OpenAI violated Canadian privacy laws in AI model training, federal investigation finds

OpenAI violated privacy laws in data collection practices

Philippe Dufresne, the Privacy Commissioner of Canada, has determined that OpenAI was "not compliant with" Canadian privacy laws in the training of its AI models. Following a comprehensive privacy investigation, Dufresne and his counterparts from Alberta, Quebec, and British Columbia concluded that the company's approach to data collection without consent violated multiple regulations, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), which governs how companies handle personal information during business operations1

1

2

2

.

The federal and provincial privacy watchdogs identified several critical issues with OpenAI's practices. The company "gathered vast amounts of personal information without adequate safeguards to prevent use of that information to train its models," according to the investigation's findings1

1

. While ChatGPT includes warnings that user interactions may be utilized for AI model training, third-party data that OpenAI has purchased or scraped also contains personal details that individuals likely aren't even aware of2

2

.

Unauthorized collection of personal information raises concerns

The privacy investigation revealed that ChatGPT users have no way to access, correct, or delete their data once it has been collected—a significant violation of user data control principles. The commissioners also criticized OpenAI's inadequate acknowledgment of information accuracy issues in some of ChatGPT's responses1

1

2

2

.

Dufresne noted that OpenAI was open and responsive throughout the investigation process and has committed to implementing multiple changes to comply with Canadian privacy laws. The company has already retired earlier models that violated regulations and now employs a filtering tool designed to detect and mask personal information such as names and phone numbers in publicly accessible internet data and licensed datasets used for AI model training1

1

2

2

.

ChatGPT data usage policies face overhaul

Within the next three months, OpenAI has agreed to add a new notice to the signed-out version of ChatGPT explaining that chats can be used for training and advising users against sharing sensitive information. Within six months, the company intends to simplify its data export tools and clarify how users can contest the accuracy of information provided by ChatGPT2

2

.

OpenAI will also confirm to privacy commissioners that it has implemented strong data safeguards for retired datasets, ensuring they cannot be used in ongoing development. Additional measures will protect minors' data protection, specifically shielding minor relatives of public figures from having their information shared by the models2

2

.

Mass shooting scrutiny intensifies regulatory pressure

The investigation into OpenAI's privacy practices was initiated in 2023, but the company has faced increased scrutiny following a mass shooting in Tumbler Ridge in February 2026. OpenAI reportedly flagged the alleged shooter's account in 2025 due to indications of real-world violence but failed to escalate those concerns to Canadian law enforcement. Following the shooting, regulators demanded enhanced safety protocols, and OpenAI agreed to pursue more extensive law enforcement collaboration with Canadian authorities and health agencies moving forward1

1

2

2

.

Upon announcing the investigation in April 2023, Dufresne emphasized that AI technology and its effects on privacy are priorities for his office, stressing the importance of keeping up with and staying ahead of fast-moving technological advances3

3

. The findings were delivered by Dufresne and his counterparts from British Columbia, Alberta and Quebec, who collaborated on the joint probe3

3

.