Canada Rules OpenAI Broke Privacy Law Training ChatGPT

Canada’s privacy watchdogs ruled Wednesday that OpenAI broke the law when it trained ChatGPT, the first formal Canadian finding of its kind against a generative AI company.

Canadian regulators ruled May 6 that OpenAI violated federal and provincial privacy laws while training ChatGPT, scraping personal data on health, politics and children without consent. The Office of the Privacy Commissioner accepted operational fixes instead of fines. OpenAI has retired the older models and agreed to deletion, filtering and transparency reforms.

Federal Privacy Commissioner Philippe Dufresne announced the findings alongside counterparts from Quebec, British Columbia and Alberta at a joint press conference in Ottawa, telegraphed by an OPC media advisory issued two days earlier. The investigation began in 2023 and ran for nearly three years before regulators released the public report.

Inside The Four-Province Probe Of ChatGPT

The joint investigation paired the federal OPC with Quebec’s Commission d’accès à l’information, BC’s Office of the Information and Privacy Commissioner, and Alberta’s Information and Privacy Commissioner. Each office tested OpenAI’s compliance against its own statute. The result, published as PIPEDA Findings #2026-002, lists overlapping violations of the Personal Information Protection and Electronic Documents Act and three provincial laws.

Findings differed by jurisdiction because the underlying laws differ. All four offices reached the same destination on the central question: OpenAI launched ChatGPT in late 2022 with no consent mechanism for the Canadians whose data fed the model.

Sensitive Data Pulled In Without Permission

The regulators traced the training pipeline back to indiscriminate scraping of public websites, social platforms, blogs and news pages. OpenAI’s filters did not strip out the categories Canadian law treats as most sensitive. The report names three categories the regulators flagged.

• Health information harvested from forum posts, patient blogs and news coverage of identifiable patients.
• Political views collected from comment threads, opinion writing and social posts attributed to named individuals.
• Children’s data pulled from publicly accessible pages, including school websites and parenting forums.

“OpenAI launched ChatGPT without having fully addressed known privacy issues,” Dufresne said in his May 6 statement to reporters. He warned that the gap left Canadians “exposed to potential risks of harm such as breaches and discrimination on the basis of information about them.”

BC Commissioner Michael Harvey went further at the same press conference. He said ChatGPT, as currently designed, “cannot be compliant” with the province’s Personal Information Protection Act. That puts every Canadian deployment of the chatbot on notice and signals further provincial action if OpenAI’s commitments slip.

What OpenAI Agreed To Change

OpenAI cooperated through the probe and accepted a list of binding commitments rather than fight enforcement. The company has already retired the older ChatGPT models trained on the contested data. Future models built for Canadian users will run through new safeguards.

• A filtering tool that detects and masks names, phone numbers and other direct identifiers in scraped datasets before training begins.
• A formal retention policy governing how personal information is held and disposed of inside the company’s data systems.
• An independent third-party assessment of accuracy for personal information that appears in ChatGPT outputs.
• Source links in model responses where personal information is involved, plus a flag when no source exists.
• More prominent disclaimers in the chat interface itself, not buried in a settings page.

The OPC’s official news release on the joint investigation says OpenAI will report back to Dufresne’s office on its progress against the deletion commitments. The federal commissioner described the deletion gap as the clearest hole the probe surfaced.

Why The Regulators Skipped The Fines

PIPEDA does not give the federal commissioner power to issue monetary penalties. The structural gap explains the missing fine. The provincial commissioners can issue orders but rarely impose financial penalties on first contact.

Dufresne said the office is “encouraged by the privacy-protective measures that OpenAI has implemented or committed to implement.” The framing matters because it locks OpenAI into a public compliance roadmap that the OPC can revisit if commitments slip.

Critics will note that OpenAI faced the same kind of inquiry in Italy in 2023 and absorbed a 15 million euro fine from the Garante in late 2024 without slowing growth. Canada’s softer route, cooperation in exchange for documented changes with the threat of enforcement held in reserve, depends on OpenAI’s continued willingness to play along.

The Push To Modernize Canadian Privacy Law

The regulators used the report to lobby for legislative change. Harvey confirmed he sent a letter to Canada’s Minister of Citizen Services calling for a rewrite of provincial and federal statutes that predate generative AI. Quebec’s Naomi Ayotte and Alberta’s Diane McLeod backed the same position from their offices, framing the OpenAI case as a stress test for the existing rulebook.

Ayotte put the political stakes plainly during the briefing.

“New technologies can bring us further and faster. That said, if we allow them to feed off of our private data, we will be paying the price, both collectively and individually. Organizations need to adopt practices that respect privacy. Generative AI impacts all aspects of our lives, and so these technologies need to be created with an increased focus on fundamental rights.”

McLeod added that she hopes “other technology companies that are developing and deploying AI or other novel technologies also learn from this report that privacy must be a top priority and cannot be an afterthought.” The signal to Anthropic, Google, Meta, Cohere and every Canadian generative AI startup is direct: assume the same questions are coming.

Harvey’s framing was the most forward-leaning. He said modernizing rules “does not mean removing guardrails as this powerful technology races ahead. We need to make sure that AI works for us, not the other way around.” For now, the OPC’s monitoring posture is the only enforcement layer Canadians have.

Federal legislation to replace PIPEDA, the Consumer Privacy Protection Act, died on the order paper in 2024 when Parliament was prorogued. Without a successor bill, Dufresne’s office is using investigations like this one as a substitute. That works for one company at a time. A national framework requires an Act of Parliament.

Frequently Asked Questions

Does The Ruling Apply To ChatGPT I Use Today?

No. The OPC said OpenAI retired the older models that contained the contested training data. Current ChatGPT versions sit under a new commitments package that includes filtering of names and phone numbers, a formal retention policy and source links for personal information in outputs. If you want to remove your data, OpenAI accepts deletion requests through its consumer privacy request portal.

Can I File A Complaint If I Find My Data In ChatGPT?

Yes. Canadians can file a complaint directly with the Office of the Privacy Commissioner online or by mail at no cost. You can also approach your provincial commissioner if you live in Quebec, Alberta or BC, since each office holds parallel authority. Include the chatbot output, the date you generated it and any account identifier you used. The OPC will assign a case officer.

Will OpenAI Be Fined In Canada?

No, not under the current law. PIPEDA does not give the federal commissioner power to issue monetary penalties, which is part of why regulators are pushing Parliament to pass replacement legislation. OpenAI was fined 15 million euros by Italy’s Garante in late 2024 for similar conduct, but the Canadian regime works through findings, recommendations and ongoing oversight rather than fines.

What Counts As Sensitive Data Under Canadian Privacy Law?

Health information, political and religious views, sexual orientation, financial details, biometric data and any data about children all carry heightened protection under PIPEDA and the provincial laws. The Canadian probe found OpenAI’s training set pulled the first three categories without consent. The legal threshold for collecting this data is meaningful, informed permission, which indiscriminate scraping by definition cannot deliver.

The Canadian decision puts a marker down for every other regulator weighing the same questions about generative AI. It does not stop OpenAI from operating in Canada, and it does not give individual Canadians a quick path to remove themselves from a model already trained. What it does is convert a public debate into a binding compliance schedule with a named federal officer holding the file. The next test will come when the next OpenAI model ships.