OpenAI Violated Canadian Privacy Laws, Watchdogs Find

Joint investigators from the Office of the Privacy Commissioner of Canada and provincial privacy regulators in Quebec, British Columbia and Alberta released findings on May 6, 2026, concluding that the way Open AI initially developed and trained ChatGPT did not comply with Canadian privacy laws, according to the OPC news release (May 6, 2026). The regulators identified several issues, including overcollection of personal information, lack of valid consent and transparency, inaccuracies involving personal information, limited ability for individuals to access or correct data, and inadequate accountability for information under Open AI's control, per the OPC news release. Reporting by CBC, BetaKit, The Canadian Press, Global News and others summarized the investigators' findings that scraped sources included social media, discussion forums, blog posts and news articles, and could contain sensitive personal details such as health conditions, political views and information about children.

Per the joint investigation documentation posted by the OPC, the probe examined how Open AI collected, used and disclosed personal information when training early versions of ChatGPT. The regulators reported that training data sets included large volumes of information from publicly accessible sources and that safeguards to prevent use of personal information for model training were insufficient in the company's early development practices, as described in the OPC news release and summarized by CBC.

Industry-pattern observations: Large-scale model development commonly relies on aggregating text from public web sources. Regulators in this case focused on consent, notice and data minimization principles under PIPEDA and comparable provincial statutes. For practitioners, regulatory attention on the provenance and curation of training corpora increases the legal and compliance burden for teams using scraped web data, especially when datasets can contain sensitive categories of information.

Editorial analysis: The findings represent a national enforcement-level review by multiple Canadian privacy authorities acting jointly. This joint framing amplifies the regulatory signal beyond a single provincial interpretation, and the OPC's statement that the complaint is "well founded and conditionally resolved" ties the findings to concrete remediation steps reported in the news release. Multiple Canadian media outlets, including CBC and The Canadian Press, reported the regulators' concerns that individuals were unaware their publicly posted information could be used to train large language models and that inaccuracies in model outputs increased risk of harm.

Per the OPC news release, Open AI implemented measures in response to the findings, including significantly limiting the personal and sensitive information used to train new ChatGPT models and committing to further steps to better inform Canadians about uses of the tool. The OPC concluded that the measures already implemented, together with those committed for the coming months, address the concerns identified under Canada's federal private-sector privacy law, PIPEDA, according to the OPC news release.

Editorial analysis: Observers should track whether other national regulators adopt similar findings or enforcement approaches, and whether guidance or legislation clarifying consent and permissible uses of publicly available content for model training emerges. Also watch for follow-up reporting on the specific technical controls adopted, because the effectiveness of remediation will depend on measurable changes to data curation, retention and access processes. Finally, litigation and complaints lodged by affected individuals, which some outlets noted are already in process, may generate additional factual records bearing on regulatory remedies.

The joint probe was launched in 2023, according to media reports including CBC and BetaKit. BetaKit and other outlets also reported that families involved in litigation following the February Tumbler Ridge mass shooting have taken legal action related to Open AI's handling of content in that matter; those accounts are separate from the joint privacy investigation and were reported by BetaKit and media outlets.