Federal (Canada)Personal Information Protection and Electronic Documents ActWell-founded & unresolved

PIPEDA Findings #2026-002: Joint Investigation of OpenAI OpCo, LLC

Organization: OpenAI OpCo, LLC

Plain-language brief

This joint investigation by the OPC, CAI, OIPC-BC, and OIPC-AB examined OpenAI OpCo, LLC's compliance with federal and provincial privacy laws regarding its ChatGPT service. The Offices investigated OpenAI's collection, use, and disclosure of personal information for model training, consent practices, openness, accuracy, individual rights (access, correction, deletion), data retention, and accountability. While OpenAI challenged jurisdiction and argued for implied consent, the Offices largely found contraventions in its initial practices, particularly concerning the overbroad collection of personal information from public sources and user interactions without valid consent or sufficient transparency. However, in response to the preliminary report, OpenAI committed to implementing significant privacy-enhancing measures, including a new filtering tool for training data, improved transparency, and enhanced individual rights processes. Consequently, the OPC found the matter well-founded and conditionally resolved under PIPEDA, expecting continued implementation and improvement of these measures. The OIPC-AB and OIPC-BC, due to stricter provincial consent requirements, found the consent issues well-founded and unresolved, while the CAI had mixed outcomes, also finding some issues unresolved. The Offices will monitor OpenAI's implementation of the agreed-upon recommendations.

Key issues

1Whether the Offices had jurisdiction over OpenAI's activities under federal and provincial privacy laws.
2Whether OpenAI collected, used, and disclosed personal information for purposes that a reasonable person would consider appropriate in the circumstances.
3Whether OpenAI obtained valid consent for the collection and use of personal information from publicly accessible websites and licensed third-party sources for model training.
4Whether OpenAI obtained valid consent and met its obligation to inform individuals with respect to the collection and use of personal information included in their interactions with ChatGPT.
5Whether OpenAI obtained valid consent and met its obligation to inform individuals with respect to the disclosure of personal information collected from various sources via ChatGPT.
6Whether OpenAI was sufficiently open and transparent about its models and information handling practices.
7Whether OpenAI took reasonable steps to ensure that the information it generates about individuals is as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
8Whether OpenAI provided individuals with the ability to obtain access to their personal information.
9Whether OpenAI provided individuals with the ability to correct their personal information.
10Whether OpenAI provided individuals with the ability to remove/delete their personal information from its models.
11Whether OpenAI established appropriate retention and disposal procedures for the personal information that it collects, uses, and discloses.
12Whether OpenAI met its accountability requirements in respect of the personal information under its control.
13Whether the personal or domestic purposes exemption applied to OpenAI's commercial activities.
14Whether the publicly available information exception applied to OpenAI's collection of personal information from the Internet.
15Whether the journalistic, historical, or genealogical material exception under Quebec's Private Sector Act applied to OpenAI's model training data.
16Whether section 9.1 of Quebec's Private Sector Act (privacy by default) applied to ChatGPT's privacy settings.

Outcome breakdownFavours: Applicant / complainant

Jurisdiction: Jurisdiction over OpenAI affirmed
Collection/Use for training: Initial practices found in contravention
Consent for training: Initial practices found in contravention
Transparency: Initial practices found in contravention
Individual rights: Initial practices found in contravention
PIPEDA compliance: Matter well-founded and conditionally resolved
Provincial consent (AB/BC): Issues well-founded and unresolved

Outcome

Complaint well-founded and conditionally resolved (OPC); Well-founded and unresolved for consent (OIPC-AB, OIPC-BC); Mixed outcomes for CAI

Reasoning

The OPC found that OpenAI's initial practices contravened PIPEDA, but due to OpenAI's significant commitments to implement privacy-enhancing measures and its deprecation of older models, the issues were deemed conditionally resolved, pending ongoing monitoring.

AI-generated summary for reference only. Always verify against the official decision ↗

Decision notes

Recommended action / remedy

OpenAI committed to implementing various privacy-enhancing measures, including a new filtering tool for training data, improved transparency in its communications, enhanced individual rights request handling, formal retention policies, and a protective measure for minor family members of public figures, with quarterly reporting to the Offices.

Statutes considered

Principle 4.1.3 PIPEDA
Principle 4.3 PIPEDA
Principle 4.5 PIPEDA
Principle 4.5.2 PIPEDA
Principle 4.5.3 PIPEDA
Principle 4.6 PIPEDA
Principle 4.8 PIPEDA
Principle 4.9 PIPEDA
s.5(3) PIPEDA
s.6.1 PIPEDA
s.7(1)(d) PIPEDA
s.7(2)(c) PIPEDA
s.7(3)(f) PIPEDA
s.2 PIPA-BC
s.3(2)(a) PIPA-BC
s.3(2)(c) PIPA-BC
s.4(2) PIPA-BC
s.4(3) PIPA-BC
s.5 PIPA-BC
s.6 PIPA-BC
s.7 PIPA-BC
s.8 PIPA-BC
s.9 PIPA-BC
s.10 PIPA-BC
s.11 PIPA-BC
s.12(1)(e) PIPA-BC
s.14 PIPA-BC
s.15(1)(e) PIPA-BC
s.17 PIPA-BC
s.18(1)(e) PIPA-BC
s.21(1) PIPA-BC
s.23 PIPA-BC
s.24 PIPA-BC
s.25 PIPA-BC
s.33 PIPA-BC
s.35 PIPA-BC
s.35(2) PIPA-BC
s.2 PIPA-AB
s.3 PIPA-AB
s.4(3)(a) PIPA-AB
s.5 PIPA-AB
s.6 PIPA-AB
s.7 PIPA-AB
s.8 PIPA-AB
s.8(1) PIPA-AB
s.8(2) PIPA-AB
s.8(2.1) PIPA-AB
s.8(2.2) PIPA-AB
s.8(3) PIPA-AB
s.9(1) PIPA-AB
s.9(4) PIPA-AB
s.11 PIPA-AB
s.13 PIPA-AB
s.13.1 PIPA-AB
s.14(e) PIPA-AB
s.16 PIPA-AB
s.17(e) PIPA-AB
s.19 PIPA-AB
s.20 PIPA-AB
s.20(j) PIPA-AB
s.24 PIPA-AB
s.25 PIPA-AB
s.33 PIPA-AB
s.35 PIPA-AB
s.35(2) PIPA-AB
s.1 Quebec's Private Sector Act
s.3.1 Quebec's Private Sector Act
s.3.2 Quebec's Private Sector Act
s.4 Quebec's Private Sector Act
s.4.1 Quebec's Private Sector Act
s.5 Quebec's Private Sector Act
s.6 Quebec's Private Sector Act
s.8 Quebec's Private Sector Act
s.8.2 Quebec's Private Sector Act
s.8.3 Quebec's Private Sector Act
s.9.1 Quebec's Private Sector Act
s.11 Quebec's Private Sector Act
s.12 Quebec's Private Sector Act
s.12(1) Quebec's Private Sector Act
s.13 Quebec's Private Sector Act
s.14 Quebec's Private Sector Act
s.15 Quebec's Private Sector Act
s.21 Quebec's Private Sector Act
s.21.01 Quebec's Private Sector Act
s.21.02 Quebec's Private Sector Act
s.23 Quebec's Private Sector Act
s.27 Quebec's Private Sector Act
s.28 Quebec's Private Sector Act
s.28.1 Quebec's Private Sector Act
s.29 Quebec's Private Sector Act

This summary is informational only and not legal advice.

Pro · AI

Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.

Pro

Coverage — 13 of 14 jurisdictions searchable

Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.

Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).

Coming soon: Nunavut — being re-processed for AI search.

Find decisions like this one — by meaning, not keywords.

Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.

Upgrade to Pro