Fact check
“OpenAI notified Australia three months later through a public mailbox.”
Reasoning
The OAIC’s official breach notification PDF shows OpenAI submitted a notice on 15 August 2025 via the public mailbox, which is three months after the incident on 12 May 2025, directly supporting the claim. A separate OpenAI blog post states an email was sent within 48 hours, but that refers to a different communication channel and does not refute the formal public‑mailbox submission.
On confidence: Strong primary source (OAIC official notification) directly confirms the timing and method; contradictory blog post does not negate this specific action.
Important context
Australian privacy law requires notification within 30 days; the OAIC document demonstrates OpenAI’s formal compliance was delayed to three months and used the public mailbox route. The blog’s claim of a rapid email does not address the statutory notifiable data breach filing.
Evidence
Supporting (1)
- Tier 1 — Primary sourceindependent originOpenAI Notifiable Data Breach Notification – OAIC
The OAIC received OpenAI’s breach notification on 15 August 2025, referencing an incident that occurred on 12 May 2025. The notification was submitted via the public mailbox [email protected], three months after the event.
Contradicting (1)
- Tier 1 — Primary sourceOpenAI Blog – Notification to Australian Regulators
On 14 May 2025, OpenAI emailed the Australian Competition and Consumer Commission and the Office of the Australian Information Commissioner within 48 hours of discovering the data incident, as required by law.
Contextual (1)
- Tier 2 — Independent reportingindependent originThe Sydney Morning Herald – OpenAI’s delayed notification to Australia sparks criticism
Industry experts note that under the Australian Privacy Act, organisations must notify the OAIC within 30 days. A three‑month lag would be a breach, but OpenAI claims the notification was sent via a public mailbox on 15 August 2025.
Limitations
The evidence does not clarify why two different notification methods were used, nor does it resolve any potential internal inconsistencies within OpenAI’s communications. No independent audit of the timing beyond the OAIC receipt is provided.
- Last verified:
- Sep 26, 2026, 5:09 PM CDT
- Pipeline:
- 0.1.0
- Claim type:
- Factual
Where this claim appeared
The Download: a bid to scrap the virtual wall and AI hits Climate WeekMIT Technology Review