Canadian regulators find ChatGPT privacy rules broken from the start
Canadian regulators find ChatGPT privacy rules broken from the start
https://ppc.land/canadian-regulators-find-chatgpt-privacy-rules-broken-from-the-start/
Publish Date: 2026-05-06 12:14:00
Source Domain: ppc.land
Four Canadian privacy regulators today published the findings of a joint investigation into OpenAI OpCo, LLC, concluding that the company violated federal and provincial privacy laws when it developed and deployed its ChatGPT service. The 128-page report, released on May 6, 2026, under citation 2026 BCIPC 41, covers seven distinct legal issues spanning data collection, consent, accuracy, transparency, and data retention – areas that sit at the heart of how AI companies build their products.
The investigation was jointly conducted by the Office of the Privacy Commissioner of Canada (OPC), the Commission d’accès à l’information du Québec (CAI), the Office of the Information and Privacy Commissioner for British Columbia (OIPC-BC), and the Office of the Information and Privacy Commissioner of Alberta (OIPC-AB). The four offices examined whether OpenAI’s practices, specifically relating to the GPT-3.5 and GPT-4 models that powered ChatGPT at the time the investigation launched, were consistent with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act Respecting the Protection of Personal Information in the Private Sector, British Columbia’s Personal Information Protection Act (PIPA-BC), and Alberta’s Personal Information Protection Act (PIPA-AB).
What set off the investigation
The process began in April 2023, when the OPC launched an inquiry following a complaint that alleged OpenAI had collected, used, and disclosed a complainant’s personal information without consent. A month later, in May 2023, the OPC decided to close that initial complaint and instead initiated a broader investigation under section 11(2) of PIPEDA. The three other provincial and territorial offices joined in parallel, triggering investigations under their respective statutes. The offices chose to work jointly to avoid duplicating effort and to pool expertise.
According to the report, investigators conducted extensive written exchanges…
