Canadian Privacy Authorities Find OpenAI Violated Privacy Laws in ChatGPT Development
Canadian federal and provincial privacy regulators concluded that OpenAI violated privacy laws in developing ChatGPT by collecting personal data without adequate consent or safeguards, though the company has since implemented corrective measures that regulators say address their concerns.
What happened
A three-year investigation by federal and provincial privacy regulators found that OpenAI violated Canadian privacy laws when handling personal information for the initial release of ChatGPT.
OpenAI collected vast amounts of personal information without adequate safeguards and valid consent, with many users unaware their data were captured and used to train AI models. The company did not provide Canadians with an easy and effective way to correct and delete personal information, and released ChatGPT without first addressing known privacy risks.
Reported impact
Users' personal information was collected and used to train ChatGPT without adequate notice or consent. OpenAI did not adequately inform users about inaccuracies in ChatGPT responses.
Index analysis
OpenAI has implemented changes since the investigation began in April 2023, including filtering to detect and mask personal information, technical tools to block ChatGPT from revealing details about specific public figures, and a formal data retention and deletion policy. The company agreed to additional changes including publishing more information about privacy policies and content sources used to train models, and better informing unsigned users that their conversations may be used to train future models.
Governance controls
Privacy Commissioner of Canada Philippe Dufresne concluded that measures implemented and planned by OpenAI will address the concerns identified during the investigation. OpenAI stated it cares deeply about protecting users' privacy.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.