- Unlike some other countries, Canada does not have a broad, blanket legal shield that automatically protects a website operator from liability for everything a user posts.
- Defamation If a user posts something false and damaging about a third party — a competitor, a former employee, another customer — on your platform, the business hosting that content can…
- Provide a clear way to report problematic content.
Reviews, comment sections, forums, uploaded photos, community Q&A — letting customers post content on your site can build engagement and trust. It can also create legal exposure for content your business didn't write, didn't ask for, and may not have even seen before it went live. Many Ontario business owners assume that because "a customer posted it, not us," they're automatically off the hook. That assumption is generally wrong.
This article walks through the main categories of risk that come with user-generated content (UGC) and practical steps to manage it.
Why "We Didn't Write It" Isn't a Full Shield
Unlike some other countries, Canada does not have a broad, blanket legal shield that automatically protects a website operator from liability for everything a user posts. That doesn't mean a business is automatically liable for every comment, either — but it does mean businesses hosting UGC should assume they can face exposure in at least some circumstances, particularly once they're aware of a problematic post and don't act on it.
The Main Risk Categories
Defamation
If a user posts something false and damaging about a third party — a competitor, a former employee, another customer — on your platform, the business hosting that content can potentially face exposure, especially after being put on notice of the specific post and failing to respond reasonably.
Copyright and trademark infringement
Users sometimes upload photos, text, or other material that belongs to someone else, or use another business's branding in a way that infringes trademark rights. Hosting infringing content, particularly after notice, can expose the platform itself to a claim, separate from the user who posted it.
Privacy and personal information
User posts sometimes include other people's personal information — a customer naming another individual, uploading identifying photos, or sharing contact details — raising both privacy and, depending on the content, harassment-adjacent concerns.
False or misleading claims in reviews
Fabricated reviews, whether positive or negative, or reviews making unsupported claims can raise concerns under Canada's federal Competition Act, which prohibits deceptive marketing practices, particularly if a business is orchestrating or paying for reviews without disclosure.
Building a Notice-and-Response Process
- Provide a clear way to report problematic content. A visible contact method or flagging tool for users and third parties to raise concerns.
- Review reports promptly. Delay after receiving a legitimate complaint tends to work against the business if a dispute later arises.
- Have a documented decision process. Even a simple internal standard — what gets removed, what gets left up, who decides — creates consistency and a record.
- Keep records of what was reported and what action was taken. This matters if your handling of a complaint is later questioned.
- Don't ignore repeat offenders. A pattern of ignored complaints about the same user or type of content is harder to defend than isolated, promptly handled incidents.
Terms of Use Provisions That Help
A well-drafted terms of use, or community guidelines, document should:
- Require users to represent that content they post doesn't infringe someone else's rights and is accurate to their knowledge
- Reserve the business's right to remove content and suspend accounts at its discretion
- Set out a clear process for reporting concerns
- Include an indemnity from the user for content they post, for whatever practical value that has if the user is difficult to locate or has limited assets
- Address ownership and licensing of content users contribute, such as whether the business gets a licence to reuse a customer's review or photo in marketing
None of this eliminates risk entirely, but a documented process and clear terms put a business in a materially better position than having no policy at all.
Frequently asked questions
Are we liable for every negative or false review a customer posts about someone else?
Not automatically. Liability for hosting third-party content depends heavily on the specific facts, including whether the business was aware of the content and how it responded. This is a nuanced area rather than a bright-line rule, and specific situations should be assessed individually.
Can we just remove any review we don't like?
You can generally set your own moderation policy through your terms of use, but selectively removing only unfavourable but truthful reviews, as opposed to content that's actually false, abusive, or otherwise violates your policy, raises its own reputational and, in some contexts, deceptive-marketing concerns.
Do we need to actively monitor every comment before it's posted?
Not necessarily — many platforms use post-and-remove moderation rather than pre-screening everything, which can be impractical at scale. What matters more is having a functioning process to respond once you're made aware of a problem.
What if a user uploads a photo that isn't theirs to use?
This raises a copyright concern, and the business hosting it can potentially face exposure alongside the user who posted it, particularly after receiving notice. A clear takedown process and terms requiring users to confirm they have rights to what they post both help manage this risk.
This is a corporate question
Start a file online — flat, published fees, reviewed by a licensed Ontario lawyer before a dollar is owed.