OpenAI violated Canadian privacy laws in AI model training, federal investigation finds

Canadian officials claim OpenAI violated federal and provincial privacy laws - Engadget

Philippe Dufresne, the Privacy Commissioner of Canada, has found OpenAI was "not compliant with" Canadian federal and provincial privacy laws in the training of its AI models. Following an investigation, Dufresne and his counterparts in Alberta, Quebec and British Columbia say OpenAI's approach to things like data collection and consent stepped on multiple laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how companies collect and use personal information during the normal course of business. The commissioners participating in the investigation identified multiple privacy issues with OpenAI's approach, including that the company "gathered vast amounts of personal information without adequate safeguards to prevent use of that information to train its models," and that it failed to acquire consent to collect and use that personal information in the first place. Warnings in ChatGPT note that interactions with the AI could be used in training, but third-party data OpenAI has purchased or scraped also includes personal details people likely aren't even aware of. The fact that ChatGPT users have no way to access, correct or delete that data was another issue that the commissioners identified, according to a summary of the investigation's findings, along with OpenAI's lackluster attempts to acknowledge the inaccuracy of some of ChatGPT's responses. Canada's Privacy Commissioner contends that OpenAI was open and responsive to the investigation, and has already committed to making multiple changes to ChatGPT to follow Canadian privacy laws. OpenAI has retired earlier models that violated Canadian privacy regulation, and now uses "a filtering tool to detect and mask personal information (such as names or phone numbers) in publicly accessible internet data and licensed datasets used to train its models," the Commissioner says. The company has also agreed within the next three months to add a new notice to the signed-out version of ChatGPT explaining that chats can be used for training and sensitive information shouldn't be shared, and within the next six months: While Canada's investigation into OpenAI's privacy policies was opened in 2023, the company has received scrutiny from regulators more recently because of its connection to the mass shooting that occurred in Tumbler Ridge in February 2026. OpenAI had reportedly flagged the alleged shooter's account in 2025 for containing warnings of real-world violence, but failed to escalate those concerns to Canadian law enforcement. Following the shooting, regulators demanded the company change its approach to safety, and OpenAI ultimately agreed to be more collaborative with Canadian law enforcement and health agencies in the future.

Canada finds OpenAI violated national privacy laws

Privacy Commissioner Philippe Dufresne of Canada found OpenAI non-compliant with federal and provincial privacy laws during an investigation. The investigation, which included commissioners from Alberta, Quebec, and British Columbia, determined that OpenAI violated Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). The commissioners identified several privacy issues, including the collection of vast amounts of personal information without adequate safeguards and the lack of consent for using such data to train AI models. Although ChatGPT includes warnings that user interactions may be utilized for training, third-party data obtained by OpenAI reportedly includes personal information that users may not be aware of. An additional concern raised was that users lack the ability to access, correct, or delete their data. The investigation also criticized OpenAI for its inadequate acknowledgment of inaccuracies in some responses generated by ChatGPT. Dufresne noted that OpenAI was responsive during the investigation and has pledged to implement changes in line with Canadian privacy laws. The company has retired older models that contravened regulations and is now utilizing a filtering tool designed to mask personal information from publicly accessible online data and licensed datasets used for training its models. Within three months, OpenAI will add a notice to the signed-out version of ChatGPT, indicating that user interactions may be used for training and advising against sharing sensitive information. Within six months, the company intends to simplify its data export tools and clarify how users can contest the accuracy of information provided by ChatGPT. OpenAI will also confirm to Privacy Commissioners that it has implemented strong protections for retired datasets, ensuring they cannot be used in ongoing development. Additional measures will protect minor relatives of public figures from having their information shared by the models. The investigation into OpenAI's privacy practices was initiated in 2023, amid increased scrutiny following a mass shooting in Tumbler Ridge in February 2026. OpenAI reportedly flagged the alleged shooter's account in 2025 due to indications of real-world violence but did not escalate concerns to Canadian law enforcement. In response to the shooting, regulators mandated OpenAI to enhance its safety protocols and the company agreed to collaborate more closely with Canadian law enforcement and health agencies moving forward.

Report on OpenAI expected from federal, provincial privacy watchdogs today

OTTAWA -- Privacy watchdogs plan to release a report today on OpenAI, the company behind the popular artificial intelligence-powered chatbot ChatGPT. Federal privacy commissioner Philippe Dufresne said just over three years ago that his office was investigating a complaint alleging the collection, use and disclosure of personal information without consent. The findings will be delivered by Dufresne and his counterparts from British Columbia, Alberta and Quebec, who collaborated on a joint probe. They plan to discuss their conclusions at a news conference in Ottawa. Upon announcing the investigation in April 2023, Dufresne said AI technology and its effects on privacy are priorities for his office. Dufresne stressed the importance of keeping up with -- and staying ahead of -- fast-moving technological advances. This report by The Canadian Press was first published May 6, 2026.