Canadian courts.
The so-called "mashup" or "YouTube exception" — the creation of a new work incorporating an existing work for non-commercial purposes, with acknowledgment of the source, that does not have a substantial adverse effect on the original work's market. This exception codifies the legality of remix culture, subject to strict non-commercial conditions.
To qualify as permissible non-commercial user-generated content, the Copyright Act requires that the activity: involve creation of a new work; use a published work in which the user reasonably believes no infringement is present; serve non-commercial purposes; acknowledge the source where reasonable; and not have a substantial adverse effect — financial or otherwise — on the exploitation of the underlying work, including by substituting for it in the market. The interaction between these statutory fair dealing provisions and platform-specific terms of use — which may be more or less permissive — requires careful analysis. A court may find copyright infringement notwithstanding that a platform's terms of use purport to permit a particular use.
Copyright Infringement Online
Canadian courts have awarded substantial damages for online copyright piracy and have developed the procedural tools necessary to identify infringing users. The Federal Court has awarded what is believed to be the largest copyright infringement damages award issued by Canadian courts — $10.5 million, including $10 million in statutory damages and $500,000 in punitive and exemplary damages — for unauthorized downloading, streaming, and copying of television episodes over the Internet, expressly citing the need for punishment and deterrence.
The Federal Court has also ordered Internet Service Providers (ISPs) to disclose subscriber information to rights holders pursuing claims against alleged infringers, subject to conditions designed to protect subscriber rights: the case must be specially managed; the plaintiff must pay the ISP's compliance costs; all correspondence must disclose the order and make clear that no court has yet ruled on the subscriber's liability; and subscriber information must remain confidential and not be disclosed publicly.
For infringement analysis, the Supreme Court of Canada in Cinar Corp. v. Robinson, 2013 SCC 73 confirmed that infringement must be assessed using a qualitative and holistic approach: the inquiry is whether a substantial portion of the originality in the plaintiff's work has been copied, assessed cumulatively across all copied features in the context of the whole original work. The Court's distinction between "perceptible" similarities (directly observable) and "intelligible" similarities (structural, atmospheric, or experiential) has particular relevance to website and mobile application interface design — an area of growing importance in online intellectual property disputes.
Technological Neutrality
The principle of technological neutrality holds that the Copyright Act should not be interpreted or applied to favour or discriminate against any particular method of delivering content to an end user. Where a new technology simply provides a more efficient means of doing something that was already legally permissible, it should not attract additional copyright royalties solely by virtue of using a different technological mechanism.
In CBC v. SODRAC, 2015 SCC 57, the Supreme Court of Canada applied the technological neutrality principle to the determination of licence fees for broadcast-incidental copies — copies made by a broadcaster for technical operational reasons in the course of preparing a program for broadcast. The Court held that where the financial risks of adopting new technology are borne by the user and the reproduction of copyrighted works is merely incidental to the technological process, the balance principle implies relatively low licence fees. Decision-makers must compare the value derived from the reproduction across technologies and balance the rights of users and rights holders accordingly — not simply impose an additional layer of fees based on the method of delivery.
The technological neutrality principle has direct implications for Internet-based content delivery. The Supreme Court has confirmed that downloading a digital file is a reproduction, while streaming constitutes communication to the public by telecommunication — a distinction that affects which royalty regimes apply. The same logic applies to mobile applications, ringtone downloads, and other Internet-delivered content, and continues to be litigated as new delivery mechanisms emerge.
Patents in the Digital Context
Patents under the Patent Act, R.S.C. 1985, c. P-4 grant the patentee the exclusive right to make, construct, use, and sell the subject matter of an invention in exchange for public disclosure of that invention. In the social media and Internet context, the most commercially significant categories of patents are software patents and business method patents — both of which remain areas of evolving and uncertain law in Canada.
Business Method Patents
A business method patent is intended to protect an innovative way of conducting business. The leading Canadian authority is the Federal Court of Appeal's decision in Canada (Attorney General) v. Amazon.com, Inc., 2011 FCA 328, which considered Amazon's "one-click" ordering system — an interface allowing a customer to purchase goods with a single mouse click by using stored payment and shipping information. The Court declined to determine definitively whether the one-click system was patentable subject matter, but its analysis strongly suggested that both business methods and software could be patentable in appropriate circumstances. CIPO ultimately issued Amazon's one-click patent following the decision.
Following Amazon, CIPO rescinded its earlier practice notice and issued two replacement practice notices clarifying its approach to business method and computer-implemented inventions. The Patent Office confirmed that it no longer assesses patentability based on notions of "substance", "inventive concept", or "inventive contribution" — concepts that had been used to deny patents to software and business methods at the application stage.
Computer-Implemented Inventions
The patentability of computer-implemented inventions turns critically on whether the claimed invention amounts to something more than a mathematical calculation or an abstract idea. The Federal Court of Appeal's earlier decision in Schlumberger Canada Ltd. v. Commissioner of Patents (affirmed by Amazon) held that mathematical operations, as such, are not patentable. Patent Appeal Board decisions since Amazon have applied this framework in both directions: claims involving multi-node computer systems are more likely to constitute patentable subject matter than processes that occur entirely within a single computer.
The current test, as clarified by CIPO and the Patent Appeal Board, requires that a computer-implemented invention have a "physical existence" or "manifest a discernible effect or change" — that is, something more than a well-known instrument such as a computer merely implementing an abstract method or performing mathematical calculations. Claims that are primarily mathematical in nature, even when implemented on a computer, face a significant patentability challenge. Applicants in this space should engage patent counsel early in the development process to assess whether the invention can be claimed in a manner that satisfies the physicality requirement and to evaluate the strategic business case for a patent application.
Privacy Law and Social Media
Privacy law and social media intersect at multiple points: the collection and use of user data by platforms, the obligations of businesses that operate online, the use of personal information for targeted advertising, and the rights of individuals to control their digital footprint. For detailed discussion of privacy law in Ontario and the federal framework as it applies to individuals and organizations, see Grigoras Law's Privacy Law practice area. This section addresses the key statutory frameworks that apply to businesses operating in the social media and e-commerce environment.
PIPEDA and the Federal Privacy Framework
The Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA) is the primary federal statute governing how private-sector organizations collect, use, and disclose personal information in the course of commercial activities. PIPEDA applies to federally regulated organizations, to personal information collected in the course of interprovincial and international commercial activity, and to transactions involving personal information in provinces that have not enacted substantially similar provincial legislation — which currently includes Ontario. Organizations in Ontario engaged in commercial activities are therefore subject to PIPEDA for the collection, use, and disclosure of personal information.
PIPEDA is built on ten Fair Information Principles, which include: accountability (an organization is responsible for personal information in its control), identifying purposes (the purpose for collecting personal information must be identified at or before the time of collection), consent (knowledge and consent of the individual are required for collection, use, and disclosure), limiting collection, limiting use and disclosure, accuracy, safeguards, openness (policies and practices must be openly available), individual access, and challenging compliance. In the social media context, consent is the most frequently litigated principle: the question of what constitutes meaningful informed consent for the collection and use of personal data in connection with social media activity, targeted advertising, and the sharing of data with third parties has been the subject of ongoing investigation and enforcement by the Office of the Privacy Commissioner of Canada (OPC).
Bill C-27, the Digital Charter Implementation Act, proposes to replace PIPEDA with the Consumer Privacy Protection Act (CPPA) — a more rigorous framework that would significantly strengthen individual privacy rights and organizational obligations, including a right to data portability, enhanced consent requirements, higher administrative monetary penalties (up to the greater of $10 million or 3% of global revenue), and a private right of action for individuals following an OPC finding of a violation. The CPPA had not yet been proclaimed in force as of the knowledge cutoff for this guide; businesses should monitor legislative developments carefully.
Canada's Anti-Spam Legislation (CASL)
Canada's Anti-Spam Legislation (S.C. 2010, c. 23) came into force in 2014 and is among the strictest commercial electronic messaging regimes in the world. CASL prohibits the sending of commercial electronic messages (CEMs) to an electronic address — including email addresses, social media accounts, instant messages, and SMS — without the prior express or implied consent of the recipient. A CEM is broadly defined as any electronic message sent to an electronic address that, having regard to its content, links, or contact information, it would be reasonable to conclude is sent for a commercial purpose.
CASL imposes three core requirements on every CEM: consent (express or implied, obtained in accordance with prescribed conditions); identification (the sender must clearly identify themselves and any person on whose behalf the message is sent); and an unsubscribe mechanism (the message must contain a functioning mechanism allowing recipients to withdraw consent, effective within 10 business days). Express consent must be obtained in the prescribed manner and cannot be inferred from inaction. Implied consent arises in limited circumstances: an existing business relationship within the past two years, an inquiry made within the past six months, or a business card or electronic address publicly published without a restriction against receiving unsolicited messages.
CASL imposes significant administrative monetary penalties: up to $1 million per violation for individuals and up to $10 million per violation for organizations. Directors, officers, and agents of a corporation can be held personally liable where they directed, authorized, or acquiesced in a violation. CASL also provides a private right of action for recipients of non-compliant CEMs, though the coming-into-force of that provision has been indefinitely delayed. Any business using email marketing, social media direct messaging, or push notifications for commercial purposes must comply with CASL at every stage of its campaigns.
Privacy Obligations for Businesses Online
For businesses operating websites, social media pages, or e-commerce platforms, privacy compliance requires a layered approach:
E-Commerce and Online Agreements
Electronic commerce has become a dominant channel for commercial activity in Canada. As of 2019, Canadian businesses reported over $305 billion in e-commerce sales, a figure that increased substantially during the COVID-19 pandemic and remains materially above pre-pandemic levels as a proportion of total retail sales. The legal frameworks governing e-commerce — the formation of online contracts, the validity of electronic signatures and records, and consumer protection obligations — are critical for any business operating in the online environment.
The Electronic Commerce Act, 2000
Ontario's Electronic Commerce Act, 2000, S.O. 2000, c. 17 provides the foundational statutory framework for electronic transactions in the province. Its central purpose is to remove legal uncertainty about the validity of electronic contracts, electronic signatures, and electronic records — resolving the common law concern that a contract formed entirely through electronic means might be unenforceable for want of a "writing" or a "signature".
The Act establishes several key principles:
The Act excludes certain categories of documents from its scope, including wills, codicils, trusts created by wills, powers of attorney relating to property or personal care, documents creating or transferring interests in land, and negotiable instruments. Businesses engaged in e-commerce must identify which of their standard transaction documents may fall within these exclusions and ensure that separate compliant processes exist for them.
Formation of Online Contracts
The general principles of contract law — offer, acceptance, consideration, and intention to create legal relations — apply to online contracts. The digital medium, however, raises particular issues about when and where a contract is formed, and whether the parties have genuinely assented to contractual terms.
Two primary models of online contract formation are commonly used:
The user is presented with the terms of the agreement and must affirmatively click a button ("I Agree", "Accept", or equivalent) before proceeding. Clickwrap agreements receive the highest level of judicial recognition because the user has taken an unambiguous, affirmative action to manifest assent to the terms. Courts have consistently enforced clickwrap agreements where the terms were reasonably accessible and the acceptance mechanism was clear.
The terms are made available by hyperlink at the bottom of a webpage, and the user is deemed to accept them merely by using the site — without any affirmative act of acceptance. Browsewrap agreements receive considerably less judicial deference. Courts scrutinize whether the user had actual or constructive notice of the terms and whether the terms were sufficiently prominent that a reasonable user would understand their conduct constituted acceptance.
A hybrid model — sometimes called "sign-in wrap" — presents terms at the point of account creation: the user is informed that creating an account constitutes acceptance of the linked terms. Courts assess these agreements based on the prominence of the disclosure and the clarity of the notice that account creation equals acceptance. The more clearly the terms are brought to the user's attention before the critical action occurs, the more likely a court is to enforce the agreement.
Terms of Use and Terms of Service
Terms of use (also called terms of service) are the contractual foundation governing the relationship between a platform or website operator and its users. A well-drafted terms of use agreement addresses:
Terms of use must be read against the backdrop of consumer protection legislation, which in Ontario imposes mandatory standards that cannot be contracted out of. The Consumer Protection Act, 2002, S.O. 2002, c. 30, Sch. A applies to contracts for goods and services made with consumers in Ontario, including distance contracts (such as contracts made over the Internet), and contains specific disclosure requirements for e-commerce transactions that cannot be waived in favour of the operator.
Consumer Protection Online
The Consumer Protection Act, 2002 imposes specific requirements on internet agreements — contracts entered into through the Internet where the consumer is not in the same physical location as the supplier when the agreement is made. An internet agreement must disclose, before the consumer enters the agreement:
The consumer must have the opportunity to accept or decline the agreement and to correct errors immediately before the order is submitted. Failure to comply with these disclosure requirements entitles the consumer to cancel the agreement within a prescribed period. Operators of e-commerce platforms with Ontario consumers must audit their checkout and agreement flows carefully to ensure compliance.
Virtual Property and Digital Assets
Defining Virtual Property
The term "virtual property" encompasses forms of property made possible by the Internet and digital technologies — property that has no physical analogue and cannot exist independently of the digital environment. This is to be distinguished from "intangible property" in the broader, traditional sense (which includes intellectual property, goodwill, and similar rights with a long history of legal recognition). Virtual property, in the narrower sense used here, refers to property types that are uniquely digital: items existing within online games and virtual worlds, digital currencies, and non-fungible tokens (NFTs).
The boundaries of this category remain unsettled, partly because the law has not yet fully resolved whether virtual property rights give rise to legal interests that can be enforced in court, passed on through estates, or transferred in commercial transactions without restriction. The challenge is compounded by the fact that virtual property typically exists within privately controlled platforms — games, virtual worlds, digital exchanges — whose operators impose contractual terms that may purport to limit or eliminate user property rights.
Virtual Goods as a Market
Notwithstanding legal uncertainty, virtual property has matured into a commercially significant market. Virtual goods — items with value that exist exclusively within online games and platforms, such as avatar customizations, in-game currency, weapons, real estate within virtual worlds, and collectible digital items — represent a multi-billion-dollar global industry. Within virtual worlds such as Second Life, users have transferred hundreds of millions of U.S. dollars' worth of in-game assets. Social gaming revenues driven primarily by the sale of virtual goods have exceeded comparable revenues from physical goods in certain market segments.
Legal disputes involving virtual property have included: claims for breach of contract where platforms have unilaterally deleted user accounts and their associated assets; tort claims for conversion where virtual items have been stolen through unauthorized account access; and disputes over whether virtual currency acquired through gameplay constitutes taxable income. Canadian courts have not yet comprehensively addressed these questions, but the volume of transactions and their commercial significance makes eventual judicial and legislative engagement inevitable.
Crypto-Assets
Crypto-assets — including cryptocurrencies such as Bitcoin and Ether, stablecoins, and non-fungible tokens — represent a distinct and rapidly evolving category of digital asset. Unlike in-game virtual property, crypto-assets are typically designed to operate independently of any single platform or operator, using distributed ledger (blockchain) technology to maintain records of ownership and transfers. Their defining characteristics are decentralization, pseudonymity, and — in most implementations — a fixed or algorithmically constrained supply.
The legal classification of crypto-assets varies by use and structure. The Canadian Securities Administrators (CSA) have taken the position that many crypto-assets — particularly those sold in initial coin offerings (ICOs) and initial token offerings (ITOs) that involve investors expecting a return from the efforts of others — constitute securities subject to registration and prospectus requirements under provincial securities legislation. Crypto-asset trading platforms dealing in such assets must be registered as dealers or exchanges. For a comprehensive analysis of crypto-asset securities regulation, see Grigoras Law's Capital Markets & Securities practice area.
Beyond securities regulation, crypto-assets raise questions in property law (can they be the subject of an equitable lien or a Mareva injunction?), contract law (what is the enforceability of smart contracts?), insolvency law (how are crypto-asset holdings treated in a bankruptcy?), and estate law (how are crypto-assets administered on death, and what happens when private keys are lost?).
Taxation of Virtual Property
The Canada Revenue Agency (CRA) has issued guidance confirming that crypto-currencies are treated as a commodity for Canadian income tax purposes — not as legal tender. This has several important implications:
Whether the disposition of a crypto-asset gives rise to fully taxable business income or a capital gain (50% inclusion) depends on the taxpayer's activity and intent. Frequent traders are generally treated as earning business income; holders who acquire and hold for appreciation may argue capital gains treatment. The CRA will examine the frequency of transactions, the period of ownership, and the taxpayer's declared purpose.
Using crypto-currency to purchase goods or services is treated as a barter transaction: the taxpayer is deemed to have disposed of the crypto-asset at its fair market value at the time of the transaction, and any gain or loss relative to the adjusted cost base is immediately realized and potentially taxable.
Crypto-currency received as compensation for mining activity is generally treated as business income at the fair market value of the currency at the time it is received. The cost of equipment, electricity, and other operational expenses are deductible in computing that income.
Because every disposition of a crypto-asset is a taxable event, taxpayers with significant crypto portfolios must maintain detailed records of: the date of each acquisition and disposition, the amount paid or received in Canadian dollars, the fair market value at the time of each transaction, and the purpose of each transaction. Failure to maintain adequate records can result in assessments based on the CRA's own reconstructions and significant penalties.
The taxation of virtual goods within games and virtual worlds — items that cannot be converted into fiat currency or used outside the virtual environment — is treated differently by the CRA. In general, purely in-game virtual items that are not convertible into real-world currency are not treated as giving rise to taxable income. However, where a user is generating real-world income by buying and selling in-game assets or virtual currency that can be converted to fiat currency, income tax obligations arise and must be reported accordingly.