Canada’s OpenAI Findings: What Businesses Need to Know About AI and Privacy Compliance

Introduction

The Office of the Privacy Commissioner of Canada (“OPC”), together with the privacy regulators in Quebec, British Columbia and Alberta, recently released the findings of their joint investigation into OpenAI OpCo, LLC (“OpenAI”), the developer of ChatGPT.^[1] The investigation examined whether OpenAI’s collection, use and disclosure of personal information in connection with the development and operation of ChatGPT complied with Canadian private-sector privacy legislation, including the Personal Information Protection and Electronic Documents Act,^[2] Quebec’s Act respecting the protection of personal information in the private sector,^[3] British Columbia’s Personal Information Protection Act^[4] and Alberta’s Personal Information Protection Act^[5] (collectively, the “Acts”).

The report, released in May 2026, followed a complaint filed in 2023 alleging that OpenAI had collected, used and disclosed personal information without consent. The report provides useful guidance to all private sector entities operating in Canada on the application of Canadian private-sector privacy laws to the development and deployment of generative artificial intelligence (“AI”).

Background

The investigation originated in 2023 following a complaint alleging that OpenAI had collected, used and disclosed personal information without consent. Given the potentially broad privacy implications of generative AI technologies, the federal regulator joined forces with the Quebec, British Columbia and Alberta privacy regulators to launch a joint investigation.

The investigation focused on ChatGPT and the GPT-3.5 and GPT-4 models that powered ChatGPT during the time of the investigation. Regulators examined how OpenAI collected information from publicly available internet sources, licensed datasets, user interactions with ChatGPT^[6] and conversations generated by human trainers.^[7]

The regulators found that OpenAI collects, uses and discloses personal information in the development and deployment of its models. In particular, the investigation analyzed the use of web-scraped data and user interactions to train and improve the models. The regulators concluded that OpenAI failed to satisfy several fundamental privacy requirements relating to consent, transparency, accuracy, accountability and the management of personal information.

A Nuanced View of AI Innovation

The investigators recognized the societal benefits of generative AI and acknowledged that technologies such as ChatGPT can promote education, creativity and innovation. The report also considered the need to balance privacy rights with freedom of expression and technological advancement.

Significantly, the regulators did not find that the development of generative AI models is inherently incompatible with Canadian privacy law. They accepted that developing and deploying ChatGPT can serve an appropriate purpose, while emphasizing that those activities must still comply with privacy-law requirements concerning consent, openness, accuracy and accountability. The findings therefore recognize the potential benefits of generative AI, without treating the novelty of the technology as a basis for relaxing established privacy obligations.

Consent Remains a Cornerstone

One of the regulators’ primary concerns was consent, a foundational principle of Canadian privacy law reflected in Principle 4.3 of PIPEDA.^[8] According to the findings, OpenAI relied extensively on personal information obtained from publicly accessible internet sources and from users’ interactions with ChatGPT. Regulators concluded that OpenAI had not obtained valid consent from affected individuals for certain collection, use and disclosure activities and that individuals were not adequately informed about how their information would be used.^[9]

These findings serve as a reminder that information being publicly available online does not necessarily mean that it can be collected and repurposed for AI training. Broadly speaking, Canadian privacy law requires that organizations ensure individuals have provided informed consent to the proposed use of their personal information, including ensuring that the proposed use aligns with what individuals would reasonably expect in the circumstances.

The findings are also consistent with the approach taken by Canadian privacy regulators in the Clearview AI investigation,^[10] where the regulators concluded that the collection of individuals’ personal information from publicly accessible websites did not eliminate the need to comply with applicable privacy law requirements relating to consent and appropriate purposes.

Transparency and Openness Remain Key Obligations

The regulators also examined whether OpenAI was sufficiently open about its models and its collection, use and disclosure of personal information.^[11] They found that OpenAI did not meet the openness and transparency requirements under the federal and provincial privacy Acts, including the openness principle set out in Principle 4.8 of PIPEDA.^[12]

The regulators found that, although OpenAI had published a Privacy Policy, Help Centre articles and other explanatory materials, key information regarding its data practices remained incomplete or unclear. In particular, OpenAI provided only high-level descriptions of the datasets used to train its models and did not sufficiently explain that personal information posted on websites, blogs, discussion forums or social media could be collected and used for model training. The regulators also noted concerns regarding the availability of privacy-related information in French. Ultimately, they concluded that important information required for individuals to understand OpenAI’s personal information practices was not adequately disclosed.

Accuracy and Individual Rights in the Age of AI

Another notable aspect of the investigation concerns the application of traditional privacy principles to AI-generated content. The regulators examined whether OpenAI took reasonable steps to ensure that personal information generated about individuals was “as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used,” as required by most privacy legislation across Canada.^[13]

The investigation found that OpenAI did not meet the accuracy requirements under the Acts.^[14] In reaching this conclusion, the regulators pointed to examples of ChatGPT generating inaccurate and potentially harmful information about individuals, including false allegations that could have significant reputational consequences. They also expressed concern that ChatGPT had been trained using information from sources such as social media platforms and online discussion forums, which may contain subjective, biased or inaccurate information, thereby increasing the risk of inaccurate outputs.

The regulators also considered whether OpenAI provided individuals with meaningful mechanisms to access, correct or delete their personal information.^[15] Although they initially identified deficiencies in OpenAI’s ability to give effect to these rights, they recognized that OpenAI had implemented new correction and deletion tools, including measures to filter personal information from training datasets and block specific personal details from appearing in outputs. As a result, the regulators concluded that OpenAI now provides individuals with an adequate mechanism to request corrections and deletions and found these aspects of the complaint to be conditionally resolved.

Accountability and Governance Expectations

The investigation also reinforces that established accountability requirements continue to apply in the context of AI systems. Accountability, a foundational principle of Canadian privacy law, requires organizations to be responsible for personal information under their control and to designate individuals accountable for compliance with privacy obligations.

The regulators found that OpenAI had not met its accountability obligations with respect to personal information under its control^[16] and had not established appropriate retention and disposal procedures for the personal information it collected, used and disclosed.^[17] In particular, OpenAI collected and used personal information from millions of individuals in Canada to train ChatGPT without first establishing the accuracy of personal information generated through model outputs or implementing a retention policy governing information used to develop and deploy its models.

Looking Ahead

At its core, the report demonstrates that existing privacy principles remain fully applicable even where personal information is collected, processed and generated through AI systems. In the OpenAI investigation, the regulators adopted a pragmatic approach: they recognized that generative AI offers substantial benefits and accepted that AI development may constitute an appropriate purpose under the applicable privacy legislation. At the same time, they reaffirmed that core privacy principles, including consent, transparency, accuracy, access rights and accountability, remain fully applicable in the AI era.

For organizations implementing generative AI tools, the investigation serves as a reminder to review privacy notices, internal governance documentation and vendor disclosures to ensure that AI-related data practices are described clearly and accurately. Organizations should also consider whether individuals are provided with sufficient information regarding the use of their information, available privacy choices and any applicable rights relating to access, correction or deletion.

For businesses operating in Canada, the question is not whether generative AI may be used, but whether it is deployed in a manner that complies with evolving privacy expectations. Organizations that invest in AI governance, transparency and privacy compliance now will be better positioned later to navigate a regulatory environment that is rapidly adapting to increasingly powerful AI technologies.

The Privacy & Data Security Group at Aird & Berlis LLP frequently advises on every aspect of complex privacy and data security matters, including transactions, commercial relationships, litigation, regulatory concerns and emerging technologies. Please contact the authors or a member of the group if you have any questions or require assistance.

[1] “Joint Investigation of OpenAI OpCo, LLC,” By the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, and the Office of the Information and Privacy Commissioner of Alberta, PIPEDA Findings #2026-002 (May 6, 2026). [“OpenAI Investigation”].