Privacy
AI apps and your privacy in Canada: what data they collect and what rights you have
Chat assistants, photo editors and voice apps can be genuinely useful. They also work by processing what you give them. Here is what that can include, and what Canadian privacy law says about it.
AI features now sit inside writing tools, photo apps, keyboards and customer service chats. Each of them needs data to work. Knowing what that data is, and what your rights are in Canada, helps you decide what to share and what to keep to yourself.
What AI apps may collect
Every app is different, and its privacy policy is the place to check the details. Broadly, AI apps may handle the following kinds of information.
- What you type
- Questions, prompts and any text or documents you paste in.
- What you upload
- Photos, files, screenshots and voice recordings.
- What the app creates
- The answers and images it generates, which may be stored with your history.
- Account details
- Your name, email address and, if you pay for a plan, billing details.
- Technical data
- Device type, approximate location from your internet connection, settings and usage logs.
The content you type or upload is the part people tend to forget. A chat about a health worry, a pasted work contract or a photo of a family member can all contain personal information, about you or about other people.
How that data may be used
Common uses include providing the service itself, keeping your conversation history, preventing abuse and fixing errors. Some providers also use conversations to improve or train future models, sometimes with a setting that lets you opt out. Some content may be reviewed by people for quality and safety checks.
These uses differ between apps and can change over time. Reading the privacy policy, or at least its summary, before you share sensitive material is the most reliable way to know what will happen to it.
PIPEDA: the federal law for businesses
In most of Canada, the Personal Information Protection and Electronic Documents Act, known as PIPEDA, governs how private-sector organizations collect, use and disclose personal information in the course of commercial activity. Some provinces, including Quebec, Alberta and British Columbia, have their own private-sector privacy laws that apply instead in many situations.
PIPEDA is built on ten fair information principles. Several of them matter directly for AI apps:
- Accountability: the organization is responsible for the personal information under its control.
- Identifying purposes: it should tell you why it collects information, at or before the time of collection.
- Consent: meaningful consent is generally required, so you should be able to understand what you are agreeing to.
- Limiting collection, use and retention: it should collect only what it needs for the stated purposes and keep it only as long as necessary.
- Safeguards: it must protect the information with security suited to its sensitivity.
- Openness: its privacy policies should be available and understandable.
Proposals to modernize federal privacy law, including rules aimed specifically at AI, have been discussed in Parliament for several years. A proposal only changes your rights once it is passed and comes into force, so this article describes PIPEDA, the federal law that applies today.
Your rights under PIPEDA
| Right | What it means | How to start |
|---|---|---|
| Access | Ask what personal information an organization holds about you and how it has been used or disclosed. | Send a written request to the organization's privacy contact. |
| Correction | Challenge the accuracy or completeness of your information and ask for it to be amended. | Point out the error and ask for a correction. |
| Withdraw consent | Withdraw consent at any time, subject to legal or contractual limits and reasonable notice. | Change the app's settings or contact the organization. |
| Complain | Raise a concern with the organization, then with the Office of the Privacy Commissioner of Canada. | Use the organization's process first; the Commissioner's office explains the next steps. |
Organizations generally have 30 days to respond to an access request, with limited extensions. They can refuse some requests for reasons set out in the law, but they should tell you why in writing.
Everyday habits that help
- Keep sensitive details out. Health card numbers, passwords, banking details and other people's personal information do not belong in a chat box.
- Check two settings. Look for chat history and for whether your content is used to improve the service.
- Clean up. Use the app's delete or export tools when you finish a sensitive conversation.
- Mind work material. Your employer may have rules about pasting documents into AI tools.
- Look at age settings. Many AI apps set minimum ages, and some offer family controls.
Where to learn more
The Office of the Privacy Commissioner of Canada publishes plain-language guidance for individuals at priv.gc.ca, including how to make a complaint. If you live in a province with its own private-sector privacy law, your provincial privacy commissioner's office offers similar guidance.
AI apps are not unusual in collecting data; most digital services do. What is different is how much personal detail people willingly type into them. A minute spent on the settings, and a moment of thought before you paste something sensitive, goes a long way.
This article is general information about Canadian privacy law. It is not legal advice. For your own situation, contact the organization involved, the Office of the Privacy Commissioner of Canada or a lawyer.