Italy - Temporary Order Against ChatGPT

Overview

The Provvedimento of 11 April 2023 (Registro dei provvedimenti n. 114) issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali) followed an emergency limitation adopted on 30 March 2023 against OpenAI's ChatGPT service. The April 11 decision conditionally suspended the earlier limitation in view of commitments presented by OpenAI while continuing the formal inquiry and reserving the right to further enforcement action. The Garante framed its decision around transparency obligations, the legal basis for processing personal data used to train large generative models, the rights of data subjects (including non‑users whose data may be in training corpora) and measures to prevent access by under‑age children. The full official narrative and the text of the Garante communications are available from the authority’s website: Garante – Provvedimento 11 April 2023 (print view) and related communiqués such as Intelligenza artificiale: il Garante blocca ChatGPT.

Definitions

For the purposes of the provvedimento: "Controller/Titular del trattamento" refers to OpenAI L.L.C. as identified by the Garante; "processing for training" denotes collection and retention of personal data (including content of user interactions and third‑party data) to tune and develop underlying machine‑learning models; "interested parties" includes both users of ChatGPT and non‑users whose data were identified as having been included in training datasets; "age gate" and "age verification" refer to procedural and technological measures to exclude or obtain verifiable parental consent for under‑13s (or other age thresholds required by law); and "prescriptions" are the specific injunctive requirements set out by the Garante in Provvedimento n.114.

Governance and Institutional Framework

The Garante exercised powers under Article 58 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) and applicable provisions of the Italian Data Protection Code (d.lgs. 196/2003). The authority's approach combined urgent injunctive powers (initial emergency limitation of 30 March 2023, subsequently ratified) with a conditional supervisory remedy (the 11 April 2023 provvedimento) that hinged on demonstrable remediation by the controller. The Garante coordinated with other EU data protection authorities and the European Data Protection Board (EDPB) which established a task force addressing generative AI concerns; see the Garante's announcement on EU cooperation at Garante – task force / EDPB. The institutional framework thus blended national enforcement discretion with EU‑level cooperation mechanisms and highlighted the cross‑border enforcement dynamics typical of digital platforms operating in the EU.

Key Focus Areas

Provvedimento n.114 emphasized several focus areas: (1) Transparency and information duties — the Garante required a clear, accessible notice explaining the categories of data used for model training, processing logic and the rights of data subjects; (2) Legal basis and accountability — the controller had to remove references to 'contract' as a legal basis for training and instead specify consent or legitimate interest with associated accountability measures, and provide mechanisms that permit the exercise of the right to object; (3) Rights of non‑users — the decision explicitly recognized remedies for individuals whose data may have been included in training without their active interaction with the service; (4) Age verification and protection of minors — an immediate age gate at restart and a plan for robust verification were required; (5) Remedies and redress — tools for rectification, deletion and opposition must be provided and made easily accessible; (6) Public awareness — a non‑promotional public information campaign was mandated to notify potentially affected individuals. The Garante set concrete deadlines and required the company to report the measures taken within specified timelines. For official Garante communications and the text of subsequent updates, see Garante – OpenAI collaborates, April updates.

Implementation Framework

Implementation under the provvedimento was pragmatic and time‑bound. The Garante ordered that items 1–7 (core transparency, rights mechanisms, immediate age gate, removal of contractual basis wording and other immediate safeguards) be fully implemented by 30 April 2023. Secondary items — submitting an age‑verification plan by 31 May 2023 and implementing verification mechanisms by 30 September 2023 — allowed staged technical deployment while obliging the company to present concrete roadmaps. The Garante required the company to provide confirmations and documentary evidence of the steps taken. The authority retained the right to verify the effectiveness of technical measures and to adopt urgent additional steps if implementation was inadequate. The Garante’s public notices set out these timelines in detail; see the Garante press releases at Garante – OpenAI reopens with commitments.

Monitoring and Evaluation

The Garante made continued oversight explicit: the authority would assess the adequacy and sufficiency of measures, retain the ability to verify technical implementations, and continue the formal investigatory procedure (istruttoria). Reporting obligations required the controller to communicate progress and to supply the authority with the documentation of measures taken by the specified deadlines. The Garante also signalled cooperation with peer authorities through the EDPB task force, enabling cross‑checking of evidence and coordinated action where processing affected residents across EU Member States.

Penalties, Liability, and Appeals

The provvedimento invoked the Garante's enforcement remit under GDPR Article 58 and linked potential sanctions to breaches of Article 83 (administrative fines). The Garante explicitly warned that failure to respond to Article 58 requests may trigger penalties as per Article 83(5)(e) GDPR. Separately, the authority preserved the right to impose other measures (temporary or definitive) at the conclusion of the formal inquiry. The provvedimento explained judicial remedies: parties may challenge the administrative measure before national ordinary courts (appeal terms specified in the measure). For the Garante's statements on sanctions and procedural rights, consult Garante – provvedimento (print).

Relationship to Other Instruments

Provvedimento n.114 sits within the GDPR enforcement architecture and interacts with Italian data protection legislation (d.lgs. 196/2003 as amended). It also formed part of a broader set of national supervisory actions in spring 2023 targeting generative AI and data practices (including separate inquiries into other chatbot providers). Additionally, the Garante's actions informed and were informed by EU‑level coordination via the EDPB and by evolving discussions on the EU AI Act, though the provvedimento was based on GDPR enforcement powers rather than AI Act rules (which were under negotiation at that time). The measure functioned as a supervisory bridging instrument between immediate protective action and longer‑term regulatory frameworks for AI.

International Alignment

The Garante explicitly engaged with other EU supervisory authorities through the EDPB task force to ensure coordinated oversight of cross‑border AI services and to share technical and legal assessments. The action signalled regulator expectations internationally: transparency over model training, lawful legal bases for large‑scale data processing, demonstrable age‑verification mechanisms, and meaningful access and redress routes for data subjects. The Garante’s communiqué highlights cooperation with OpenAI representatives and with EU counterparts; see the Garante press note on cooperation and commitments at Garante – OpenAI collaborates.

Implementation Timeline

Sources and References