Canada’s federal and provincial privacy regulators have concluded that OpenAI violated Canadian privacy laws in the development and launch of the first version of ChatGPT, following a nearly three-year investigation into the company’s handling of personal data.
The findings, released Wednesday, say the artificial intelligence company collected and used large amounts of personal information without obtaining meaningful consent or putting sufficient safeguards in place. However, regulators also acknowledged that the company has since implemented significant changes to address many of the concerns raised during the probe.
Canadian Privacy Regulators Cite Consent and Data Protection Failures
The investigation was led by the Office of the Privacy Commissioner of Canada, with participation from privacy authorities in Quebec, Alberta and British Columbia.
According to the report, OpenAI failed to provide Canadians with clear and effective ways to access, correct or delete their personal information after ChatGPT launched in late 2022. Regulators also found the company did not adequately warn users about the possibility of inaccurate or misleading responses generated by the chatbot.
Privacy Commissioner Philippe Dufresne said many individuals were unaware that their online information could be collected and used to train artificial intelligence systems.
The investigation began in April 2023 after a formal complaint was filed shortly after ChatGPT became widely available in Canada and around the world.
OpenAI Introduced Changes During the Investigation
Regulators noted that OpenAI has modified several of its practices since the investigation started.
Among the changes highlighted in the report are new filtering systems designed to detect and mask personal information, technical safeguards aimed at preventing ChatGPT from revealing sensitive details about public figures, and the introduction of formal retention and deletion policies for user data.
The company also agreed to introduce additional transparency measures in the coming months. These include publishing more information about how its AI models are trained and clarifying how conversations with ChatGPT may be used to improve future systems.
Users accessing the web version of ChatGPT while signed out will also receive clearer notices advising them not to share confidential or sensitive personal information.
“I’ve concluded that the measures that have been and that will be implemented by OpenAI will address the concerns identified during the investigation,” Dufresne said during a press conference in Ottawa.
An OpenAI spokesperson said the company remains committed to protecting user privacy and pointed to a newly published explanation of its privacy approach for Canadian users.
Quebec Watchdog Declined Financial Penalties
Although Quebec’s privacy regulator has the authority to impose monetary penalties for violations, officials chose not to pursue fines in this case.
Naomi Ayotte said regulators instead focused on securing commitments and policy changes from the company.
Legal experts say the outcome reflects a collaborative regulatory approach aimed at improving industry standards while avoiding lengthy legal battles.
Teresa Scassa described the result as a negotiated solution that could strengthen privacy protections while allowing technological innovation to continue.
AI Industry Practices Continue to Evolve
The report also highlights how rapidly the artificial intelligence sector has changed since ChatGPT’s initial launch.
Generative AI systems such as ChatGPT are trained using enormous datasets gathered from publicly available internet sources, including websites, blogs, discussion forums and social media platforms. Some of this material may contain personal information.
AI developers typically attempt to remove sensitive information before training models and implement safeguards to prevent systems from reproducing personal details. According to regulators, newer methods adopted by OpenAI now significantly reduce the amount of sensitive information used during training compared with earlier versions of the technology.
The report noted that the original AI models examined during the investigation have already been retired, reflecting the fast pace of development in the AI sector.
Michael Geist said the findings demonstrate how difficult it has become for lawmakers and regulators to keep pace with rapidly advancing AI technologies.
Calls Grow for Updated Canadian Privacy Laws
The investigation has renewed pressure on Ottawa to modernize Canada’s privacy legislation.
The federal Liberal government introduced privacy and data reform legislation in 2022, but the bill died after Parliament was prorogued in early 2025. A replacement bill has not yet been tabled.
Federal AI Minister Evan Solomon said updating Canada’s privacy framework remains a government priority as digital technologies evolve.
Experts say one of the biggest unresolved issues is determining how meaningful consent can realistically be obtained when AI companies rely on data scraped from the public internet.
Emily Laidlaw argued that the focus may need to shift away from traditional consent models toward stronger accountability standards and oversight mechanisms for AI companies.
Meanwhile, Alberta Information and Privacy Commissioner Diane McLeod called for broader regulatory powers, including mandatory privacy impact assessments and stronger enforcement tools before new technologies are released to the public.
Growing Debate Over AI Accountability in Canada
The OpenAI investigation is likely to become a landmark case in Canada’s broader debate over artificial intelligence regulation, privacy rights and corporate accountability.
As AI tools become increasingly integrated into workplaces, schools and daily life across Canada, regulators and lawmakers are facing mounting pressure to establish rules that balance innovation with stronger protections for personal information.
The findings also signal that Canadian privacy authorities expect global technology companies operating in Canada to comply with domestic standards, even as AI development continues at a rapid pace.
“Unapologetic communicator. Wannabe web lover. Friendly travel scholar. Problem solver. Amateur social mediaholic.”