Canadian privacy regulators find OpenAI violated privacy laws in developing ChatGPT

May 7, 2026

Four Canadian privacy regulators released a 128-page report on May 6, 2026, concluding that OpenAI violated federal and provincial privacy laws when developing ChatGPT's GPT-3.5 and GPT-4 models. The joint investigation, launched in April 2023, found OpenAI collected personal information from trillions of tokens scraped from public websites without proper consent, used a deceptive opt-out design requiring users to disable chat history, and launched ChatGPT without establishing accuracy standards or retention policies despite known factuality concerns. OpenAI, now valued at $730 billion with millions of Canadian users, disputes the findings and claims compliance through existing practices, while citing technical infeasibility of reversing model training. The regulators concluded OpenAI's accountability failures exposed individuals to risks including privacy breaches, inaccurate information, and discrimination.

Investigation scope and OpenAI's scale of operations

▪OpenAI announced US $110 billion in new investment at a US $730 billion pre-money valuation.
▪As of March 31, 2025, the OpenAI group of companies was valued at US $300 billion.
▪The Office of the Privacy Commissioner of Canada launched an inquiry in April 2023 following a complaint that alleged OpenAI had collected, used, and disclosed a complainant's personal information without consent.
▪In October 2025, several media outlets reported OpenAI's valuation at US $500 billion following a secondary share sale.
▪Four Canadian privacy regulators published findings of a joint investigation into OpenAI OpCo, LLC on May 6, 2026.
▪The Canadian privacy investigation report was 128 pages long and released under citation 2026 BCIPC 41.
▪The Office of the Privacy Commissioner of Canada closed the initial complaint in May 2023 and initiated a broader investigation under section 11(2) of PIPEDA.
▪Canadian privacy investigators conducted hands-on testing of ChatGPT versions 3.5 and 4 inside the Office of the Privacy Commissioner of Canada's technical laboratory between November 2023 and May 2024.

Training data collection and consent violations

▪Until April 2024, ChatGPT users who wished to opt out of having their interaction data used for training had to simultaneously disable their chat history.

Accuracy failures and AI hallucinations

▪An OpenAI co-founder stated regarding ChatGPT's launch in November 2022: "Our biggest concern was around factuality, because the model likes to fabricate things."