Italian Data Protection Authority (Garante) — OpenAI (ChatGPT)
Garante temporarily banned ChatGPT in Italy over: (1) no legal basis for processing personal data to train the model, (2) no age-verification despite obvious minor exposure, (3) inadequate transparency to users, and (4) a March 2023 data leak exposing other users' conversations. OpenAI restored service on 28 April 2023 after meeting Garante's interim requirements. Legal basis cited was GDPR — but the substance (training-data transparency, age-gating of a generative AI service, user-facing disclosure) is exactly what EU AI Act Articles 50 (transparency for generative AI) and 52 (deepfake labelling) now address.
Key takeaway — how to prevent this
Don't overstate AI capabilities to investors or customers. 'AI-washing' — claiming AI you don't have, or that doesn't work as described — triggers securities and consumer-protection enforcement; disclosures must match reality.
Case brief
Read from the order on 2026-09-19. Every holding carries a short verbatim quote from that text (in IT, the document's language).
- Decided by
- Garante per la protezione dei dati personali
- Parties
- Garante per la protezione dei dati personali v. OpenAI L.L.C.
- Decision date
- March 30, 2023
- Remedy
- The Garante ordered OpenAI L.L.C. to immediately place a temporary limitation on processing the personal data of data subjects located in Italy.
- Appeal
- Appeal status not stated
Key holdings
OpenAI failed to provide a privacy notice to users and data subjects whose personal data was collected and processed through ChatGPT.
“non viene fornita alcuna informativa agli utenti, né agli interessati i cui dati sono stati raccolti da OpenAI, L.L.C. e trattati tramite il servizio di ChatGPT;” — Registro dei provvedimenti n. 112 del 30 marzo 2023
There is no suitable legal basis for collecting and processing personal data to train the algorithms underlying ChatGPT.
“l’assenza di idonea base giuridica in relazione alla raccolta dei dati personali e al loro trattamento per scopo di addestramento degli algoritmi sottesi al funzionamento di ChatGPT;” — Registro dei provvedimenti n. 112 del 30 marzo 2023
The processing of personal data is inaccurate because the information provided by ChatGPT does not always correspond to real facts.
“il trattamento di dati personali degli interessati risulta inesatto in quanto le informazioni fornite da ChatGPT non sempre corrispondono al dato reale;” — Registro dei provvedimenti n. 112 del 30 marzo 2023
OpenAI failed to implement age verification mechanisms, exposing children under 13 to inappropriate content.
“l’assenza di qualsivoglia verifica dell’età degli utenti in relazione al servizio ChatGPT che, secondo i termini pubblicati da OpenAI L.L.C., è riservato a soggetti che abbiano compiuto almeno 13 anni;” — Registro dei provvedimenti n. 112 del 30 marzo 2023
The authority imposed an immediate temporary limitation on the processing of personal data belonging to data subjects in Italy.
“la misura della limitazione provvisoria, del trattamento dei dati personali degli interessati stabiliti nel territorio italiano;” — Registro dei provvedimenti n. 112 del 30 marzo 2023
In plain English
The Italian Data Protection Authority (Garante per la protezione dei dati personali) reviewed the operations of ChatGPT, an artificial intelligence application developed and managed by US company OpenAI L.L.C. Following its assessment, the authority identified several major breaches of European data protection regulations. First, OpenAI provided no privacy notice to users or affected individuals whose data was harvested and processed. Second, there was no legal basis authorizing the collection and processing of personal data for training the underlying algorithms of ChatGPT. Third, the personal data processed by ChatGPT proved inaccurate because the responses generated did not always match real-world facts. Fourth, although OpenAI terms restrict the service to individuals aged 13 and older, the system lacked any age verification mechanism, thereby exposing children under 13 to responses inappropriate for their level of development. As an urgent response to these violations, the Garante ordered OpenAI L.L.C. to immediately limit the processing of personal data of individuals located in Italy. The authority gave OpenAI 20 days to communicate the actions taken to implement the order and present its justifications, warning that failure to comply could trigger administrative fines and criminal liability.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.