A. Individually perpetrated TFGBV—overview of types and scope

People experience digitally inflicted harms every day in multiple image- and text-based forms and combinations of these forms, including NCDI, digital sexual forgeriesFootnote ⁵¹ (also referred to as deepfakes), secret recordings in showers, bathrooms, change rooms and classrooms,Footnote ⁵² verbal threats and extortion, disclosure of personal information (doxxing), individually perpetrated and networked harassment and trolling, and group-based hate speech.Footnote ⁵³ These harms are perpetrated using a wide range of digital technologies including mobile phones, cell phone cameras,Footnote ⁵⁴ social media platforms, online games,Footnote ⁵⁵ texting, hidden cameras,Footnote ⁵⁶ tracking devices,Footnote ⁵⁷ home security systems,Footnote ⁵⁸ e-transfers,Footnote ⁵⁹ AI and more.Footnote ⁶⁰ People are targeted by current and former intimate partners,Footnote ⁶¹ family members, friends, acquaintances and complete strangers who can be located in the same room, next door, another city, across the country or on the other side of the world.Footnote ⁶² The Centre for International Governance Innovation’s (CIGI) 2023 report on an 18-country survey found that nearly 60% of the 18,149 participants had experienced at least 1 of 13 online harmsFootnote ⁶³ included in the survey.Footnote ⁶⁴

While anyone can be targeted, gender and sexual orientation impact who is more likely to be targeted, who is more likely to be seriously affected, and who is more likely to perpetrate. For example, CIGI’s 2023 report parallels findings from other research demonstrating that transgender and gender-diverse people are disproportionately likely to be targeted by online harms, and cis women and LGBTQ+ people are more likely to report being seriously impacted by online harms than are their cis male and heterosexual counterparts, respectively.Footnote ⁶⁵ Further, women and transgender and gender diverse people were more likely to report having been targeted on the basis of their gender identity than men, and ‘LGB+ people were more likely to report they were targeted … because of their sexual orientation than heterosexual people’.Footnote ⁶⁶ Gender also played a role in relation to perpetration, with men being the most likely among all genders to be reported as the perpetrator of the most serious online harms, particularly where a cis or trans woman or gender diverse person was targeted.Footnote ⁶⁷

Being targeted by TFGBV can result in physical, mental, social, psychological and financial harms, and discourages cis women and girls, and gender diverse people from participating in public life.Footnote ⁶⁸ As Anja Kovacs put it:

In Canada, for example, statistics indicate that age, race, ability and gender are factors in exposure to and commission of ‘cyber-related hate crimes’, with young Canadians aged 15 to 24, especially those with a disability, being much more likely to report having seen hateful online content compared to the national average.Footnote ⁷⁰ Reported incidents of cyber-related hate crimes more than doubled from 2019 to 2022 with anti-Black racism and homophobia being the most common forms of those crimes reported to police.Footnote ⁷¹ In that same period, nearly 25% of cyber-related hate crimes targeted young people aged 12 to 17. While young women and girls were more often targeted by online bullying and abuse (particularly sexualised abuse), men and boys were slightly more likely to be the victims of police-reported cyber-related hate crimes, except in teen years and early adulthood when young women comprised a greater portion of police-reported cyber hate crimes than young men.Footnote ⁷² Nonetheless, online sexual exploitation and harassment were more likely to be directed at young women, leaving young women aged 15 to 24 three times as likely as young men to be pressured to send, share or post explicit images, videos or messages.Footnote ⁷³ Similarly, among young people aged 15 to 24, women were 2.5 times as likely as men to receive unsolicited sexually suggestive or explicit images or messages.Footnote ⁷⁴

Between 2018 and 2022, 87% of those ‘charged with or suspected of cyber-related hate crimes were men or boys’.Footnote ⁷⁵

With this sketch of recent research focused largely on individually perpetrated TFGBV, we turn now to consider the growing body of work focused on corporate perpetuation and perpetration.

B. Recognition of the spectrum of corporate facilitation of TFGBV

Individual perpetration of TFGBV is often more easily recognised than the roles played by tech corporations—especially when the latter are cast as mere conduits for communication. Understanding their capacity to facilitate TFGBV in a range of ways—from perpetuating GBV posted by others to perpetrating it directly themselves will be essential for holding them to account in meaningful ways. Achieving that understanding has been unnecessarily complicated by the fact that some of the most critical aspects of corporate roles in TFGBV are too often not recognised as being about TFGBV, and instead are treated as separate issues associated with building an innovative information economy, such as data protection and/or cybersecurity.

Moreover, the roles played by tech corporations in TFGBV (as in other forms of social, political and cultural malady) are often obfuscated by what Winner termed ‘cyberlibertarianism’—‘a whole hearted embrace of technological determinism’ in which digital technologies are represented as ‘endless opportunities for achieving wealth, power, and sensual pleasure’ while existing social, political and economic structures (including democratic legal governance) are cast as undesirable ‘barriers’ to freedom.Footnote ⁷⁶ Tech corporations and cyberlibertarian advocates have engaged in adept campaigns to portray these for-profit corporate entities as purveyors of freedom and democracy. These campaigns, combined with public policy that makes global economies increasingly dependent on these corporations, have created an environment in which government regulation is understood as a hindrance to human rights and freedoms. This is so even though, as Golumbia points out, social media ‘has been shown in study after study to correlate with the most striking retreat of democratic values in over a century’.Footnote ⁷⁷ In this context, public policy initiatives such as those discussed below begin the work of prioritising human rights and imposing a degree of democratic oversight that does not presume digital technology to be synonymous with human flourishing are encouraging.Footnote ⁷⁸ That said, the willingness and capacity of states to resist uncritical embrace of technological developments, such as AI, are increasingly being tested by geopolitical and economic factors suggesting that those who attempt to regulate such developments in the public interest could ultimately be left behind in what is being positioned as a technological arms race and/or be punished economically by the United States.Footnote ⁷⁹ More recently, however, even the Trump administration has acted to regulate certain aspects of AI development through issuance of an Executive Order.Footnote ⁸⁰

Indeed, growing attention has been paid over the last several years to legal and ethical shortcomings of corporate practices and the data-in-exchange-for-services model currently underlying our digitally networked environment, including how that model allows tech corporations to profit from TFGBV.Footnote ⁸¹ For example, in 2023, the United Nations’ 67th Commission on the Status of Women recognised that:

This statement is significant because it recognises tech corporations as more than passive intermediaries. Conceptualising corporate facilitation of TFGBV along a spectrum from perpetuation to perpetration helps to illustrate the various roles tech corporations play in TFGBV, highlighting opportunities for effective regulatory interventions. We use the terms perpetuation and perpetration to denote opposite ends of a spectrum from minimal to maximal engagement, acknowledging that in many cases no clear line delineates one from the other. Our spectrum is meant only to highlight the range of corporate conduct that needs to be accounted for in designing human rights-respecting responses, not to suggest that any particular point along it is worse or better than another. TFGBV is harmful, regardless of who generates it or how it is done. We turn now to discuss examples at both ends of the spectrum.

C. Corporate perpetuation

If a distinguishing feature of corporate perpetuation of TFGBV turns on dealings with content posted by others, any corporation that employs digital technology in its operations can engage in perpetuation. Tech corporations may be involved in a variety of activities, from networked home security systems to livestreaming services to hosting digital content to online gaming. One of the services widely associated with tech corporations is the provision of digital platforms that host, organise and/or circulate online content primarily created by others, where the service is built on an infrastructure aimed at processing users’ data for profit.Footnote ⁸³ Often tech corporations own and operate numerous services through a variety of subsidiary corporations with offices strategically located in various places around the world,Footnote ⁸⁴ which, like other multinational enterprises, gives them significant power, while simultaneously making them less susceptible to state regulation.Footnote ⁸⁵ Further, power is increasingly concentrated in technology giants like Apple, Google (Alphabet), Amazon, Facebook (Meta), Microsoft and Netflix,Footnote ⁸⁶ leading to some referring to ‘big tech’ as the ‘new governors.’Footnote ⁸⁷

Perhaps the clearest examples of tech corporation perpetuation of TFGBV relate to hosting others’ content, as well as decisions by online platforms regarding removal of that content. Notwithstanding having community guidelines and/or terms of use that specify that certain forms of harmful content are impermissible and subject to removal by the platform, social media giants like Facebook, X (formerly Twitter), and YouTube have long and continuing histories of hosting hate speech against cis and trans women and girls, gender diverse, racialised, disabled and newcomer populations, as well as members of many other marginalised communities.Footnote ⁸⁸ There are also a smaller number of platforms that are purpose-built to host hateful and other forms of harmful and illegal content, such as NCDIFootnote ⁸⁹ and transphobic attacks.Footnote ⁹⁰ In these latter cases, the line between perpetuation of others’ TFGBV and direct corporate perpetration of TFGBV is razor thin.

Online platforms have become ‘central sites of TFGBV’Footnote ⁹¹ (although most are not intentionally created for dissemination of hateful content) due to four common features highlighted by Cynthia Khoo: (i) the underlying data-in-exchange-for-services business model; (ii) ease and low cost of dissemination; (iii) user anonymity; and (iv) user avoidance of content moderation features.Footnote ⁹² Of these, the first is perhaps the most insidious. Online platforms profit from capturing as much data about users as possible because that data is a marketable commodity for, among other things, building profiles that are in turn used to influence user behaviour, often in order to sell people things, a model that Shoshana Zuboff has labelled ‘surveillance capitalism’.Footnote ⁹³ Under this model, platforms’ profit potential is maximised by capturing user attention. The longer users engage with the platform, the more profitable data they are likely to spill.Footnote ⁹⁴ Thus, the deliberately chosen design of most online platforms is practically purpose-built ‘to optimize and maximize violent or abusive content and behaviours’ that are likely to attract and keep user attention.Footnote ⁹⁵ For example, online platforms design and deploy algorithms that drive ‘engaging’ content to the top of user feeds, which, when it comes to TFGBV, results in corporate perpetuation of (and profit from) this harmful content.Footnote ⁹⁶

D. Corporate perpetration

Corporations not only perpetuate TFGBV posted by others, but they can also perpetrate structural violence through content they generate. Structural violence focuses on interlocking systems of oppression, such as racism and misogyny, as forms of violence.Footnote ⁹⁷ That structural violence is deeply intertwined with interpersonal violence is reflected in the fact that women and girls from certain marginalised communities, including Indigenous and Black communities, are disproportionately exposed to interpersonal violence and suffer exacerbated harms from such violence.Footnote ⁹⁸

As Bailey and BurkellFootnote ⁹⁹ note, the structural form of TFGBV perpetrated by tech corporations has been variously labelled: digital structural violence,Footnote ¹⁰⁰ digital colonialism,Footnote ¹⁰¹ digital exclusionFootnote ¹⁰² and algorithmic violence.Footnote ¹⁰³ Tech corporations perpetrate structural violence in various ways, often resulting from decisions about platform design and choice of digital tools.Footnote ¹⁰⁴ For example, Elon Musk’s generative AI tool, Grok, was originally designed to allow users to ‘edit photos of real people to show them in revealing clothing’ and/or nude that were then automatically uploaded to social media platform X.Footnote ¹⁰⁵ It was only after significant international backlash ‘over sexualised AI deepfakes’ that X announced ‘technological measures to prevent the Grok account’ from doing so in ‘jurisdictions where it is illegal’.Footnote ¹⁰⁶ Some AI systems go beyond enabling others to perpetrate TFGBV, such as chatbots that generate ‘original’ misogynistic and otherwise hateful responses to user queries never intended to prompt them.Footnote ¹⁰⁷ Similarly, some virtual gaming environments deliberately build in sexist and racist discoursesFootnote ¹⁰⁸ that studies show decrease empathy for female victims,Footnote ¹⁰⁹ potentially reinforcing pre-existing structural inequalities in the physical world.Footnote ¹¹⁰

Tech corporations’ use of algorithms as the basis for profiling and delivery of content can also be understood as corporate perpetration of structural violence, often with disparate impacts on cis and trans girls and women, gender diverse people and members of other marginalised communities. Algorithms trained on data in which women and racialised people are not included or in which they are stereotypically portrayed produce discriminatory outcomes that exclude members of these communities in ways that both reflect and reinforce forms of structural violence that characterise the physical world.Footnote ¹¹¹ As a result, such algorithms have produced faulty results that disproportionately misidentify Black women,Footnote ¹¹² and discriminatory search results classifying hairstyles of Black women as ‘unprofessional’Footnote ¹¹³ and associations of Black girls with demeaning, sexualised, racist and misogynistic stereotypes.Footnote ¹¹⁴ In each instance, the corporate choice to employ such algorithms reflects and reinforces exclusions that mirror and amplify pre-existing exclusionary structural violence, that can simultaneously occasion direct harm on individuals to whom such content is delivered.Footnote ¹¹⁵

The rights-violating harms occasioned by TFGBV and the spectrum of corporate roles in perpetuating and perpetrating those harms provide an important contemporary example of the urgent need to ensure business respect for human rights. The next section critically examines the strengths and weaknesses of UNGPs and how they have been interpreted by the B-Tech project to inform state and tech behaviour and suggests what an effective BHR approach to regulating tech corporations’ role in TFGBV might look like.

A. The state obligation to protect human rights

The UNGPs state in Guiding Principle (GP) 3 that in order to meet their obligation to protect human rights, states should:

1. (a) Enforce laws that are aimed at, or have the effect of, requiring business enterprises to respect human rights, and periodically to assess the adequacy of such laws and address any gaps;

2. (b) Ensure that other laws and policies governing the creation and ongoing operation of business enterprises, such as corporate law, do not constrain but enable business respect for human rights;

3. (c) Provide effective guidance to business enterprises on how to respect human rights throughout their operations;

4. (d) Encourage, and where appropriate require, business enterprises to communicate how they address their human rights impacts.Footnote ¹²³

The UNGPs commentary on this provision calls on states to take action and ‘consider a smart mix of measures – national and international, mandatory and voluntary – to foster business respect for human rights’.Footnote ¹²⁴ It also emphasises the importance of reviewing existing laws and addressing any gaps: ‘It is equally important for States to review whether these laws provide the necessary coverage in light of evolving circumstances and whether, together with relevant policies, they provide an environment conducive to business respect for human rights.’Footnote ¹²⁵

The B-Tech foundational paper on the state obligation to protect human rights makes five key points: (1) it sets out the state duty to protect and warns against states ‘roll[ing] back human rights protections when fulfilling this duty’; (2) states should use a ‘smart mix’ of regulation and policy measures; (3) regulation and policy measures ‘should reflect the UNGPs’ normative expectation’ that companies undertake HRDD; (4) states should use their leverage in public procurement to ensure suppliers respect human rights; and (5) ‘[s]tates should ensure that they have the necessary policy coherence – as well as capacity and ability – to effectively protect people against harms involving technology companies’.Footnote ¹²⁶

The paper takes a hesitant approach to the need for new human rights-focussed domestic and other regulation. The way the state duty to protect human rights is represented in a diagram early in the paper downplays the importance of assessing the gaps in regulation that is emphasised in the UNGPs’ commentary on GP3. In the part representing the ‘smart mix’ of measures, there is no mention of introducing new legislation, including mandatory HRDD legislation, to ensure tech corporation accountability for the harm they cause or to which they contribute. Rather, it lists ‘[e]nforcing existing laws’; ‘[p]roviding guidance to business’; and ‘[i]mplementing transparency measures’.Footnote ¹²⁷ The discussion later in the paper mentions the UNGPs guidance about assessing gaps in laws and policies to ensure that they ‘provide an environment conducive to business respect for human rights’.Footnote ¹²⁸ But again it does not recommend the introduction of mandatory HRDD laws. It notes that while there is no panacea for addressing the human rights harms of all types and sizes of tech corporations, ‘[s]tates will need to be deliberate and firm in making human rights protection a non-negotiable feature of such laws’.Footnote ¹²⁹ It is only much later on that mandatory HRDD is mentioned as an example of legislation that some states have enacted in establishing a ‘smart mix’ of measures, rather than something that states should consider enacting now.Footnote ¹³⁰ This all seems counterintuitive given that the problem is not simply that states are not enforcing relevant laws against tech corporations, but that existing laws are often insufficient on their own to address tech company-related human rights violations.

B. The business responsibility to respect human rights

The UNGPs call on businesses to respect human rights.Footnote ¹³¹ Under GP 14, all business actors ‘regardless of their size, sector, operational context, ownership and structure’ are encouraged to respect human rights by avoiding infringing on the human rights of others and addressing adverse impacts in which they are involved.Footnote ¹³² This is further explained in GP 13, which states that businesses should:

1. a. Avoid causing or contributing to adverse human rights impacts through their own activities, and address such impacts when they occur;

2. b. Seek to prevent or mitigate adverse human rights impacts that are directly linked to their operations, products or services by their business relationships, even if they have not contributed to those impacts.Footnote ¹³³

Therefore, in the case of tech corporations the UNGPs offer the potential to address both corporate perpetuation and perpetration of TFGBV. When it comes to perpetration, sub-paragraph (a) would mean, for example, that tech corporations must not deploy algorithms that discriminate against Black girls and women by returning racist and misogynistic search results or that target girls and young women with harmful body image content. With respect to perpetuation, sub-paragraph (b) would mean, for example, that tech corporations must have in place content removal procedures and harms reduction measures both to minimise others’ use of their platforms to perpetrate violence (e.g., through posting hateful content) and to ensure that the platform’s own algorithms are not amplifying violent content posted by others or generating violent content of their own.

To meet this responsibility to respect human rights, corporations must develop a policy commitment to respect human rights and undertake ongoing HRDD initiated at the earliest possible opportunity. In doing so they need to identify actual and potential human rights impacts, the process of which should include internal or external human rights experts and meaningful consultation ‘with potentially affected groups or other relevant stakeholders’ (GP 18), integrate findings and take appropriate action (GP 19), track the effectiveness of the company’s response (GP 20) and communicate publicly (GP 21). Where the business finds that it has caused or contributed to human rights harms, it should ‘provide for or cooperate in their remediation through legitimate processes’ (GP 22).Footnote ¹³⁴

B-Tech, in two of its foundational papers, interprets this obligation for tech corporations as undertaking HRDD in which ‘business model-driven practices and related technology designs, create or exacerbate human rights risks’.Footnote ¹³⁵ This means such companies must consider ‘what risks to people emerge as a consequence of the very essence of how their companies make money, serve customers, and increase market share and share price’ and take ‘reasonable steps – consistent with the UNGPs – to prevent, mitigate and remediat[e] harms to people’.Footnote ¹³⁶ Equally, businesses must engage in HRDD with respect to the end use of their products and services. This includes ‘identifying whether and how the design, development, promotion, deployment, sales/licensing and use of its products and services could lead to adverse human rights impacts’.Footnote ¹³⁷

The B-Tech Project has also produced a paper on using the UNGPs to ensure that the development and deployment of generative AI is undertaken in a way that respects human rights.Footnote ¹³⁸ It argues that HRDD processes should be embedded ‘into the product-oriented working methods and cultures of technology companies developing foundation models’.Footnote ¹³⁹ It notes that currently, there is ‘very little understanding’ of how to ensure that such models do not violate human rights and any human rights risk assessment processes may not be undertaken early on and throughout the development, deployment and monitoring of the product.Footnote ¹⁴⁰ It further observes that there is often little communication about any human rights risk processes that companies may already have in place. Additionally, methodologies for human rights impact assessment ‘may be too far removed from the pace and iterative nature of developing foundation models’ and companies may simply end up engaging in HRDD as ‘a compliance exercise’ rather than ‘a meaningful tool’,Footnote ¹⁴¹ which is a generic problem with HRDD well beyond the technology context.

C. Effective remedies

As noted above, as part of their obligation to protect human rights, states must also provide effective remedies to victims of business-related human rights violations. Thus, they must investigate allegations of corporate-related abuse, sanction the actors involved and take ‘appropriate steps to ensure, through judicial, administrative, legislative or other appropriate means … that those affected have access to effective remedy’.Footnote ¹⁴² Judicial remedies are central to the right to an effective remedy,Footnote ¹⁴³ and should be supplemented with state- and non-state-based non-judicial remedial mechanisms (NJRMs). Non-state-based NJRMs include remedy mechanisms ‘administered by a business enterprise’. In interpreting the UNGPs, the WGBHR notes that all remedial mechanisms must not only be accessible to all rights holders without discriminationFootnote ¹⁴⁴ but they must be capable of furnishing effective remedies. This means, in the view of rights holders, they are ‘accessible, affordable, adequate and timely’,Footnote ¹⁴⁵ and should ‘result in some form of corporate accountability’.Footnote ¹⁴⁶ In addition, remedial mechanisms for business-related human rights violations should be ‘responsive to the diverse experiences and expectations of rights holders’ and the latter should be able to choose from ‘a bouquet of preventive, redressive and deterrent remedies’.Footnote ¹⁴⁷

The B-Tech foundational papers on remedies, which draw on the WGBHR report on effective remedies, set out quite well many of the elements of an effective remedy for states and tech corporations.Footnote ¹⁴⁸ Additionally, they emphasise the importance, as well as the challenges, of creating a ‘[w]ell-functioning remedy ecosystem’ that ensures ‘realistic and readily-identifiable pathways to an effective remedy’.Footnote ¹⁴⁹

D. Shortcomings of the UNGPs and their interpretation in the B-Tech project in addressing TFGBV

The UNGPs have been influential and widely welcomed by states and businesses and clearly do have a lot to offer in terms of guidance for the tech sector on preventing business-related human rights violations through HRDD processes and taking action to address harm that does occur, as well as guidance for states on how to meet their international legal obligation to protect human rights through legislative, administrative and other measures and to provide effective remedies. However, these norms (and how they have been interpreted in the B-Tech Project) have some significant shortcomings when it comes to preventing, addressing and redressing TFGBV.

A. Overview of the SSMA, OSA, DSA and AI Act

In June 2026, the Canadian government tabled Bill C-34– the Safe Social Media Act,Footnote ²⁰⁸ which replaced predecessor online harms legislation that had expired on the dissolution of Parliament in 2025.Footnote ²⁰⁹ Aimed at promoting the safety of people in Canada, especially children, C-34 would impose five duties on certain regulated services. First, operators of regulated social media services would have a duty to act responsibly by implementing measures to mitigate users’ exposure to seven categories of harmful content.Footnote ²¹⁰ Second, regulated chatbot service operators would have a duty to act responsibly by implementing measures to mitigate the risk of chatbot communication of harmful content and engagement in harmful behaviours.Footnote ²¹¹ Third, all regulated services would have a duty to protect children by integrating design features to be provided for by regulation, and by imposing age restrictions for access to pornographic content, while minimum age restrictions would apply to having a social media account, except for exempted operators.Footnote ²¹² Fourth, regulated social media services would have a duty to make NCDI and CSAM inaccessible to people in Canada in certain situations.Footnote ²¹³ Fifth, operators would have a duty of transparency relating to the regulated services they provide, including by submitting a digital safety plan to a new regulator, the Digital Safety Commission of Canada (DSCC).Footnote ²¹⁴

The UK’s OSA passed in 2023 and came fully into force in 2025. It aims to protect children from illegal and harmful content and adults from illegal content by imposing new duties on social media and search services to better protect user safety by implementing systems and processes to reduce risk, and by taking down illegal content when it appears. Its strongest protections relate to children (including taking steps to prevent children from accessing harmful and age-inappropriate content), while also increasing transparency for adults about what kinds of potentially harmful content regulated entities allow. Ofcom, an independent regulator of online safety, both sets up codes of practice for, and has enforcement powers over, regulated entities.Footnote ²¹⁵

The EU’s DSA came into force in 2022. As an initiative primarily concerned with EU digital sovereignty and security writ large,Footnote ²¹⁶ unlike the OSA, the DSA focuses on the process of content moderation, rather than on specific types of content. It imposes due diligence obligations on regulated entities to identify and mitigate individual and, in the case of very large entities, systemic risks of individual and collective harm arising from the design, function and use of their services.Footnote ²¹⁷ Member states must appoint a Digital Services Coordinator (DSC) with strong investigatory, oversight and enforcement powers in relation to both individual and systemic harms, with potential for cross-border mutual assistance between DSCs from different states.Footnote ²¹⁸ The European Board for Digital Services supervises regulated entities, with powers to support investigations and DSCs, analyse reports from very large regulated entities (subject to additional obligations), and issue opinions and advice to DSCs.Footnote ²¹⁹

The EU’s AI Act came into force in 2024, with various aspects of the regulation staged to come into effect between 2025 and 2027. It provides a harmonised set of rules for AI regulation in the EU.Footnote ²²⁰ Aimed at ensuring that ‘Europeans can trust what AI has to offer’, the Act takes a risk-based approach, defining four levels of risk: (1) unacceptable risk; (2) high risk; (3) limited risk; and (4) minimal risk. Any AI system that poses an unacceptable risk (e.g., social scoring, harmful AI-based manipulation and deception, harmful AI-based exploitation of vulnerabilities) is banned, while high-risk systems are subject to strict obligations relating to risk assessment and mitigation, and no specific regulations are imposed on minimal to no risk systems.Footnote ²²¹ Implementation, enforcement and supervision of the Act falls to the European AI Office and Member State authorities, steered and advised by the AI Board, the Scientific Panel and the Advisory Forum.Footnote ²²² The Act also sets out rules for general purpose AI models, including obligations relating to transparency and copyright, as well as assessment and mitigation obligations for models that may carry systemic risks.Footnote ²²³

B. Assessing consistency with the key requirements of a fortified BHR approach

As noted above, states are obliged under international human rights law to take legislative and other measures to prevent tech corporations from violating human rights and to provide effective remedies where harm occurs. The four key focuses of our fortified BHR approach would obligate states to bind businesses through laws that include: (i) an inclusive and intersectional lens and broad spectrum coverage; (ii) prevention and accountability measures that may include, but go beyond HRDD; (iii) no-go zones with enforceable bottom lines; and (iv) effective individual remedies for situations where systems implemented to protect human rights fail. None of the four initiatives comprehensively satisfies all four of these criteria. Nor does any of them guarantee that tech corporations will adopt equality-centred, human rights-focused measures to end their involvement in TFGBV. That said, aspects of all four initiatives offer insight and inspiration for domestic legislation that could go some way toward greater accountability across the spectrum of corporate roles in TFGBV.

(i) Inclusive and intersectional gender lens and broad spectrum coverage—None of these initiatives begins the work of explicitly recognising and requiring inclusive responses to the disproportionate impacts of TFGBV on all gender-marginalised people and sexual minorities.Footnote ²²⁴ However, the OSA and DSA explicitly advert to the disproportionate impact of certain online harms on women and girls, as well as the systemic role of tech corporations in facilitating such harms. That said, while the OSA directs regulated entities’ attention toward harms arising from the design and operation of their systems (such as through algorithmic amplification) and recognises the disproportionate harms women and girls experience from certain types of illegal and otherwise harmful content,Footnote ²²⁵ the legislation does not explicitly link the two. In contrast, the DSA specifically connects due diligence obligations relating to system design, including algorithms, with possible negative effects on GBV.Footnote ²²⁶ These represent small but important steps toward broad spectrum coverage of both corporate perpetuation and perpetration by connecting certain systemic corporate behaviours with TFGBV.

Finally, none of the four initiatives refers to any of the international instruments relating to GBV specifically or to gender or racial equality more generally. That said, the DSA refers to various rights under the Charter of Fundamental Rights of the European Union (EU Charter), including rights to non-discrimination, the SSMA refers to rights to privacy, equality and to non-discrimination under federal Canadian human rights legislation,Footnote ²²⁷ and the AI Act refers repeatedly to fundamental rights. However, without references to specific gender and GBV-focused instruments, corporate attention will not be specifically trained on addressing the impacts of their behaviour on these specific international rights and obligations, continuing the problematic pattern of disconnecting technology regulation from GBV and discrimination.Footnote ²²⁸

(ii) Prevention and accountability mechanisms that may include, but go beyond HRDD—All four initiatives refer to human rights. However, the DSA and AI Act do so most frequently, and in language that most directly connects tech corporations and/or the operation of algorithmic systems to human rights obligations and outcomes. For example, the DSA’s preamble specifies that in addition to taking account of EU Charter rights, all intermediary service providers should also ‘pay due regard to relevant international standards for the protection of human rights, such as the [UNGPs]’.Footnote ²²⁹ When it comes to specific rights, all four initiatives were more likely to cite freedom of expression and privacy, with significantly fewer references to rights to equality and non-discrimination. Moreover, regulated entities were more likely to be directed to take freedom of expression and privacy into account in carrying out legislatively imposed obligations,Footnote ²³⁰ whereas references to equality and non-discrimination tended to relate to other things.Footnote ²³¹ While advertence to human rights in all four initiatives is encouraging, when it comes to the human rights harms of TFGBV, language that consistently and specifically ties tech corporations’ obligations not simply to free expression and privacy, but also to substantive equality will be essential.

With respect to specific accountability mechanisms, while all four initiatives differently define the scope and, sometimes, obligations of the entities they regulate, each of them imposes obligations on services and/or products of tech corporations without expressly referring to those obligations as HRDD. The SSMA, OSA and DSA centre many of these obligations on content-related harms, with the SSMA focused on seven defined types of illegal and otherwise harmful content,Footnote ²³² the OSA focused on illegal content rated from high to low risk, and the DSA focuses on moderation of both illegal and otherwise harmful content with obligations adjusted according to size of entity and risk.Footnote ²³³ All of these initiatives empower regulatory bodies to oversee compliance with these obligations, as well as to impose significant financial penalties for failure to comply.Footnote ²³⁴ All three, therefore, employ HRDD mechanisms backed by accountability measures.Footnote ²³⁵

The SSMA, OSA and DSA, however, go even further by imposing obligations on regulated entities not only in relation to content posted by others, but also, to varying degrees, with respect to the harms posed by their own systems. The SSMA would require regulated chatbot services not only to mitigate against the risk of delivery of harmful content, but also to implement measures (to be specified in regulations) to address situations where a user expresses suicidal ideation or an intention to cause death or serious bodily harm, and to mitigate risks of harmful chatbot behaviour, including presenting as a human, and engaging in manipulative techniques that could cause a user to form a social attachment to the chatbot.Footnote ²³⁶ It would also require regulated social media services to label synthetic content posted by others,Footnote ²³⁷ to make NCDI and CSAM inaccessible,Footnote ²³⁸ and to address multiple instances of automated harmful content accessible on their services, though it exempts from that obligation programs used by a regulated entity to ‘facilitate proper functioning of the service’.Footnote ²³⁹ Operators of all regulated online services would be required to submit digital safety plans that include, among other things, information about measures taken to mitigate the risk of user exposure to harmful content.Footnote ²⁴⁰ The OSA requires providers to specifically include in their risk assessment and mitigation strategies how platform design, functionalities and algorithms impact user exposure to illegal content and child exposure to harmful content. This includes, for example, consideration of harm arising from the way content is disseminated, such as where an ‘algorithm repeatedly pushes content to a child in large volumes over a short space of time’.Footnote ²⁴¹ Published annual transparency reports must include information about the algorithms used and their effect on user experience.Footnote ²⁴² Moreover, the OSA specifically acknowledges that certain forms of illegal content disproportionately affect women and girls,Footnote ²⁴³ necessitating provision of explicit guidance from Ofcom (published in 2025) to ensure that regulated entities implement ‘holistic and effective protections for women and girls across their various duties’ under the legislation.Footnote ²⁴⁴ While mandated compliance backed by the same kinds of enforcement powers that are provided for in other areas, rather than requested cooperation with Ofcom-provided guidance, would be preferable, advertence to the gendered dimensions of online harms represents an important first step.

The DSA also imposes obligations on very large online platforms and very large online search engines not only to undertake due diligence and related mitigatory action with respect to illegal content on their services, but also with respect to systemic risks arising from the ‘design, functioning or use, including through manipulation’ of their services with an ‘actual or foreseeable negative effect on’, among other things, GBV.Footnote ²⁴⁵ This includes any systems or elements relevant to such risks, including algorithmic systems (especially recommender and advertising systems), data collection and use practices, terms of service, content moderation practices, technical tools and allocated resources.Footnote ²⁴⁶ Mitigation attempts must be mindful of the fundamental rights at stake, with particular consideration of freedom of expression.Footnote ²⁴⁷

Like the online harms/safety initiatives, the AI Act also imposes obligations on tech corporations, in this case with respect to high-risk AI systemsFootnote ²⁴⁸ and general-purpose AI (GPAI) models.Footnote ²⁴⁹ High-risk AI systems include those relating to certain biometric systems, critical infrastructure, education, employment, law enforcement, migration and justice administration.Footnote ²⁵⁰ The Commission may expand the list of what constitutes high-risk where the system is intended for use in any of the listed areas and ‘poses a risk of harm to health and safety or an adverse impact on fundamental rights’ and carries with it an equal or greater risk of harm or adverse impact to already-listed high-risk AI systems,Footnote ²⁵¹ including human rights to non-discrimination and gender equality.Footnote ²⁵² Providers of high-risk AI systems are subject to stringent due diligence processes and obligations,Footnote ²⁵³ and must also be subjected to a fundamental rights impact assessment and registered in an EU database. They cannot be placed on the market without a signed declaration of conformity.Footnote ²⁵⁴

In recognition of the systemic risks posed by GPAI models that are widely used, these models must comply with specific transparency (including in relation to content used for training) and copyright-related rules.Footnote ²⁵⁵ Further, if they are evaluated as carrying with them systemic risks (e.g., due to actual or reasonably foreseeable negative effects on fundamental rights), providers of GPAI models must also assess and mitigate possible systemic risks, and track and report serious incidents to the AI Office.Footnote ²⁵⁶

Like the other three initiatives, the AI Act also provides for significant financial penalties for non-compliance with its due diligence and transparency requirements.Footnote ²⁵⁷ However, some of its enforcement powers have yet to come into force, and it remains unclear how such penalties will be enforced pending member state passage of enforcement legislation since the AI Act itself does not clearly vest enforcement powers in the statutory regulators.Footnote ²⁵⁸ Moreover, as of May 2026, an agreement between the COE and the European Parliament on the Digital Omnibus on AI (originally proposed in November 2025), if formally adopted, would delay implementation of high-risk AI system rules in some cases to December 2027 and in others to August 2028, while also expanding the scope of exemptions from the high-risk category.Footnote ²⁵⁹

Overall, two aspects from the four initiatives suggest strategies for moving away from the tick-box approach to which HRDD can so easily give rise toward more substantive results. First, although we have characterised all four initiatives as featuring due diligence approaches to some extent, the SSMA and OSA stand out in one respect by imposing duties on regulated services that go beyond risk assessment and mitigation. The SSMA imposes duties to act responsibly specific to social media and chatbot providers, and general duties to protect children, to make certain content inaccessible, and to be transparent, while the OSA imposes numerous duties relating to illegal content, content harmful to children, as well as to freedom of expression and privacy.Footnote ²⁶⁰ Articulation of generalised duties offers the prospect for moving beyond satisfaction of a tick-box procedural exercise of identifying, mitigating against and assessing the results of mitigation efforts toward recognition of an ongoing substantive obligation that requires thought and engagement. Explicit imposition of a duty to ensure substantive equality and/or non-discrimination (rather than vague references to these values) will be essential to communicate these rights’ equal place in corporate policy and practice, taking the first step toward recognition and redress of corporations’ roles in TFGBV.Footnote ²⁶¹

Second, the move toward articulation of substantive obligations would benefit from the availability and exercise of strong enforcement powers to impose meaningful penalties, rather than legislation that primarily provides guidance. All four initiatives incorporate the possibility of after-the-fact financial penalties for non-compliance. However, for those initiatives that are now in force, it remains to be seen whether severe penalties will actually be meted out, especially when it comes to TFGBV-related infractions.Footnote ²⁶² Further, for larger entities who may profit substantially from both perpetuating others’ TFGBV and perpetrating it themselves in structural form (or who resist intervention under the banner of protecting free expression),Footnote ²⁶³ ex post fines may not be sufficient. Here, expansion of the possibility of court-ordered business disruption measures and criminal prosecution of senior managers of chronically non-compliant regulated entities, such as those provided for under the OSA,Footnote ²⁶⁴ if made specific to TFGBV-related instances, could prove useful in driving home the substantive nature of the obligations at stake.

(iii) No-go zones with enforceable bottom lines—Closely tied to transitioning to substantive rather than procedural regulatory measures is the implementation of no-go zones. The AI Act and SSMA set out the clearest examples of these. First, the AI Act explicitly articulates a list of prohibited practices relating to AI, including certain dealings with AI systems facilitating purposefully manipulative or deceptive techniques, social scoring, prediction of future criminality, emotion inferenceFootnote ²⁶⁵ in certain situations, and biometric categorisation.Footnote ²⁶⁶ These reflect careful prior evaluation of uses of AI systems deemed too problematic to be allowed into the market. Further, in 2026, as part of the Digital Omnibus on AI, the COE and European Parliament agreed to amend the AI Act to impose prohibitions on AI practices relating to ‘generation of non-consensual sexual and intimate content [and CSAM]’,Footnote ²⁶⁷ both of which are common forms of TFGBV. The ban would prohibit, as of 2 December 2026, ‘placing AI systems on the EU market with the purpose of creating such content’, ‘placing them on the EU market without reasonable safety measures to prevent such creation’, and ‘deployers using these systems for the purpose of creating such content’ (including audio, images or video).Footnote ²⁶⁸

Second, the AI Act provides specific rules for tighter controls on high-risk AI systems, many of which also present threats to human rights. While not banning high-risk systems entirely, satisfaction of certain requirements is necessary before they are permitted entry into the market,Footnote ²⁶⁹ allowing for prior review as a condition precedent to unleashing these systems onto the public.Footnote ²⁷⁰ Though not specific to GBV or to TFGBV, some of the human rights harms sought to be avoided overlap with these forms of violence. And, in any event, these examples from the AI Act demonstrate that the imposition of no-go zones is at least in theory a plausible response for proactively addressing systemic perpetration of violence by tech corporations.

Without directly prohibiting certain chatbot functions, the SSMA would impose a no-go zone of sorts by requiring regulated chatbot providers to implement measures to prevent them from engaging in certain types of behaviours.Footnote ²⁷¹ The SSMA’s age verification requirements would impose another type of no-go zone in relation to children. First, regulated entities would be required to implement age verification or estimation measures to prevent those under the age of 18 from accessing pornographic content on their services.Footnote ²⁷² Second, regulated entities would have to implement similar verification mechanisms to prevent those under 16 from having a social media account, unless they obtain an exemption from the DSCC by demonstrating that they have designed their systems to adequately safeguard children.Footnote ²⁷³ Use of age verification mechanisms to create no-go zones raises a myriad of concerns, including disparate impacts on marginalised communities, privacy, access to information and efficacy.Footnote ²⁷⁴ Widespread threat of age-related bans in numerous jurisdictions worldwide, coupled with the capacity to avoid them through design choices, is one way of incentivising material change in platform design. However, the AI Act’s direct approach of articulating no-go zones offers a more principled and rights-respecting means of achieving the kind of systemic and structural change that will be essential in addressing tech corporations’ multiple roles in TFGBV.

(iv) Effective individual remedies—All four initiatives offer tools for corporate accountability to individuals, with the DSA and AI Act offering the strongest examples. The DSA imposes detailed and explicit obligations on regulated entities to provide ‘timely, non-discriminatory, diligent and non-arbitrary’ internal complaints mechanisms for users with respect to corporate decisions relating to content (and to take measures to protect complaint mechanisms from abuse).Footnote ²⁷⁵ Not only are users entitled to ‘effective, user-friendly, free’ mechanisms that are not fully automated and that allow for e-filing of complaints, but also, in certain cases, to be provided with reasons for decision and information about additional dispute resolution processes, including through impartial, independent, expert DSC-approved out-of-court dispute settlement processes established under the Act, as well as court-based redress.Footnote ²⁷⁶

The AI Act provides several individual remedies relating to violation of its provisions. These include the right of individuals to submit complaints about infringements to the relevant market surveillance authority,Footnote ²⁷⁷ and the right of individuals affected by a decision based on an output from a certain high-risk AI system that significantly affects them (including by having an adverse effect on their fundamental rights) to obtain from the deployer of that system ‘clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken’.Footnote ²⁷⁸ Further, whistleblower protection is offered to ‘persons reporting such infringements’.Footnote ²⁷⁹

The SSMA would require regulated social media services to implement mechanisms to allow users to block other users and to report harmful content to the service, and to file certain content-related complaints with the DSCC, and to render NCDI and CSAM inaccessible to everyone in Canada within 24 hours of a report.Footnote ²⁸⁰ Perhaps most importantly, the SSMA’s proposed DSCC would provide assistance to users of regulated services,Footnote ²⁸¹ potentially supporting those targeted by TFGBV in having content removed and accessing other kinds of remedial responses and resources expeditiously.Footnote ²⁸²

The OSA imposes obligations relating to monitoring for, and takedown of, illegal content,Footnote ²⁸³ but also mandates regulated entities to offer easily accessible tools to allow individuals to manage the content to which they are exposed,Footnote ²⁸⁴ as well as providing clear complaints procedures.Footnote ²⁸⁵ However, it offers little guidance with respect to moderation of harmful, but legal content, or to user rights in relation to moderation decisions made under corporate terms of service.Footnote ²⁸⁶

None of these initiatives satisfies all four criteria in our fortified BHR approach, though provisions within the EU initiatives provide some of the most promising examples. First, where gender inclusivity and broad-spectrum coverage are concerned, only the OSA and DSA explicitly focus on disproportionate harms to women and girls and corporations’ systemic roles in facilitating such harms. However, none of the four approaches gender inclusively or refers explicitly to international human rights instruments relating to gender or racial equality or to GBV. Second, in terms of prevention and accountability mechanisms, all four initiatives refer to human rights and incorporate due diligence mechanisms backed by accountability measures without necessarily tying due diligence specifically to human rights. Yet rights to equality and non-discrimination are infrequently referenced and none of the initiatives explicitly incorporates equality into regulated entities’ mandatory obligations. That said, the DSA and OSA, and to a lesser extent the SSMA, make certain regulated entities accountable not just for harmful content posted by others, but also for harms arising from the operation of their own systems and the OSA and SSMA allow for the possibility of prosecution for certain situations of non-compliance. Third, of the four initiatives, the AI Act goes furthest in imposing no-go zones by prohibiting certain dealings with AI systems, including generation of CSAM and NCDI, both of which can be forms of TFGBV, while the SSMA imposes specific kinds of constraints on chatbots and in relation to children. Fourth, with respect to effective remedies, all four initiatives provide for various kinds of individual remedies, including services to support those targeted by harmful content and corporate-provided complaint and takedown mechanisms.