Consumer protection considerations in the era of artificial intelligence

Introduction

Through technology innovation, businesses offering artificial intelligence (AI) products and services are shaping consumers’ daily lives in multiple fields. 

At a high level, AI is the ability of computers to carry on tasks normally associated with human behaviour. It is a broad umbrella term that encompasses many different technologies, including machine learning and natural language processing. Generative AI employs AI technology that learns patterns from existing data and uses this knowledge to create novel and complex content. This content mimics human creativity and can include images, videos, audio, text, and 3D models.

Generative AI in consumer markets

The rapid pace of AI innovation is evidenced by the launch of ChatGPT in 2022. By reaching 100 million monthly active users just two months after launch, ChatGPT became the fastest-growing consumer application in history. Other examples of generative AI applications include GitHub Copilot (an AI programming and development tool) and Synthesia (an AI video generator). The scope and sophistication of AI applications has significant potential to impact the consumer market by automating or streamlining a variety of tasks or services. However, businesses supplying generative AI products or services to consumers must be aware of consumer protection laws in Canada. While these laws do not always keep pace with technological innovation, they remain applicable to consumer-facing products and services and impose significant consequences for non-compliance.

Consumer protection laws generally

In Canada, the conduct of suppliers in their sale of goods or services to consumers is governed by provincially regulated consumer protection statutes. All provincial statutes differentiate between types of consumer agreements, each of which are subject to specific content and disclosure requirements and, in certain cases, cancellation rights and a cooling-off period. With the proliferation of online offerings, suppliers commonly make available products or services to consumers through subscription plans. For example, ChatGPT Plus, a pilot subscription plan for ChatGPT, launched in early 2023. Consumer-facing online agreements, subscription plans and automatic renewals put AI businesses squarely in focus for provincial consumer protection laws. 

Consumer protection considerations for consumer-facing AI businesses

At a high level, the following elements of consumer protection laws will be of special interest to consumer-facing AI businesses:

• Online sales requirements: In Canada, provincial consumer protection legislation regulates contracts entered into online. The legislation prescribes certain content requirements and regulates the online contracting process, including the mandated disclosure of certain information to the consumer prior to the consumer entering into the contract. The legislation also requires that certain information be included in a contract (e.g., email confirmation) delivered to the consumer within 15 days of the purchase being made. Failure to comply with the legislation gives rise to consumer cancellation rights and potential fines and penalties. 
• Subscription plans and automatic renewals: While subscription plans and automatic renewals are permitted in Canada, renewal processes must be carefully structured to ensure such renewals are effective. Refer to our "Automatic renewals in Canadian consumer protection law" Update published on August 31, 2023 for the latest update on this issue.
• Unilateral amendments to consumer contracts: Unilateral amendments are strictly regulated in Canada in several provinces and under several types of consumer contracts. Depending on the context and contract, express consent of the consumer may be required when a supplier wishes to make an amendment to an agreement with a consumer (e.g., website terms of use). The supplier also may be required to follow certain processes and procedures related to disclosure, consent and notice (including notice content, timing, and response).
• Prohibited practices: Provincial consumer protection legislation also prohibits certain practices outright. As a result, certain provisions in a consumer agreement may be unenforceable. Depending on the province, this can include provisions requiring a consumer to waive any of its rights, requiring arbitration of disputes, or limiting the supplier’s liability. This can pose particular challenges when drafting a set of terms intended to be used across the country (or the continent).
• Consequences for non-compliance: The consequences for non-compliance will depend on the specific facts but can include fines, penalties, compliance orders, consumer cancellation rights, and—most concerning of all—class actions.

Proposed regulations governing AI businesses in Canada

Supplementing these considerations under consumer protection legislation are emerging AI regulations in Canada, specifically the proposed Artificial Intelligence and Data Act (AIDA) which, if passed by Parliament, would become the first law in Canada that aims to regulate the use of AI systems. AIDA establishes common requirements across Canada governing the design, development and deployment of AI systems with a view to mitigating harm to individuals—an objective and scope that will, of course, implicate businesses that make use of AI to offer products and services to consumers. 

In the meanwhile, the federal government has also announced the AI Voluntary Code of Conduct (the Code), which the government has stated is intended to act as a “critical bridge” between now and when AIDA comes into force. The Code is intended to apply to advanced generative systems and prescribes measures that fall within the following six key areas: accountability, safety, fairness and equity, transparency, human oversight, and validity and robustness. It is noteworthy that the Code specifically delineates between generative systems and those made available for public use, often placing a greater amount of responsibility on the latter (e.g., prescribing specific transparency requirements, such as the publication of the capabilities and limits of the underlying system). Products and services made available to consumers are necessarily public-facing, so these voluntary requirements provide a useful framework in an organization’s effort to adopt responsible AI practices between now and when AIDA comes into force. Refer to our "ISED's Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems" Update published on October 2, 2023 for additional details on the Code.

Conclusion

While AI-specific regulation remains pending or voluntary, consumer-facing businesses should be aware that consumer regulation will always be applicable, regardless of whether it strictly contemplates AI or other technologies.

Of special note for businesses with consumers in Canada’s most populous province, the Ontario government has recently proposed substantive changes to its Consumer Protection Act (CPA) via Bill 142, which would repeal Ontario’s existing CPA and replace it with an entirely new one. While the proposed Consumer Protection Act, 2023 remains technology-neutral, several categories of changes will likely implicate suppliers in the online and technology space, including new language regarding automatic renewals, unilateral amendments, and unsubscribing from subscription services.

The new CPA would also include the potential for compliance orders to be laid against entities that “facilitate” violations of the CPA by consumer-facing entities. While the term “facilitator” remains undefined, a government consultation paper on the proposed changes that was released in February 2023 suggested that “intermediaries such as online platforms and billing services” were the targets. Bill 142 has already passed second reading and been referred to Standing Committee, but it is not yet law, and its impact will not truly be known until the associated regulations are drafted and released for consultation. Regardless, the stated aim of Bill 142 is to better account for the digital marketplace, so businesses serving consumers in Ontario will need to keep an eye on the developments.

With the increasing popularity of generative AI applications in consumer markets, businesses will need to ensure they comply not only with any emerging AI regulations but the existing consumer protection obligations.