Four Canadian regulators found that OpenAI broke privacy rules and then announced no penalty. Buyers should read that as a gap to fill, not a reprieve.
- The May 6 findings on ChatGPT came with commitments from OpenAI, not a fine or an order.
- Bill C-36 would add penalties, but it has had no debate since first reading on June 15.
- Until it moves, the findings work best as a vendor checklist you can use this month.
Canada’s privacy regulators said ChatGPT’s collection of personal information was “overbroad and therefore inappropriate” and that OpenAI “failed to obtain valid consent.” Then they published no fine. With no penalty to point at, a company has to decide on its own whether the findings matter to it. Read the clause, not the headline. This column argues that waiting for a fine is the expensive choice.
TL;DR
The federal privacy commissioner and the regulators in Quebec, British Columbia and Alberta investigated ChatGPT together and found problems with consent, collection, accuracy, transparency and retention. OpenAI made commitments, and the regulators will monitor them. Nothing in the release imposes a penalty. Companies that buy AI tools can still use the findings as a list of questions for every vendor, starting now.
What did the regulators actually find about ChatGPT?
They found that the way ChatGPT was built and released fell short of Canadian privacy law on several counts, and the regulators classed the matter as well-founded and conditionally resolved.
The joint investigation covered the federal Office of the Privacy Commissioner and its counterparts in Quebec, British Columbia and Alberta. Each office worked under its own statute, and the release says the conclusions varied between them. The common thread was a list. Collection was too broad. Consent was not valid. OpenAI had not assessed the accuracy of personal information in its outputs, was not transparent enough, gave people limited ability to see or delete their data, and had deployed the product without a formal retention and deletion policy.
In return, OpenAI agreed to a schedule. Within three months it will tell users that chats may be reviewed and used to train models, and advise them not to share sensitive information. Within six months it will make data exports easier, confirm protections for future training datasets and test safeguards for minor family members of public figures. It will report to the regulators quarterly. Note what the schedule does not contain. The May 6 release and its backgrounder mention no penalty.
Why does a finding without a fine still matter to a Canadian company?
Because the findings describe how a regulator reads consent, collection and retention in an AI product, and your own use of that product sits under the same statutes. The finding is about OpenAI. The reasoning applies to everyone who uses the product.
The commissioner has made the weakness of the current regime plain before. In an earlier annual report the office warned that a company found in contravention can simply wait out the process until the courts catch up. That was written in 2019, and the powers described there are the reason a conditional resolution looks light. We have not verified today’s enforcement powers against the current statutes, so treat that point as background, not as a current legal claim.
What a conditional resolution does produce is a public record of what the regulators consider inadequate. A company that signs a contract with a vendor it knew had been told to fix consent and retention, and asked no questions, has a hard conversation ahead if a complaint ever arrives.
Is Bill C-36 going to fix this soon?
Not on any timeline a buyer can plan around. The bill had first reading on June 15, and the parliamentary record shows the bill awaiting second reading, with no debate recorded so far.
Bill C-36, the Protecting Privacy and Consumer Data Act, is sponsored by the Minister of Artificial Intelligence and Digital Innovation. It sets administrative penalties of up to the greater of $10 million or 3% of gross global revenue, as summarized by Torys,, adds a requirement to explain automated decisions and broadens the legitimate interest ground for using data. We covered what the bill regulates without being an AI law in August. The House sits the weeks of October 5, October 19 and October 26, so there are only three chances this month for it to move. The country has been here before, when AIDA died in Parliament and left a gap that is still open.
What should a company do with the findings now?
Turn each finding into a question and put it to every AI vendor whose product touches personal information. It takes a couple of hours and does not need a lawyer to start.
- Ask what personal information the tool collects, and whether any of it is collected beyond what your use needs.
- Ask how consent is obtained, and whether your staff and customers see it or only you do.
- Ask whether chats or uploads are used to train models, and how to switch that off.
- Ask for the written retention and deletion policy. If there is none, record that.
- Ask how a person can see or delete what the tool holds about them.
- Tell staff not to paste sensitive customer information into any tool that has not passed the first five.
- Write the answers down with a date. A dated record is worth more than a good memory.
Most small and mid-sized firms already have staff using these tools. The Privacy Commissioner’s warning to Parliament was that many businesses had not noticed the exposure. A list like this is the cheapest way to notice.
What does the sceptic say?
The strongest counter-argument is that the findings bind OpenAI and not its customers, so there is no legal duty to act and any effort is wasted if the bill rewrites the consent test. That is a fair reading of the text. A company with limited time could reasonably wait for the law to settle before it spends any.
The cost of the checklist is a few hours. The cost of waiting is that the questions get asked later, by someone else, with less time. This view would be wrong in one case. If Bill C-36 clears second reading with a consent test loose enough to make most of these findings moot, the checklist loses force and it would be fair to say so. That is the thing to watch for.
What to watch
- Whether second reading debate on Bill C-36 starts during the October sitting weeks.
- OpenAI’s three-month notice about chat review and training, due by early August if counted from the May release, and any report on whether it appeared.
- The six-month commitments on data exports and dataset protections, due in November.
- Whether the regulators publish anything from the quarterly reports.
Frequently asked questions
Did Canadian regulators fine OpenAI?
No penalty is mentioned in the May 6 release or its backgrounder. The matter was classed as well-founded and conditionally resolved, with commitments and monitoring.
Does the ChatGPT finding apply to other AI tools?
The finding is about OpenAI, but the reasoning on consent, collection, retention and transparency is the standard regulators are likely to apply elsewhere. That is an analysis, not a legal ruling.
Is Bill C-36 law yet?
No. It had first reading on June 15 and has not been debated at second reading as of this writing.
The decision in one line
A regulator has told you in public what an acceptable AI vendor looks like, and the list is free. The fine, if it ever comes, will go to someone who did not read it. A couple of hours with the findings is cheaper.
Disclosure. This column is analysis and opinion, not legal advice. Facts were checked against the regulators’ releases and the parliamentary record on October 2, 2026.
Written by the AI Magazine Canada team, reviewed by the AI Magazine Canada editorial team.
