Canada Says OpenAI Broke Privacy Law. Now What?
Matthew Leo · Published July 26, 2026 · Canada Tech
Canada found that OpenAI violated privacy law, but the federal regulator could not fine the company a single dollar.
A joint investigation by privacy authorities in Canada, Alberta, British Columbia and Quebec concluded that OpenAI’s original development of ChatGPT collected personal information too broadly, failed to obtain valid consent and did not give Canadians enough control over their data.
The investigation focused on GPT-3.5 and GPT-4, not OpenAI’s newer models. Regulators said the findings still matter because the same privacy questions apply to future AI systems.
What Did OpenAI Do Wrong?
More than 99% of the information used to pre-train the investigated models came from publicly accessible internet sources.
That included social media posts and discussion forums containing health information, political views, false claims and information about children. Regulators found that simply being visible online did not automatically make that information fair game for AI training.
They also found problems with transparency, accuracy and Canadians’ ability to access, correct or remove personal information connected to ChatGPT.
OpenAI has since introduced stronger filtering, clearer privacy notices, improved access tools and formal data-retention policies. The company also indicated that it retired the earlier models trained using the practices examined in the investigation.
So Was OpenAI Punished?
Not financially.
Under the current federal law, PIPEDA, the Privacy Commissioner can investigate and recommend changes but cannot directly issue binding orders or financial penalties. Stronger remedies generally require further legal action through the courts.
The federal investigation was declared conditionally resolved because OpenAI committed to implementing the recommendations. Regulators will continue monitoring its compliance.
However, Alberta and British Columbia found some consent issues unresolved, while Quebec also left parts of the case unresolved under its own law.
That is an important distinction.
OpenAI did not receive a clean bill of health. It received a list of changes and continued regulatory attention.
Canada’s New Privacy Bill Could Change That
Bill C-36, now at second reading in the House of Commons, would replace the federal private-sector privacy framework with stronger order-making and penalty powers.
The proposed law would allow administrative penalties of up to the greater of C$10 million or 3% of global revenue for certain violations. Serious offences could carry fines reaching the greater of C$25 million or 5% of global revenue.
The bill has not passed.
For now, Canada can publicly declare that a global AI company broke privacy law and then largely depend on that company to complete the promised repairs.
OpenAI’s cooperation is welcome.
A privacy system should not rely on cooperation alone.
The larger lesson from the ruling is not merely that early ChatGPT models collected too much information. It is that Canada’s privacy laws were built for an internet before companies could scrape enormous parts of it, turn the data into a model and sell the result back to millions of people.
Canada has identified the problem.
The next test is whether Parliament gives regulators enough power to make the next ruling hurt.