The short answer: using ChatGPT in your BC business is not illegal, but whatever you paste into it is still personal information under BC's Personal Information Protection Act, and you remain responsible for it. On 6 May 2026, Canada's federal, BC, Alberta and Quebec privacy regulators jointly found that OpenAI's collection of personal information to train ChatGPT did not comply with Canadian privacy law; BC and Alberta declined the resolution and marked the file well-founded but unresolved. The practical rules: use a business-tier account rather than a personal one, strip names and addresses out of prompts, and treat anything you would not email to a stranger as off limits.
Most local businesses started using AI the same way: one owner pasting a rambling voicemail into ChatGPT to turn it into a tidy quote email. It works. It also means a customer's name, address and phone number just left your business and went to a server in another country.
That is not a reason to stop. It is a reason to set two or three rules and get on with it.
What actually happened in May 2026
On 6 May 2026, the Office of the Privacy Commissioner of Canada, along with the regulators for British Columbia, Alberta and Quebec, published the findings of a joint investigation into OpenAI. The investigation looked at how ChatGPT was built — where its training data came from, and whether people whose information was scraped had ever consented.
The regulators found that they had not. Scraping personal information from the open internet without people's knowledge or consent does not meet the consent requirement in BC's Personal Information Protection Act.
Most provinces accepted a set of commitments from OpenAI. BC and Alberta did not. Those files are marked well-founded but unresolved. BC's Information and Privacy Commissioner, Michael Harvey, went further, saying that ChatGPT by design cannot comply with the province's privacy law as currently written, and wrote to BC's Minister of Citizens' Services arguing that PIPA's consent provisions no longer fit a data-driven world.
Read that carefully, because it is easy to over-read. The finding is about how OpenAI built its product, not about you using it. Nobody has told BC businesses to stop using AI tools. What the finding does is remove any comfort that "a big company handles it, so it must be fine".
What the law actually asks of you
BC private businesses are governed by PIPA, not the federal PIPEDA. It is administered by the Office of the Information and Privacy Commissioner in Victoria. Three obligations matter here.
You need consent for what you collect and how you use it. Your customer consented to you having their address so you could come and fix their furnace. That is not automatically consent for their details to be processed by a third-party AI service.
You have to protect it. Reasonable security arrangements are your obligation, and they do not stop at your own laptop. If you hand information to a vendor, you are still on the hook.
You have to be able to say where it went. A customer can ask what personal information you hold about them. "It's somewhere in my chat history" is not a comfortable answer.
None of this is unique to AI. It is the same rule that already applies to your CRM, your booking tool and your accountant's Dropbox. AI chat just makes it very easy to paste something in without thinking.
The paste test
Here is the working rule I use, and it is short enough to put on a wall.
If you would not email it to a stranger, do not paste it into a consumer AI chat window.
| Fine to paste | Strip it first | Do not paste |
|---|---|---|
| "Write a follow-up email for a customer whose furnace quote I sent two weeks ago" | Customer names, street addresses, phone numbers, emails | Health information about a named person |
| Your own service descriptions and pricing | Invoice numbers and account references | Anything covered by a confidentiality agreement |
| A public Google review you want to reply to | Photos with plates, house numbers or documents visible | Employee records, SIN, banking details |
| A rough draft in your own words | Supplier contract terms | Client financial or mortgage details |
The middle column is the one that matters most in practice. Almost every real prompt works just as well with "the customer" in place of a name. The AI does not need to know it is Dave on Springhill Drive to write a good follow-up.
Consumer accounts versus business accounts
This is the single most actionable difference, and most owners do not know it.
On free and personal paid ChatGPT accounts, your conversations may be used to help improve OpenAI's models unless you turn that setting off yourself. On business, enterprise and API accounts, business data is not used for training by default — it is a contractual commitment rather than a setting an employee can flip.
Two caveats worth holding onto:
- "Not used for training" is not the same as "not stored". Conversations are still transmitted and retained for a period for abuse monitoring.
- The same distinction exists across most of the major tools, but the details differ. Check the terms of whatever you actually use, not what a competitor's blog says about it.
If your business runs any customer information through an AI tool, the business tier is the cheapest risk reduction available. It is usually a few dollars a month per person.
A one-page rule for your staff
Whatever you decide, write it down. Most small-business data problems are not decisions, they are the absence of one.
- Name the approved tools. One or two, on business accounts, paid by the business. Anything else is not approved, including someone's personal account on their phone.
- Write the paste rule. Copy the table above if you like. One page, no legal language.
- Decide what happens with output. AI-drafted quotes and emails get read by a person before they go out. This catches both privacy slips and the confident, wrong details these tools invent.
- Turn off training on any personal account still in use. It is a settings toggle, and it takes a minute.
- Review it when you add a tool. Every new AI feature bolted onto software you already pay for is a new place your data goes.
That is a twenty-minute job for most local businesses, and it is the difference between "we thought about this" and "we had no idea".
Where this leaves automation
None of this argues against automating your business. It argues for automating it deliberately.
The automations that pay for themselves fastest — missed-call text-back, quote follow-up, booking, review requests — mostly run on systems you already control, where customer data stays inside tools you have a contract with. That is a different risk profile from an owner pasting client details into a chat window at 9 pm.
It is also why scoping matters more than tooling. The reason most small-business AI projects fail is that nobody defined the job, the data, or the limits before buying. Privacy belongs in that same conversation. When I set up AI automation for a Kamloops business, where the customer data lives and who can see it is part of the build, not an afterthought.
If you want a sense of what your manual admin actually costs before you decide how far to take this, the automation savings calculator gives you the number in about a minute.
Common questions
Is it illegal to put customer information into ChatGPT in BC? No. There is no ban on using AI tools. But customer details are personal information under BC's Personal Information Protection Act, and your obligations for consent, security and accountability follow that information wherever you send it — including to an AI vendor.
What did Canada's privacy regulators decide about ChatGPT? On 6 May 2026 the federal, BC, Alberta and Quebec regulators jointly found that OpenAI's collection of personal information for training ChatGPT did not meet Canadian privacy law, particularly on consent. BC and Alberta declined the resolution, marking the file well-founded but unresolved.
Does a paid ChatGPT account keep my data private? It depends which paid account. On free and personal paid plans, conversations may be used to improve models unless you opt out in settings. On business, enterprise and API plans, business data is not used for training by default. In all cases, conversations are still transmitted and retained for a period.
What should I never paste into an AI chat window? Health information about a named person, employee records, banking or SIN details, client financial information, anything under a confidentiality agreement, and photos showing plates, house numbers or documents. Most other prompts work fine once names and addresses are removed.
Do I need a privacy policy that mentions AI? If you use AI tools on information that identifies your customers, your privacy policy should say so in plain language: what you use it for, and that a third-party service processes it. It costs nothing to add and it is the honest answer if a customer asks.
The honest summary
The May 2026 findings are a warning about the industry, not a prohibition on you. Your job is smaller than it sounds: move to business-tier accounts, take names and addresses out of prompts, keep a human reading anything that goes to a customer, and write the rule down so it survives your next hire.
Written by Jagatjeet — Jagatjeet (jagatjeet.com) is a web design, local SEO and AI automation studio in Kamloops, British Columbia, serving the Thompson-Okanagan and BC Interior. Published 3 August 2026. Last updated 3 August 2026. This article summarises publicly available regulatory findings as of that date and is not legal advice.