PIPEDA Complaints Are Up 109%. Your AI Tools Are Likely Why.

In June 2026, Canada's Office of the Privacy Commissioner tabled its annual report under a title that left little room for ambiguity: *Championing Privacy in the Age of AI*. The numbers behind that title should get the attention of any Canadian organization that has deployed AI tools in the past 18 months.

PIPEDA complaints reached 3,044 in the 2025–2026 reporting year — a 109% increase over the previous year, according to the OPC's 2025–2026 Annual Report. Privacy Act complaints rose 62% to 3,146, bringing total complaints filed with the Commissioner to 6,190, up 82% overall. The OPC has not identified a single root cause for the jump; its report attributes the rise to several factors, including AI-enhanced search tools that made the complaint process easier for Canadians to find. Whatever the driver, the direction is clear: Canadians are filing privacy complaints at a pace regulators have not seen before, and AI is at the centre of the surge.

The same reporting year produced one of the most consequential AI privacy rulings in Canadian history. On May 6, 2026, the OPC — jointly with Quebec's Commission d'accès à l'information (CAI) and the privacy commissioners of British Columbia and Alberta — released PIPEDA Findings #2026-002: a landmark investigation into how OpenAI developed and operates ChatGPT.

The finding is not just about OpenAI. Read as a signal of regulatory intent, it tells every Canadian organization using AI tools how the OPC is thinking — and what it will look for next.

What the ChatGPT Investigation Actually Found

The investigation examined two core questions: whether OpenAI's collection of personal information through web scraping was lawful under PIPEDA, and whether its use of user conversations to train its models was handled appropriately.

On web scraping, the regulators were unambiguous. OpenAI did not obtain valid consent for collecting personal data from publicly accessible websites — including Common Crawl and other public repositories — to train GPT-3.5 and GPT-4. The OPC and its provincial counterparts found that neither "publicly available" nor "implied consent" was an adequate legal basis for training data collection at this scale and sensitivity.

On user conversations, the OPC was more nuanced. It accepted that using chat interactions to improve model outputs was proportional to the residual privacy risk, given transparency measures OpenAI had implemented — including disclosures that conversations may be used for training. The OPC rated this part of the complaint not-well-founded.

One finding deserves particular attention regardless of sector: OpenAI confirmed that it had not conducted an assessment to expressly validate the general accuracy of personal information about individuals provided in ChatGPT responses. PIPEDA's accuracy principle requires that personal information be as accurate, complete, and up-to-date as necessary for its intended purpose. That gap — acknowledged by the company and flagged by regulators — signals where scrutiny will fall for any organization whose AI system generates statements about identifiable people.

British Columbia's privacy commissioner took the strictest position. The OIPC-BC found that ChatGPT's training on scraped data contravenes PIPA-BC's consent requirements, and that complaint remains unresolved. Organizations with operations in BC face a higher bar than the federal PIPEDA analysis alone suggests.

One in Five Canadian Businesses Is Now an AI User

The OPC's heightened focus lands at an inflection point in Canadian AI adoption.

Statistics Canada's Q2 2026 analysis found that 19.2% of businesses used AI to produce goods or deliver services over the preceding 12 months — roughly triple the 6.1% rate in Q2 2024. Among businesses already using AI, the three most common applications were data analytics (36.6% of AI users), text analytics (34.5%), and virtual agents or chatbots (28.2%).

Put those figures together: nearly one in five Canadian businesses now uses AI in some operational capacity, and the most common use cases — analytics, text tools, chatbots — all process the kind of personal information that PIPEDA governs. Meanwhile, PIPEDA complaints are at record levels, and regulators have just issued their first landmark ruling against an AI system.

The question for most Canadian SME and mid-market organizations is no longer whether PIPEDA applies to their AI deployments. It does. The question is whether their governance is keeping pace with their deployment.

What This Means for Organizations Using AI — Not Just Building It

The ChatGPT investigation targeted an AI developer. But the OPC's findings articulate PIPEDA obligations that apply to any organization using AI tools to process Canadians' personal information — which is exactly what most business AI deployments involve.

Consent still applies, even with enterprise tools. Deploying Microsoft Copilot, Google Workspace AI features, or Claude for Enterprise transfers some compliance responsibility to you as the data controller. Your obligation is to ensure that the data your employees feed into those tools — customer records, emails, contracts, call transcripts — was collected with consent for uses that include AI processing. If your original privacy consent language predates your AI deployment, it may no longer be adequate.

Vendor agreements don't substitute for your own governance. The OPC acknowledged that enterprise data processing agreements can be meaningful mitigations — but those terms still require review. The questions to answer: Does the vendor use your data to train their models? Where is data stored? What are the retention and deletion terms? These are no longer routine due-diligence checkboxes; they are questions regulators will ask in an investigation.

Provincial law matters, and it can be stricter. If your organization collects data from residents in Quebec, British Columbia, or Alberta, you face privacy obligations that equal or exceed PIPEDA in important respects. Quebec's Law 25 requires a Privacy Impact Assessment for projects involving personal information acquired from a third party, automated profiling, or biometric data — all of which can apply to AI deployments. The ChatGPT investigation showed that provincial regulators sometimes reach stricter conclusions than the federal OPC on identical facts.

Accuracy obligations now extend to AI outputs. The ChatGPT finding flagged OpenAI's failure to validate output accuracy as a specific compliance gap. If your AI system generates content about customers, employees, or third parties — customer-facing chatbots, AI-generated recommendations, automated correspondence — building in an output review process is no longer best practice. It is a regulatory expectation.

The Regulatory Gap Creates Its Own Risk

Canada currently has no federal AI-specific law in force. Bill C-27 and the Artificial Intelligence and Data Act died when Parliament was prorogued in January 2025 and have not been reintroduced. The federal government's AI for All strategy, launched June 2026, includes investment in AI programs and skills development, but no binding federal AI regulatory timeline has been confirmed.

This gap creates a particular risk for Canadian organizations. With no AI Act setting a national standard, PIPEDA — a law written before large language models existed — is the operative framework. Regulators are applying its principles creatively, and the complaint volume suggests Canadians are paying attention. Organizations operating under the assumption of "we'll get serious about AI compliance when there's a real AI law" are already behind: enforcement is happening under the existing framework, now.

The CCCS Cyber Security Awareness Month 2026 survey found that 73% of Canadians are concerned about AI-related cybercrime. That level of public concern feeds the complaint culture the OPC is now navigating. It is not a sentiment likely to diminish.

Five Steps to Take Before Year-End

The OPC's findings and complaint surge do not require a complete overhaul — but they do require specific, targeted action. These are the highest-priority items for Canadian organizations that have deployed or are actively using AI tools.

1. Audit your AI tools against your PIPEDA obligations. List every AI tool your organization uses that processes personal information. For each one, document what data it processes, the legal basis for that processing, and whether that basis covers AI-specific uses.

2. Review and update your consent language and privacy notices. If your privacy notice does not describe AI processing, it likely creates a compliance gap. Add language that is specific about how personal information may be used in AI contexts — including vendor-side training implications, if applicable.

3. Assess your vendor agreements for training data and retention terms. For each AI vendor, confirm: Does the vendor train on your data? What are the data retention and deletion terms? Are you operating under a data processing agreement that satisfies PIPEDA's safeguard and accountability principles?

4. Build a process for assessing AI output accuracy. Any AI system that generates information about identifiable individuals — chatbots, automated recommendations, AI-drafted correspondence — needs a review step that catches materially inaccurate outputs before they reach the person they concern.

5. Verify your provincial obligations separately. If your operations touch Quebec, BC, or Alberta residents, get advice on those provincial frameworks independently. The ChatGPT investigation established that provincial regulators can and do reach stricter conclusions than the federal analysis on the same technology.

Sources

• Office of the Privacy Commissioner of Canada. *Championing Privacy in the Age of AI: 2025–2026 Annual Report.* priv.gc.ca (June 2026)
• Office of the Privacy Commissioner of Canada. *PIPEDA Findings #2026-002: Joint Investigation of OpenAI OpCo, LLC.* priv.gc.ca (May 2026)
• Office of the Privacy Commissioner of Canada. *Backgrounder: Summary of joint investigation into OpenAI's ChatGPT.* priv.gc.ca (May 2026)
• Statistics Canada. *Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026.* statcan.gc.ca (June 2026)
• Lexpert. *Federal privacy commissioner's annual report notes 109 percent increase in PIPEDA complaints.* lexpert.ca (June 2026)
• Government of Canada — Communications Security Establishment. *Cyber Security Awareness Month 2026.* canada.ca (October 2026)

Not sure how your AI deployments stand against current OPC guidance? Cloud Forces' AI Advisory service includes a privacy and governance review as part of our AI Readiness Assessment — we map your AI tools against PIPEDA obligations and provincial requirements, and identify the gaps before regulators do. As an AWS Consulting Partner since 2019 and a team certifying on Claude, we work with Canadian SMEs and mid-market organizations across sectors including professional services, financial services, and technology. Book a consultation to find out where you stand.