Canadian Privacy Regulators’ Joint Investigation Into ChatGPT Released

On May 6, 2026, the Privacy Commissioners of Canada, Quebec, British Columbia and Alberta (collectively, the Commissioners) released findings from a joint investigation into OpenAI’s collection, use and disclosure of Canadians’ personal information in developing and operating ChatGPT. The Commissioners concluded that the manner in which OpenAI initially trained early ChatGPT models, including GPT 3.5 and GPT-4, did not comply with applicable federal and provincial privacy laws.

The Commissioners’ investigation examined how OpenAI sourced its training data including publicly scraped content, licensed datasets and user interactions, for ChatGPT, and whether it adhered to key privacy principles including consent, transparency and accuracy.

The Commissioners identified several concerns with the initial development and deployment of ChatGPT. Specifically, the Commissioners found:

• Overcollection of personal information including sensitive information such as health conditions and political views;
• Lack of valid consent and transparency as many users were unaware that their information was being collected and used to train ChatGPT and OpenAI did not clearly explain that information collected from publicly accessible sources could include data from social media and other similar platforms;
• Factual inaccuracies and fabricated “hallucinations” as OpenAI had not assessed the accuracy of personal information generated in ChatGPT’s outputs;
• Inadequate mechanisms for individuals to access, correct or delete their personal information; and
• Insufficient accountability measures including deploying ChatGPT without having fully addressed known privacy risks and without establishing data deletion rules.

During the investigation, OpenAI implemented measures to improve privacy protections for personal information, including limiting the personal and sensitive information used to train its new ChatGPT models. OpenAI retired its earlier ChatGPT models trained in a manner that contravened Canadian privacy laws, and OpenAI implemented new safeguards in relation to its current models powering ChatGPT. OpenAI also committed to implementing additional measures to improve openness, access, retention and children’s privacy and will provide quarterly reports to the Commissioners to demonstrate its compliance with its commitments.

Each Commissioner investigated OpenAI’s compliance with the jurisdiction-specific privacy legislation that they oversee; as a result, the investigative findings varied between jurisdictions. The Commissioners’ full report, including findings under each Commissioner’s respective privacy laws, can be found here.

Summary By: Victoria Di Felice