AI and privacy in Canada: how to protect your personal information

The short answer

• **What you type into an AI tool leaves your device.** It is stored by the provider, may be reviewed for safety, and may be used for training unless you opt out.
• **Canadian privacy law applies to AI.** Organisations need a valid reason and, usually, your consent to collect and use your personal information — including to train or run AI.
• **You have rights.** You can ask what an organisation holds about you, correct it, withdraw consent and complain to a privacy commissioner.
• **Small habits protect you most.** Share less, change a few settings, and think twice about photos and voice.

Where your data goes when you use AI

1. **Your device** sends your prompt, files, photos or voice to the provider's servers — often in the United States — unless the model runs locally.
2. **The provider stores it** with your account, for a period set by its [retention policy](/glossary/data-retention), even after you delete a chat.
3. **Automated systems and sometimes people review it** to detect abuse and improve safety.
4. **It may train future models**, depending on your settings and plan. Data used in training can't practically be removed later.
5. **Connected apps and plug-ins** may receive it too, under their own policies.
6. **AI features in other apps** — email, photo, office suites — often send content to an AI provider behind the scenes; their privacy policies should name who.

The laws that protect you

Canada has several privacy laws, depending on who holds your information and where. None is specific to AI, but all of them apply to it.

Québec's Law 25 goes furthest: organisations must name a person in charge of protecting personal information, assess privacy risks before new projects and before sending data outside Québec, report serious incidents, keep tracking technologies off by default, and tell you when a decision about you is made solely by automated means.

Your rights, and how to use them

• **Access.** Ask an organisation what personal information it holds about you and how it's used. Under PIPEDA it generally must answer within 30 days.
• **Correction.** Ask for inaccurate information to be fixed.
• **Withdraw consent.** You can withdraw consent for many uses, subject to legal or contractual limits — including, with many AI providers, use of your chats for training.
• **Automated decisions (Québec).** Be told when a decision was automated, learn the main factors, and have it reviewed by a person.
• **Portability and de-indexing (Québec).** Get your data in a usable format, and ask that information about you stop being disseminated or indexed in some circumstances.
• **Complain.** If an organisation doesn't respond or you think your rights were breached, complain to the relevant commissioner. It's free.

Ten steps you can take today

1. Turn off training on your chats in each AI assistant you use (see [where to find it](/guides/use-ai-assistants-safely#settings)).
2. Use temporary or incognito chats for health, money, legal or family questions.
3. Review and prune what the assistant's [memory](/glossary/ai-memory) has stored about you.
4. Replace names and numbers with placeholders before pasting documents.
5. Crop or blur faces, licence plates, addresses and ID cards before uploading photos.
6. Remove connected apps and plug-ins you no longer use.
7. Be cautious with voice features: a few seconds of audio can be enough to [clone a voice](/glossary/voice-cloning).
8. Check the privacy settings of AI features built into your phone, email and photo apps.
9. Set your social-media profiles to limit public posts and photos being scraped.
10. Talk with your kids about what not to share with chatbots and apps.

AI in public spaces and at work

[Facial recognition](/glossary/facial-recognition) and other biometric tools raise the highest privacy stakes, because you can't change your face. In 2021 Canada's privacy commissioners found that Clearview AI's mass collection of online photos was illegal in Canada, and the federal commissioner found the RCMP broke the law by using it. Employers, too, must keep employee monitoring reasonable and transparent; in Ontario, employers with 25 or more staff need a written electronic monitoring policy. See [AI and jobs in Canada](/guides/ai-and-jobs-in-canada#rights).

For organisations: a privacy checklist for AI projects

1. **Know your data.** List what personal information the AI will see, from whom, and why it's needed.
2. **Assess the risk first.** Do a privacy impact assessment — required in Québec for new technology projects involving personal information and before transferring it outside the province.
3. **Read the vendor's terms.** Confirm in writing that your data won't train their models, where it's stored, how long it's kept and who can access it.
4. **Get meaningful consent** where needed, and update your privacy policy to name AI uses and providers.
5. **Minimise and de-identify.** Send the AI only what it needs; strip identifiers when you can.
6. **Keep humans accountable** for decisions about people, and be ready to explain them.
7. **Plan for incidents.** Know how you'd detect, record and report a breach involving an AI tool.
8. **Name an owner.** Someone must be responsible for privacy — in Québec this is a legal requirement.

Small businesses can start with our [practical guide to AI for small business](/guides/ai-for-small-business).

How AI Broadsheet handles your privacy

We practise what we report. You can read everything without an account; our analytics are cookieless; ads are non-personalised unless you agree; Young Lab collects nothing about children. Details are on our [privacy page](/privacy).