Short answer for readers in Canada: there is no AI companion law here, no rule that forces an app to show you a notice or a crisis card, and no ban on adults using one. What you do have is an older set of protections (privacy statutes, the Criminal Code) and a cluster of bills introduced in the summer of 2026 that would reach chatbots directly. None of the three chatbot-relevant bills is law yet.
Where things stand: a reset, then a rush
The first attempts lapsed. Bill C-27 would have created both a new privacy statute and the Artificial Intelligence and Data Act. Bill C-63 was the Online Harms Act. Both died on the order paper when Parliament was prorogued on January 6, 2025. Neither was designed around companion apps, and C-63 did not cover chatbots at all.
June 2026 brought a new set. Within a single week the government tabled two bills that matter to this topic: C-34 on June 10 and C-36 on June 15. A third piece of legislation, the Criminal Code package in Bill C-16, had already cleared Parliament by then. A private-sector age-check bill, S-209, is moving separately.
Internationally the pattern is different. The United States has written companion-specific statutes at state level (New York's took effect in November 2025, California's SB 243 in January 2026). Canada has so far chosen the regulator-and-bill route, which is why much of what follows is still a proposal.
Key dates, as of late September 2026. Bills marked pending were at second reading in the House of Commons.
What binds companies today
Privacy law
Federal private-sector privacy law is PIPEDA. Quebec's private-sector statute, amended by Law 25, applies to organizations there, and the commissioners of British Columbia and Alberta have their own remit. In practice these laws give you a right to see the information a company holds about you and, in general, require consent for how it is collected and used.
Two 2026 decisions show how regulators are treating AI products:
- ChatGPT, May 6, 2026. The federal, Quebec, British Columbia and Alberta privacy regulators concluded a joint investigation into OpenAI. They raised concerns about overcollection, consent and transparency, accuracy, and access and deletion. The federal commissioner found the complaint well-founded and conditionally resolved after OpenAI changed its practices.
- Grok, June 11, 2026. The Privacy Commissioner found that X Corp. and xAI breached PIPEDA by launching Grok's image tool without adequate safeguards, which let users produce sexualized deepfakes without consent. The companies committed to stronger safeguards, quarterly reporting and independent audits.
Neither case concerned a companion app. Together they tell you that Canadian regulators treat chat logs and generated images as personal information, and will act when consent is missing. Our four privacy checks and data request guide show how to use that right.
The Criminal Code and sexual deepfakes
Distributing an intimate image of someone without consent has long been an offence. Bill C-16, the Protecting Victims Act, received royal assent on June 18, 2026. Among other things it makes it a crime to threaten to distribute non-consensual intimate images, including sexual deepfakes, and it raises penalties for distributing them. Most of its provisions came into force on July 18, 2026.
For companion users, the practical meaning is simple: generating or sharing a sexual image of a real person who has not agreed to it can be a crime, whichever app produced it. Our piece on AI clones of real people goes deeper.
What is still only a bill
| Bill | Subject | Stage, late September 2026 | Relevance to companions |
|---|---|---|---|
| C-34, Safe Social Media Act | Online safety for social media and AI chatbots | Second reading, House of Commons | Duties to reduce harmful content, protect children and remove intimate images; a new Digital Safety Commission |
| C-36, Protecting Privacy and Consumer Data Act | Replacement for the private-sector part of PIPEDA | Second reading, House of Commons | Would govern how apps collect and keep your data |
| S-209 | Age checks for online pornography | Second reading in the Commons after passing the Senate | Would require rigorous age checks on sites offering explicit material |
Bills can change or die before they pass. Everything in this table should be read as what is proposed, not as current law.
The official LEGISinfo record for Bill C-34.
Bill C-34 in more detail
Introduced on June 10, 2026, the bill would enact a Digital Safety Act and set up a Digital Safety Commission of Canada. Chatbot operators would carry three duties: to act responsibly (assess and reduce the risk of exposing people to harmful content, and provide a way to report problems), to protect children (age-appropriate protections, and keeping minors away from pornographic material), and to make certain content inaccessible (child sexual abuse material and non-consensual intimate content, deepfakes included). Operators would publish digital safety plans. The Commission could audit companies, issue compliance orders and levy administrative monetary penalties.
Commentators are divided. Critics say too many details are left to regulation and worry about free expression; supporters welcome chatbot rules that C-63 lacked.
Bill C-36 in more detail
Tabled on June 15, 2026 by the Minister of Artificial Intelligence and Digital Innovation, C-36 is the government's third try at replacing PIPEDA's private-sector rules. It is described as a measure to protect children's data and strengthen privacy. Because earlier versions died, treat its final shape as open.
What you may see on screen
- Age prompts. Apps serving many countries are tightening age checks everywhere. Character.AI ended open-ended chat for under-18s in November 2025 and now relies on behavioural signals, third-party verification and ID checks as a fallback.
- Crisis cards. These appear because of company policy and foreign laws, not a Canadian mandate, and they can be triggered by fiction. A short out-of-character note usually lets a scene carry on.
- Privacy wording that cites PIPEDA or Law 25. Expect your rights to be spelled out more clearly if C-36 advances.
What the law leaves alone
What adults choose to do. No law here limits consensual adult content between a user and a companion. The proposals concern minors and non-consensual images.
Billing. Hidden fees, misleading pricing and refunds fall under general consumer law. The federal Competition Bureau deals with false or misleading representations, including drip pricing, and you can file a complaint with it. Provincial consumer protection offices handle most billing disputes. See refunds and cancellations.
Europe's example
Europe acted through privacy law rather than companion law. Italy's data protection authority fined Luka Inc., the company behind Replika, €5 million in a decision announced in May 2025. It cited no valid legal basis for processing, a privacy policy that lacked transparency, and no working age verification. The same regulator's February 2023 order preceded Replika's sudden removal of erotic roleplay, described in when your AI companion changes overnight.
Who to contact
- Privacy complaint or access problem: the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information in Quebec.
- Fraud or romance scam: the Canadian Anti-Fraud Centre, and your local police.
- Crisis: 9-8-8 (call or text, any time), or 911.
- Misleading pricing: the Competition Bureau, or your provincial consumer protection office.
The bottom line
An adult in Canada is free to use a companion app. The protection you can rely on today comes from privacy statutes and the Criminal Code, and regulators have shown they will use them against AI companies. The bills could add chatbot-specific duties by next year, or change or stall. Watch the stage of C-34 and C-36 more than any headline.
This article is general information, not legal advice, and it describes the position as of the end of September 2026.