Ruling2026 · CA-federal📣 Marketing, media & customer-facing AI

Canadian privacy regulators v. OpenAI — joint findings on ChatGPT training data

What happened

The federal Privacy Commissioner and the Quebec, British Columbia and Alberta commissioners jointly investigated how OpenAI collected and used Canadians' personal information to train GPT-3.5 and GPT-4 and to run ChatGPT. On 6 May 2026 they published PIPEDA Findings #2026-002. They found the web-scraped collection 'overbroad and therefore inappropriate', that OpenAI lacked valid consent for training on scraped data and on user chats, gave insufficient warnings about inaccurate outputs about real people, had weak access and correction tools, and had no retention policy for training data at launch.

The rule

PIPEDA and the Quebec, BC and Alberta private-sector privacy acts: appropriate purposes, consent, accuracy, openness, access and retention. The regulators held that scraping personal information from the internet is not collecting 'publicly available' information under Canadian law.

Outcome

Complaint well-founded. The federal OPC treated it as conditionally resolved on the strength of OpenAI's commitments (filtering tools, clearer notices about accuracy and sources, improved access tools, quarterly reporting); the Quebec, BC and Alberta offices found the consent and retention issues unresolved. No fine was imposed — PIPEDA gives the OPC no penalty powers.

What this means for you

In Canada, 'it was on the internet' does not give you a licence to train on personal data. Before fine-tuning or building on scraped or customer data, document why the collection is appropriate, get consent or confirm an exception, tell users their chats may be used for training, warn about inaccurate outputs, and set retention limits.

Laws involved

PIPEDA (Canada)In forceCA-federal
Quebec Law 25In forceCA-QC
Canada GenAI Code of ConductVoluntaryCA-federal

Sources

Last reviewed Sep 25, 2026.