Canadian privacy regulators concluded Wednesday that OpenAI violated federal and provincial privacy laws while collecting data to train ChatGPT [1].

The finding signals a growing regulatory effort to hold artificial intelligence developers accountable for how they scrape personal information from the internet. As AI models integrate deeper into public infrastructure, the lack of transparency regarding data sourcing creates significant legal and ethical risks for users.

Federal Privacy Commissioner Philippe Dufresne and three provincial counterparts coordinated the investigation from Ottawa [1, 2]. The group of four watchdogs determined that the company collected personal information without valid consent, and failed to implement required privacy safeguards [1, 3].

"OpenAI did not respect Canadian privacy laws in collecting data to train ChatGPT," Dufresne said [4].

In a collective statement, the commissioners said OpenAI collected personal information without adequate safeguards and valid consent [1]. The report highlights a systemic failure to adhere to the legislative frameworks governing the privacy of Canadian citizens.

Political figures have reacted to the findings. Pierre Poilievre said, "Tech giants need to follow our laws" [5].

Despite the findings of legal violations, the company has not faced any penalties [6]. There are conflicting reports regarding the current status of the breaches; some reports indicate OpenAI has since addressed the major issues identified in the probe, while others emphasize the lack of formal sanctions [1, 6].

The investigation focused on the training phase of the ChatGPT model, during which massive amounts of data are ingested to improve the AI's linguistic capabilities. Regulators found that this process bypassed the necessity for explicit user permission, which is a cornerstone of Canadian privacy law.

“"OpenAI did not respect Canadian privacy laws in collecting data to train ChatGPT."”

This ruling establishes a regulatory precedent in Canada that the 'scraping' of public data for AI training is not a blanket exemption from privacy legislation. While the absence of immediate penalties suggests a preference for compliance over punishment, the coordinated effort between federal and provincial watchdogs indicates a unified front that may lead to stricter AI governance and potential fines for future infractions.