When your startup is accused online: a legal playbook for Canadian founders

The first few hours

Resist the urge to fire back from the company account. A defensive reply posted at midnight can become the screenshot everyone shares, and it can be used as evidence later.

• Name one owner. One person approves anything said publicly. For a small team that’s usually the CEO, with input from a lawyer.
• Classify the problem. Is it a customer service complaint, a product failure, a security incident, a regulatory issue, or a false statement? The category drives everything else.
• Capture the evidence. Save URLs, timestamped screenshots, account names, comments and repost counts. Posts get edited and deleted quickly.
• Freeze your records. Don’t edit tickets, logs or customer emails related to the dispute. Pull the terms of service that applied at the time.

If the accusation is that you leaked customer data

Treat it as a possible security incident until you know otherwise, because the law may set the pace. Under PIPEDA (section 10.1), you must report a breach of security safeguards to the Privacy Commissioner, and notify affected individuals as soon as feasible, when it’s reasonable to believe the breach creates a real risk of significant harm.

Points that catch SaaS founders off guard:

• If you notify individuals, you must also notify other organizations or government institutions that may be able to reduce the harm.
• You must keep a record of every breach of security safeguards, including ones below the reporting threshold, for 24 months (Breach of Security Safeguards Regulations, s. 6).
• Knowingly failing to report, notify or keep records is an offence.
• Quebec, Alberta and British Columbia have their own private sector privacy laws, and your customer contracts and data processing terms may set shorter notice deadlines.

Anything you say publicly about a data incident should be accurate and consistent with what you tell regulators and customers. See privacy and data.

When a negative post becomes defamation

In general terms, defamation is a statement communicated to at least one other person that refers to your business and would tend to lower its reputation in the eyes of a reasonable person. A factual allegation (“they sell customer data to advertisers”) is treated very differently from an opinion (“their onboarding is a mess”). Truth is a full defence, and fair comment can protect honest opinion on matters of public interest. The Supreme Court of Canada summarized these elements and defences in Grant v. Torstar Corp., 2009 SCC 61.

Many angry reviews are opinion, exaggeration or a partly true account of a real problem, which makes them hard to sue on.

Short deadlines for newspapers and broadcasts

Ontario’s Libel and Slander Act sets short timelines for libel in a newspaper or broadcast: written notice within six weeks after the libel comes to your knowledge, and an action within three months. The Court of Appeal for Ontario has applied these rules to a newspaper’s online version in John v. Ballingall, 2017 ONCA 579. If a news outlet repeats the accusation, speak to a lawyer quickly.

Ontario’s anti-SLAPP law

Section 137.1 of Ontario’s Courts of Justice Act lets a defendant ask the court to dismiss a lawsuit early if it arises from expression on a matter of public interest. Once the defendant shows that, the case is dismissed unless the company suing shows grounds to believe the claim has substantial merit and the defendant has no valid defence, and that the harm is serious enough that the public interest in letting the case continue outweighs the public interest in protecting the expression. The Supreme Court of Canada explained this test in 1704604 Ontario Ltd. v. Pointes Protection Association, 2020 SCC 22.

Product safety, data privacy and how a company treats its customers can all be matters of public interest. A startup that sues a customer over a critical post may lose early and draw more attention to the original claim.

Options short of a lawsuit

• Fix it and say so. If the complaint is fair, a short, factual public reply with a path to resolve it often ends the story.
• Platform tools. Review sites, app stores and social platforms have processes for fake reviews, impersonation and harassment that move faster than courts.
• A targeted demand letter. For clearly false factual claims, a measured letter asking for removal or correction can work. An aggressive one can be posted publicly and backfire.
• Litigation. Reserve it for statements that are clearly false, provable, repeated and causing real harm.

Removing abusive or spam content under your posted community guidelines is reasonable. Deleting fair criticism wholesale often makes the story bigger.

Preventing the next one

Many public accusations start with an avoidable gap: refund terms nobody can find, a vague service level promise, an outage with no status page, or a former contractor who still has admin access. Clear terms of service, a written incident response plan, a named privacy officer and good records turn many future accusations into routine support tickets. See the contract stack for software startups and privacy policies for apps.