Philippe Dufresne, the Privacy Commissioner of Canada, found OpenAI “not compliant with” Canadian federal and provincial privacy laws following an investigation into the company’s data collection and consent practices. The inquiry involved counterparts from Alberta, Quebec, and British Columbia and centered on OpenAI’s approach under the Personal Information Protection and Electronic Documents Act (PIPEDA).
Investigators reported that OpenAI collected vast amounts of personal information without sufficient safeguards and without obtaining necessary consent. Although warnings in ChatGPT indicated that interactions could be used for training, it was highlighted that third-party data purchased or scraped by the company included personal details users might not be aware of.
The investigation identified that ChatGPT users lacked the ability to access, correct, or delete their data, raising significant privacy concerns. Additionally, investigators criticized OpenAI for inadequately acknowledging inaccuracies in some responses generated by ChatGPT.
Dufresne stated that OpenAI was cooperative during the investigation and has committed to making several changes to ensure compliance with Canadian privacy laws. OpenAI has retired earlier models that violated regulations and now employs a filtering tool to mask personal information in publicly available data and licensed datasets used for training.
Within three months, OpenAI will add a notice to the logged-out version of ChatGPT, informing users that chats could be used for training and advising against sharing sensitive information. Additionally, the company plans to simplify its data export tools and clarify the process for users to challenge ChatGPT’s response accuracy in the next six months.
OpenAI has also agreed to confirm to the Privacy Commissioners that robust protections will be established for future retired datasets. Furthermore, the company will test protective measures aimed at safeguarding the personal information of minor relatives of public figures.
The investigation into OpenAI’s privacy practices began in 2023. Recently, the company has come under scrutiny related to a mass shooting in Tumbler Ridge in February 2026. Reports indicate that the alleged shooter’s account had been flagged in 2025 for containing warnings of real-world violence, but OpenAI did not escalate these concerns to law enforcement.
Following the shooting, regulators demanded changes to OpenAI’s safety protocols, resulting in the company’s agreement to collaborate more closely with Canadian law enforcement and health agencies in the future.
