Key takeaways
- Of 10 published CAI and OPC enforcement actions, five involve cameras or faces and three involve AI training data. Not one is about cookie banners or paper privacy policies.
- The CAI has used binding orders three times, all against physical surveillance: grocery-store facial recognition, workplace facial recognition, and dashcams filming truck cabs. The pattern is the body, not the browser.
- Zero monetary penalties appear in any of the 10 actions. The weapon of choice is a published decision or corrective order, which means reputational risk arrives before any fine does.
Counting what the enforcers actually did
My site tracks published enforcement actions from Quebec’s CAI and the federal OPC. The count: 10 actions, five each; three binding orders, all CAI; seven investigation decisions; September 2024 to June 2026.
Sorted by what the regulator actually went after, the result should change how you spend your compliance budget.
| Target | Actions | Share of 10 |
|---|---|---|
| Cameras and faces (facial recognition, in-cab video) | 3 | 30% |
| AI training data (ChatGPT, TikTok, Grok) | 3 | 30% |
| Retention failures (loyalty data, resold laptops) | 2 | 20% |
| Individual rights (de-listing, photo consent) | 2 | 20% |
| Cookie banners, consent flows, paper policies | 0 | 0% |
Nobody got fined: every penalty field in the tracker reads null. Law 25 gives the CAI the power to impose administrative penalties. It has not used it once in the published record. The bite is the order and the publication.
The camera file
The three CAI orders read like a field guide to physical surveillance gone wrong.
Metro Inc., February 2025. The grocer planned a facial-recognition pilot across its Metro, Super C, and Jean Coutu banners to flag past shoplifters, which required a bank of biometric characteristics. The CAI prohibited the bank from going live: verifying identity with biometrics requires express consent, and shoppers were never asked.
Société Imprimeries Transcontinental, September 2024. A printing company used facial recognition for employee access, a system born in the COVID temperature-screening era and kept running after. The CAI ordered it to stop collecting employees’ facial biometrics, stop using the system, and destroy the templates within 90 days.
Crane Supply, May 2025. Delivery trucks with dashcams filming inside the cab, recording continuously over 14-day periods. The CAI ordered collection limited to a few seconds around incidents, recording stopped after engine shutdown, excess footage destroyed, and access restricted.
Three orders, one lesson: point a camera at people and your justification had better hold up. The CAI is not waiting for a complaint cycle to finish.
The AI file
The three AI actions came as joint or commissioner-initiated investigations, and they all center on the same question: did you have a lawful basis for the personal information you fed the model?
The joint OpenAI finding concluded the initial ChatGPT training-data collection was overbroad and non-compliant with Quebec’s Private Sector Act, with four recommendations. The September 2025 joint investigation into TikTok examined minors’ data practices. The June 2026 OPC investigation into xAI’s Grok was well-founded and unresolved: no valid consent for using personal information to generate sexually explicit deepfakes, a purpose a reasonable person would call inappropriate.
Notice what is missing. None of these actions dispute that AI is being built. They dispute the data pipeline underneath it: collection without consent, purposes nobody would defend, no meaningful way to get your data out. If you deploy AI features, your training and input data are the enforcement surface, not the model card.
The retention file
The two retention cases are the quiet ones, and the ones most organizations should fear.
Loblaw kept PC Optimum purchase history after account deletion, arguing that stripping direct identifiers made it anonymous. The OPC found deletion unreasonably slow and anonymization unproven. Staples resold returned laptops through Openbox without adequately wiping prior customers’ data, with procedures and training the OPC found inadequate.
Old data you kept “just in case” is the classic breach multiplier. These two decisions say what the camera cases say: what gets examined is the physical and operational footprint of your data practices. Your retention schedule is the document that decides whether a 2019 record shows up in a 2026 incident.
The two outliers worth keeping
Google was told to de-list decade-old articles about a complainant’s stayed criminal charge from name searches, a finding it did not accept. A swimming pool that made promotional photos of children a condition of lessons was found to have tied consent to service unlawfully. Both are reminders that individual rights cases still land, and that “everyone does it” has never been a defense.
The question nobody can answer yet
Ten actions, zero fines, three orders against cameras. The pattern is legible. What is not legible is whether the CAI’s penalty power stays theoretical forever, and whether the joint AI investigations produce anything a company must obey rather than negotiate. Quebec wrote the biggest stick in Canadian privacy law. Two years into full enforcement, it has swung everything except that stick.
Actionable takeaway: Pull your three highest-risk physical or operational data collections this week: cameras, biometrics, loyalty or retention databases, any AI feature touching personal information. For each, write down the consent basis, the retention clock, and the destruction proof. If any answer is missing, you now know what file the regulator opens first.