Joint Privacy Investigation Examining Whether OpenAI Violated Canadian Privacy Law

In April 2023, Canada’s Privacy Commissioner launched an investigation into OpenAI after receiving a complaint about ChatGPT’s handling of personal information. The investigation was subsequently joined by privacy commissioners in Quebec, British Columbia, and Alberta in May 2023, making it one of the first joint federal-provincial privacy investigations into a large language model.

The investigation is examining whether OpenAI violated the Personal Information Protection and Electronic Documents Act (PIPEDA) on multiple grounds: collecting personal information of Canadians without consent through web scraping to build training datasets, failing to ensure the accuracy of personal information generated by ChatGPT, and lacking transparency about how personal data was collected, used, and processed. The scope includes ChatGPT’s generation of false biographical statements about identifiable Canadians and whether this constitutes a failure to meet accuracy obligations under Canadian privacy law.

As of early 2026, the investigation remains ongoing. Privacy Commissioner Philippe Dufresne described it as his “ongoing investigation into OpenAI” in a February 2026 statement to Parliament. The investigation is one of the Privacy Commissioner’s most significant regulatory actions concerning AI systems and is expected to address whether companies deploying large language models in Canada bear privacy obligations for the outputs those systems generate — not just the data they consume.

The investigation addresses a tension in generative AI: systems trained on vast internet data inevitably absorb personal information about real people, and their probabilistic text generation can produce confidently stated falsehoods about identifiable individuals. The outcome of this investigation will help determine whether current Canadian privacy frameworks have applicability to these novel AI harms.