PIPEDA Findings #2026-002: Joint Investigation of OpenAI OpCo, LLC
This joint investigation by privacy authorities across Canada found that OpenAI contravened privacy laws in its collection, use, and disclosure of personal information through its ChatGPT models GPT-3.5 and GPT-4. Specifically, the investigation found that OpenAI's collection of personal information from publicly accessible websites for training purposes was overbroad and inappropriate. The company also failed to obtain valid consent and be sufficiently transparent about its data practices. While OpenAI has since implemented new mitigation measures and committed to further improvements, some provincial authorities found the new measures insufficient to meet their specific legislative requirements.
- Appropriateness of purpose for data collection and use
- Validity of consent and transparency obligations
- Accuracy of generated information
- Individual rights to access, correction, and deletion
Well-founded and conditionally resolved for PIPEDA matters, but well-founded and unresolved for some provincial privacy act matters.
OpenAI's collection and use of personal information from publicly accessible websites for training its AI models was found to be overbroad and inappropriate, contravening privacy laws. While the company has implemented new measures and committed to further improvements, some provincial authorities found these measures insufficient to meet their specific consent requirements.
AI-generated summary for reference only. Always verify against the official decision ↗
OpenAI committed to implementing various measures to address privacy concerns, including enhancing transparency, improving consent processes, and refining data handling practices.
- subsection 5(3) of PIPEDA
- sections 2, 11, 14 and 17 of PIPA-BC
- sections 2, 3, 11, 16 and 19 of PIPA-AB
- section 5 of Quebec’s Private Sector Act
- Principle 4.3 of Schedule 1 of PIPEDA
- sections 7 and 8 of PIPA-AB
- sections 6-8 of PIPA-BC
- Principle 4.8 of Schedule 1 of PIPEDA
- section 10 of PIPA-BC
- section 13 of PIPA-AB
- Principle 4.6 of Schedule 1 of PIPEDA
- section 33 of PIPA-AB
- section 33 of PIPA-BC
- section 11 of Quebec’s Private Sector Act
- Principle 4.9 of Schedule 1 of PIPEDA
- section 24 of PIPA-AB
- section 23 of PIPA-BC
- sections 27 and 29 of Quebec’s Private Sector Act
- Principle 1 of Schedule 1 of PIPEDA
- sections 4(2), 4(3) and 5 of PIPA-BC
- sections 5 and 6 of PIPA-AB
- sections 3.1 and 3.2 of Quebec’s Private Sector Act
This summary is informational only and not legal advice.