The opt-out lives in the product. The right that matters more is in PIPEDA.
Short answer
Often, yes, if the vendor’s own settings offer an opt-out — that control lives in the product, not in Canadian law. What Canadian privacy law actually gives you is a related but different protection: accountability for your personal information that follows it into a vendor’s hands, whether or not training is involved.
Canada’s joint federal-provincial-territorial privacy principles for generative AI are blunt about where training data usually comes from: privacy authorities around the world have called on organizations to be cautious before scraping publicly accessible personal information, which is still subject to privacy law in most jurisdictions, because “such scraping is common practice when training generative AI systems”, per the OPC’s own principles page. The same document tells developers not to “develop or put into service generative AI systems that violate ‘no-go zones’”.
PIPEDA Schedule 1, clause 4.1.3 puts the accountability on whoever collected your information in the first place, not on the AI vendor: “the organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party”. If your own business collected the data being fed into a training pipeline, the identifying-purposes principle in PIPEDA means that use should have been disclosed to the person the data is about at collection time — the same obligation covered, for ordinary customer data, here. That obligation is not optional guidance, either: PIPEDA s.5(1) states plainly that “every organization shall comply with the obligations set out in Schedule 1”.
Turning off future training doesn’t erase the fact that the vendor already processed what you typed once. And if that vendor operates offshore, the OPC is explicit about the limits of any contract you sign with them: “what the organization cannot do through contract - or indeed by any other means - is to override the laws of a foreign jurisdiction”.
See also does AI store what I type for the related question of what happens to information after you’ve already typed it in.
Keeping track of what a vendor does with data over time, not just at sign-up, is an operations question.
