Privacy Commissioner Philippe Dufresne of Canada found OpenAI non-compliant with federal and provincial privacy laws during an investigation. The investigation, which included commissioners from Alberta, Quebec, and British Columbia, determined that OpenAI violated Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
The commissioners identified several privacy issues, including the collection of vast amounts of personal information without adequate safeguards and the lack of consent for using such data to train AI models. Although ChatGPT includes warnings that user interactions may be utilized for training, third-party data obtained by OpenAI reportedly includes personal information that users may not be aware of.
An additional concern raised was that users lack the ability to access, correct, or delete their data. The investigation also criticized OpenAI for its inadequate acknowledgment of inaccuracies in some responses generated by ChatGPT.
Dufresne noted that OpenAI was responsive during the investigation and has pledged to implement changes in line with Canadian privacy laws. The company has retired older models that contravened regulations and is now utilizing a filtering tool designed to mask personal information from publicly accessible online data and licensed datasets used for training its models.
Within three months, OpenAI will add a notice to the signed-out version of ChatGPT, indicating that user interactions may be used for training and advising against sharing sensitive information. Within six months, the company intends to simplify its data export tools and clarify how users can contest the accuracy of information provided by ChatGPT.
OpenAI will also confirm to Privacy Commissioners that it has implemented strong protections for retired datasets, ensuring they cannot be used in ongoing development. Additional measures will protect minor relatives of public figures from having their information shared by the models.
The investigation into OpenAI’s privacy practices was initiated in 2023, amid increased scrutiny following a mass shooting in Tumbler Ridge in February 2026. OpenAI reportedly flagged the alleged shooter’s account in 2025 due to indications of real-world violence but did not escalate concerns to Canadian law enforcement. In response to the shooting, regulators mandated OpenAI to enhance its safety protocols and the company agreed to collaborate more closely with Canadian law enforcement and health agencies moving forward.
