Canada: Canadian privacy authorities concluded joint investigation into OpenAI OpCo for alleged violations of Canadian private sector privacy laws

On 6 May 2026, the Office of the Privacy Commissioner (OPC) and its provincial counterparts in Quebec, British Columbia, and Alberta issued findings following the investigation into OpenAI’s data collection and processing practices. The authorities found that the initial development and deployment of ChatGPT did not fully comply with applicable Canadian privacy laws, identifying issues such as excessive collection of personal information, insufficient consent and transparency, factual inaccuracies in outputs involving personal data, limitations in individuals’ ability to access, correct, or delete their information, and gaps in accountability for data under OpenAI’s control. In response to the findings, OpenAI introduced and committed to further measures aimed at addressing the findings and establishing privacy protections, including reducing the personal and sensitive data used to train new models and improving user information about how ChatGPT operates and its privacy implications. The OPC concluded that these measures, if fully implemented, address the concerns raised under PIPEDA and therefore found the complaint to be well-founded and conditionally resolved. The provincial regulators reached similar but not identical conclusions, the Quebec Commission on Access to Information found appropriate purposes, individual rights, and accountability conditionally resolved, and consent and retention unresolved. The Office of the Information and Privacy Commissioner for British Columbia and the Office of the Information and Privacy Commissioner of Alberta found the consent violations unresolved, indicating that they would continue to monitor compliance.