News release
Joint investigation by Canadian privacy regulators into OpenAI’s ChatGPT leads to better protections for Canadians’ personal information
May 6, 2026 – Ottawa, Ontario
In the wake of a joint investigation by the Privacy Commissioner of Canada and his provincial counterparts in Quebec, British Columbia, and Alberta that identified several concerns related to how OpenAI initially developed and deployed ChatGPT, the company has taken steps that better protect the personal information of Canadians.
The joint investigation examined OpenAI’s collection, use, and disclosure of personal information for the purpose of developing its AI-powered chatbot, ChatGPT.
The four regulators identified several privacy concerns and ultimately concluded that the way that OpenAI had initially trained ChatGPT was not compliant with their respective privacy laws.
The investigation revealed that a number of privacy issues were present in the initial training and deployment of ChatGPT, including: overcollection of personal information; lack of valid consent and transparency; factual inaccuracies involving personal information; issues related to individuals’ ability to access, correct and delete their personal information; and a lack of accountability for the personal information under OpenAI’s control.
Throughout the course of the investigation and in response to findings and recommendations made by the regulators, OpenAI implemented measures to improve protections for personal information in the ongoing development and delivery of ChatGPT and took steps to address privacy concerns in its operations.
In particular, OpenAI has significantly limited the personal information and sensitive information that is used to train new ChatGPT models. It will also be taking steps to better inform Canadians on the implications of using ChatGPT.
The Privacy Commissioner of Canada found that the measures that have been implemented by OpenAI, along with those that the company has committed to implementing in the coming months, will address the concerns identified during the investigation with respect to PIPEDA, Canada’s federal privacy law for the private sector. He has therefore found the complaint to be well-founded and conditionally resolved.
Each of the four regulators investigated compliance with the specific legislation that they oversee. As a result, the conclusions reached by each Office varied due to the differences in the laws that they enforce.
The Privacy Commissioner of Canada is encouraged by the privacy-protective measures that OpenAI has implemented or committed to implement. His Office will be monitoring the actions of the company to ensure that it continues to limit the impact that its AI tools have on individuals’ privacy.
Quote
“Addressing the privacy impacts of technologies, such as artificial intelligence, is of utmost importance and is key to ensuring that Canadians can benefit from new technologies without giving up their fundamental right to privacy.
Through this investigation, we identified emerging privacy issues early and made recommendations that led to improved protections for the personal information of Canadians.
This milestone investigation highlights the importance of prioritizing privacy in the development, deployment, and ongoing evolution of artificial intelligence so that Canadians are able to safely use and leverage the benefits of these technologies.
Appropriate safeguards are the cornerstone of responsible innovation. I expect that the findings of this investigation will inform and advance the privacy-protective design of other AI-powered technologies.
This investigation also further highlights the need to modernize Canada’s privacy laws for the digital age. As AI is increasingly being integrated into personal and professional applications, and while current privacy laws apply to AI, updated laws would help further support the safe deployment of new technologies to protect Canadians’ fundamental right to privacy.”
Philippe Dufresne
Privacy Commissioner of Canada
Related links
- Statement by the Privacy Commissioner of Canada regarding a joint investigation of OpenAI’s ChatGPT
- Backgrounder: Summary of joint investigation into OpenAI’s ChatGPT
- Overview of the joint investigation of OpenAI, OpCo, LLC
- Report of findings: Joint Investigation of OpenAI OpCo, LLC by the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, and the Office of the Information and Privacy Commissioner of Alberta
Media contacts
- Office of the Privacy Commissioner of Canada
communications@priv.gc.ca - Commission d’accès à l’information du Québec
media@cai.gouv.qc.ca - Office of the Information and Privacy Commissioner for British Columbia
MMitchell@oipc.bc.ca - Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
- Date modified: